Aggregator

Version:next-20261028 (linux-next) Released:2026-10-28

FEDORA-2026-2ef243ce94 Packages in this update:

• hatch-1.15.1-7.fc43

Update description:

Backport updated Python distributions from Hatch 1.18.2

The latest managed CPython interpreters for Python 3.11 and later should now distrust the compromised eMudhra/emSign intermediate CA certificates, as described in the release notes for uv 0.13.5. Both hatch and uv use python-build-standalone for their managed Python interpreters.

FEDORA-2026-0a9fbbfa6d Packages in this update:

• python-mistune-3.3.4-1.fc45

Update description:

Update to 3.3.4

FEDORA-2026-ea39a303cf Packages in this update:

• python-mistune-3.3.4-1.fc44

Update description:

Update to 3.3.4

FEDORA-2026-340793a2f1 Packages in this update:

• python-mistune-3.3.4-1.fc43

Update description:

Update to 3.3.4

FEDORA-2026-142a25f1ca Packages in this update:

• goose-1.45.0-2.fc46

Update description:

Automatic update for goose-1.45.0-2.fc46.

Changelog * Tue Oct 27 2026 thepetk <thepetk@gmail.com> - 1.45.0-2 - Backport for CVE rhbz#2558803

FEDORA-2026-01f9a44339 Packages in this update:

• hatch-1.18.2-1.fc44

Update description:

Update to version 0.18.2.

The latest managed CPython interpreters for Python 3.11 and later should now distrust the compromised eMudhra/emSign intermediate CA certificates, as described in the release notes for uv 0.13.5. Both hatch and uv use python-build-standalone for their managed Python interpreters.

FEDORA-2026-1168b946ef Packages in this update:

• hatch-1.18.2-1.fc45

Update description:

Update to version 0.18.2.

The latest managed CPython interpreters for Python 3.11 and later should now distrust the compromised eMudhra/emSign intermediate CA certificates, as described in the release notes for uv 0.13.5. Both hatch and uv use python-build-standalone for their managed Python interpreters.

FEDORA-2026-f20c4144a2 Packages in this update:

• jackson-bom-2.21.8-1.fc45
• jackson-core-2.21.8-1.fc45
• jackson-databind-2.21.8-1.fc45
• jackson-modules-base-2.21.8-1.fc45

Update description:

Fix CVE-2026-89407 CVE-2026-89425 CVE-2026-68497 CVE-2026-83557 CVE-2026-19032 CVE-2026-91777 across aligned packages updated to version 2.21.8

FEDORA-2026-e720c67bd5 Packages in this update:

• perl-Plack-1.0057-1.fc45

Update description:

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

FEDORA-2026-a2bcaf6c4d Packages in this update:

• perl-Plack-1.0057-1.fc43

Update description:

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

FEDORA-2026-83600dbb0b Packages in this update:

• perl-Plack-1.0057-1.fc44

Update description:

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

FEDORA-2026-a2df1dfb37 Packages in this update:

• perl-Starman-0.4019-1.fc43

Update description:

Starman 0.4019 fixes several CVEs: Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Reject Transfer-Encoding other than "chunked" (400/501) and close the connection after a request with both Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560

FEDORA-2026-c02d051eaf Packages in this update:

• perl-Starman-0.4019-1.fc45

Update description:

Starman 0.4019 fixes several CVEs: Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Reject Transfer-Encoding other than "chunked" (400/501) and close the connection after a request with both Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560

FEDORA-2026-2106e35a84 Packages in this update:

• perl-Starman-0.4019-1.fc44

Update description:

Starman 0.4019 fixes several CVEs: Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Reject Transfer-Encoding other than "chunked" (400/501) and close the connection after a request with both Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560

FEDORA-2026-5ca1419368 Packages in this update:

• perl-HTTP-Headers-ActionPack-0.10-1.fc43

Update description:

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. Version 0.10 uses substrings, not regexes to prevent this from happening.

FEDORA-2026-37e6cc76fc Packages in this update:

• perl-HTTP-Headers-ActionPack-0.10-1.fc45

Update description:

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. Version 0.10 uses substrings, not regexes to prevent this from happening.

FEDORA-2026-e94650c1ee Packages in this update:

• perl-HTTP-Headers-ActionPack-0.10-1.fc44

Update description:

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. Version 0.10 uses substrings, not regexes to prevent this from happening.

FEDORA-2026-70bb33101d Packages in this update:

• python-pillow-12.3.0-5.fc45

Update description:

Backport fix for CVE-2026-112393.

Backport fix for CVE-2026-112892.

FEDORA-2026-14e12dd636 Packages in this update:

• python-pillow-12.3.0-5.fc44

Update description:

Backport fix for CVE-2026-112393.