Fedora Security Advisories

FEDORA-2026-a05d65f5fa Packages in this update:

• gegl04-0.4.70-5.fc43

Update description:

This update fixes an overflow in parsing RGBE/HDR image files.

FEDORA-2026-03ea7c5707 Packages in this update:

• gegl04-0.4.70-5.fc45

Update description:

This update fixes an overflow in parsing RGBE/HDR image files.

FEDORA-2026-79b351972c Packages in this update:

• gegl04-0.4.70-5.fc44

Update description:

This update fixes an overflow in parsing RGBE/HDR image files.

FEDORA-2026-e33554bf9f Packages in this update:

• perl-Net-OAuth-0.33-1.fc44

Update description:

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. This update fixes the issue.

FEDORA-2026-370bd8b5f0 Packages in this update:

• perl-Net-OAuth-0.33-1.fc43

Update description:

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. This update fixes the issue.

FEDORA-2026-27bab0e213 Packages in this update:

• perl-Net-OAuth-0.33-2.fc45

Update description:

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. This update fixes the issue.

FEDORA-2026-5c3f4c8337 Packages in this update:

• perl-XML-Bare-0.53-45.fc44

Update description:

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue.

Fixes CVE-2026-57074 and CVE-2026-13401.

FEDORA-2026-14e358a2a2 Packages in this update:

• perl-XML-Bare-0.53-44.fc43

Update description:

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue.

Fixes CVE-2026-57074 and CVE-2026-13401.

FEDORA-2026-3a2db4368a Packages in this update:

• perl-XML-Bare-0.53-47.fc45

Update description:

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue.

Fixes CVE-2026-57074 and CVE-2026-13401.

FEDORA-EPEL-2026-e2adb4a954 Packages in this update:

• perl-XML-Bare-0.53-40.el9

Update description:

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue.

Fixes CVE-2026-57074 and CVE-2026-13401.

FEDORA-2026-6b1a89dfe6 Packages in this update:

• emacs-30.2-11.fc43

Update description:

Fix CVE-2026-79992: Local shell command injection through the user field in emacs tramp

FEDORA-2026-58b1e1716c Packages in this update:

• kernel-7.2.2-300.fc45

Update description:

The 7.2.2 stable kernel update contains a single fix for CVE-2026-80590

FEDORA-2026-92c9a5d8bc Packages in this update:

• kernel-7.1.12-200.fc44

Update description:

The 7.1.12 stable kernel update contains a single fix for CVE-2026-80590.

The 7.1.11 stable kernel updates contain a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream will assign CVEs, but we will not know what those are until a bit after this update ships.

FEDORA-2026-f04e0d4d9d Packages in this update:

• kernel-7.1.12-100.fc43

Update description:

The 7.1.12 stable kernel update contains a single fix for CVE-2026-80590.

The 7.1.11 stable kernel updates contain a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream will assign CVEs, but we will not know what those are until a bit after this update ships.

FEDORA-2026-e47f5a0b84 Packages in this update:

• emacs-30.2-29.fc44

Update description:

Fix CVE-2026-79992: Local shell command injection through the user field in emacs tramp

FEDORA-2026-3d5ab046c4 Packages in this update:

• openssl-4.0.2-1.fc45

Update description:

Rebase to OpenSSL 4.0.2

FEDORA-2026-51251b4657 Packages in this update:

• openssl-3.5.8-1.fc44

Update description:

Rebase to OpenSSL 3.5.8

FEDORA-2026-00b3d3d018 Packages in this update:

• openssl-3.5.8-1.fc43

Update description:

Rebase to OpenSSL 3.5.8

FEDORA-2026-612edb2029 Packages in this update:

• rclone-1.75.0-2.fc45

Update description:

Update to 1.75.0

FEDORA-EPEL-2026-b69054a78f Packages in this update:

• nsd-4.15.1-1.el10_3

Update description:

BUG FIXES:

Fix for CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Thanks to Qifan Zhang, Palo Alto Networks for the report Thanks to Claude and Ada Logics for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18664.txt Fix for CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window (down to 1). Thanks to Akhil Koul (https://github.com/akoul) for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18916.txt Fix for CVE-2026-19401: Any remote client can denial UDP service by sending a specifically crafted query with multiple DNS Cookie options. Thanks to Qifan Zhang, Palo Alto Networks for the report Thanks to afldl zhangph@yandex.com for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19401.txt Fix for CVE-2026-19538: Anyone with access to the proxy protocol port over TCP or TLS can bypass BLOCKED access control items. Thanks to Qifan Zhang, Palo Alto Networks for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19538.txt