Aggregator

rust-backtrace-0.3.76-4.el9 rust-object-0.40.0-1.el9 rust-object0.37-0.37.3-3.el9 rust-object0.38-0.38.1-2.el9 rust-object0.39-0.39.1-1.el9 rust-ruzstd-0.9.1-1.el9

Fedora Security Advisories
4 hours 3 minutes ago
FEDORA-EPEL-2026-4645488364 Packages in this update:
  • rust-backtrace-0.3.76-4.el9
  • rust-object0.37-0.37.3-3.el9
  • rust-object0.38-0.38.1-2.el9
  • rust-object0.39-0.39.1-1.el9
  • rust-object-0.40.0-1.el9
  • rust-ruzstd-0.9.1-1.el9
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.el10_4 rust-object-0.40.0-1.el10_4 rust-object0.37-0.37.3-3.el10_4 rust-object0.38-0.38.1-2.el10_4 rust-object0.39-0.39.1-1.el10_4 rust-ruzstd-0.9.1-1.el10_4

Fedora Security Advisories
4 hours 3 minutes ago
FEDORA-EPEL-2026-4c9681f2f1 Packages in this update:
  • rust-backtrace-0.3.76-4.el10_4
  • rust-object0.37-0.37.3-3.el10_4
  • rust-object0.38-0.38.1-2.el10_4
  • rust-object0.39-0.39.1-1.el10_4
  • rust-object-0.40.0-1.el10_4
  • rust-ruzstd-0.9.1-1.el10_4
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.fc43 rust-object-0.40.0-1.fc43 rust-object0.37-0.37.3-3.fc43 rust-object0.38-0.38.1-2.fc43 rust-object0.39-0.39.1-1.fc43 rust-ruzstd-0.9.1-1.fc43

Fedora Security Advisories
4 hours 3 minutes ago
FEDORA-2026-9e7597548d Packages in this update:
  • rust-backtrace-0.3.76-4.fc43
  • rust-object0.37-0.37.3-3.fc43
  • rust-object0.38-0.38.1-2.fc43
  • rust-object0.39-0.39.1-1.fc43
  • rust-object-0.40.0-1.fc43
  • rust-ruzstd-0.9.1-1.fc43
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.fc44 rust-object-0.40.0-1.fc44 rust-object0.37-0.37.3-3.fc44 rust-object0.38-0.38.1-2.fc44 rust-object0.39-0.39.1-1.fc44 rust-ruzstd-0.9.1-1.fc44

Fedora Security Advisories
4 hours 4 minutes ago
FEDORA-2026-09783712f4 Packages in this update:
  • rust-backtrace-0.3.76-4.fc44
  • rust-object0.37-0.37.3-3.fc44
  • rust-object0.38-0.38.1-2.fc44
  • rust-object0.39-0.39.1-1.fc44
  • rust-object-0.40.0-1.fc44
  • rust-ruzstd-0.9.1-1.fc44
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.fc45 rust-object-0.40.0-1.fc45 rust-object0.37-0.37.3-3.fc45 rust-object0.38-0.38.1-2.fc45 rust-object0.39-0.39.1-1.fc45 rust-ruzstd-0.9.1-1.fc45

Fedora Security Advisories
4 hours 4 minutes ago
FEDORA-2026-e10e41c5b3 Packages in this update:
  • rust-backtrace-0.3.76-4.fc45
  • rust-object0.37-0.37.3-3.fc45
  • rust-object0.38-0.38.1-2.fc45
  • rust-object0.39-0.39.1-1.fc45
  • rust-object-0.40.0-1.fc45
  • rust-ruzstd-0.9.1-1.fc45
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.fc46 rust-object-0.40.0-1.fc46 rust-object0.37-0.37.3-3.fc46 rust-object0.38-0.38.1-2.fc46 rust-object0.39-0.39.1-1.fc46 rust-ruzstd-0.9.1-1.fc46

Fedora Security Advisories
4 hours 5 minutes ago
FEDORA-2026-d591b1e061 Packages in this update:
  • rust-backtrace-0.3.76-4.fc46
  • rust-object0.37-0.37.3-3.fc46
  • rust-object0.38-0.38.1-2.fc46
  • rust-object0.39-0.39.1-1.fc46
  • rust-object-0.40.0-1.fc46
  • rust-ruzstd-0.9.1-1.fc46
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

USN-8932-1: curl vulnerabilities

Ubuntu Security Advisories
4 hours 37 minutes ago
Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-86409) Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414) Stanislav Fort discovered that curl did not correctly handle HSTS entries when an includeSubDomains parent entry was imported before a longer-lived child entry. An attacker could possibly use this issue to cause curl to use unencrypted HTTP connections. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-87862) Stanislav Fort discovered that curl did not properly handle HSTS max-age values that exceeded calendar time structure bounds. An attacker could possibly use this issue to cause a denial of service or data loss. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-87863) Stanislav Fort discovered that curl did not properly handle IMAP APPEND commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be interpreted as pipelined commands. An authenticated attacker could possibly use this issue to inject arbitrary IMAP commands. (CVE-2026-87864) Joshua Rogers discovered that libcurl had a use-after-free vulnerability in the FTP wildcard matching code. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92388) Joshua Rogers discovered that libcurl's TFTP state machine did not properly validate transfer directions, allowing a malicious server to force the client into transmit mode. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92389) Joshua Rogers discovered that curl had a stack overflow vulnerability when processing deeply nested MIME structures. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-92391) Joshua Rogers discovered that libcurl could expose credentials in the URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved from a .netrc file. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-94266)

USN-8931-1: Apache HTTP Server vulnerabilities

Ubuntu Security Advisories
5 hours 41 minutes ago
이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-58415) Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote attacker could possibly use this issue to make a forward proxy connect to an arbitrary host. (CVE-2026-63045) Hyojae Lee and Zhen Kong discovered that Apache HTTP Server incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-63292) Lucian Nitescu and Zhen Kong discovered that Apache HTTP Server did not properly handle certain responses from backend servers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-63686) Qing Xu discovered that Apache HTTP Server incorrectly interpreted HTTP responses from backend servers. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63718) Hyojae Lee discovered that Apache HTTP Server did not properly validate Digest authentication requests. A machine-in-the-middle attacker could possibly use this issue to bypass authentication. (CVE-2026-73636) Zhen Kong and Darren Carreras discovered that Apache HTTP Server did not properly manage authentication requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-73637) Vlatko Kosturjak discovered that Apache HTTP Server did not properly enforce access restrictions for user directories. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-79768) Zhen Kong discovered that Apache HTTP Server did not properly handle certain WebDAV requests. An authenticated user could possibly use this issue to cause a denial of service or corrupt WebDAV property data. (CVE-2026-93546)

USN-8930-1: U-Boot vulnerabilities

Ubuntu Security Advisories
7 hours 39 minutes ago
Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74222) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not properly validate certain DHCPv6 option lengths during network boot. An attacker could possibly use this issue to trigger out-of-bounds memory access, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74225)

erlang-26.2.5.21-10.fc43

Fedora Security Advisories
8 hours 38 minutes ago
FEDORA-2026-a5783c8008 Packages in this update:
  • erlang-26.2.5.21-10.fc43
Update description:

Backport fixes for CVE-2026-75538 (Erlang/OTP TCP driver: remote DoS via signed length overflow) and CVE-2026-73270 (Erlang/OTP inets httpd: information disclosure via case-insensitive path bypass).