Fedora Security Advisories

• opkssh-0.16.0-3.el10_3

Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 (denial of service via crafted channel messages in golang.org/x/crypto/ssh's connection multiplexer).

opkssh only uses golang.org/x/crypto/ssh for key and certificate handling and never establishes SSH connections through it, so the vulnerable code is not reachable in any opkssh build (confirmed with govulncheck).

• opkssh-0.16.0-3.el10_2

Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 (denial of service via crafted channel messages in golang.org/x/crypto/ssh's connection multiplexer).

opkssh only uses golang.org/x/crypto/ssh for key and certificate handling and never establishes SSH connections through it, so the vulnerable code is not reachable in any opkssh build (confirmed with govulncheck).

• opkssh-0.16.0-3.fc45

Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 (denial of service via crafted channel messages in golang.org/x/crypto/ssh's connection multiplexer).

opkssh only uses golang.org/x/crypto/ssh for key and certificate handling and never establishes SSH connections through it, so the vulnerable code is not reachable in any opkssh build (confirmed with govulncheck).

• opkssh-0.16.0-3.fc44

Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 (denial of service via crafted channel messages in golang.org/x/crypto/ssh's connection multiplexer).

opkssh only uses golang.org/x/crypto/ssh for key and certificate handling and never establishes SSH connections through it, so the vulnerable code is not reachable in any opkssh build (confirmed with govulncheck).

• opkssh-0.16.0-3.fc43

Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 (denial of service via crafted channel messages in golang.org/x/crypto/ssh's connection multiplexer).

opkssh only uses golang.org/x/crypto/ssh for key and certificate handling and never establishes SSH connections through it, so the vulnerable code is not reachable in any opkssh build (confirmed with govulncheck).

• PackageKit-1.4.0-1.fc45

Update to 1.4.0 to fix CVE-2026-19816, GHSA-pwvr-2q5v-xvw4, GHSA-6759-8c43-4xrv, GHSA-6695-qjj5-533m, GHSA-gmhf-fxfx-m2w9

• PackageKit-1.4.0-1.fc44

Update to 1.4.0 to fix CVE-2026-19816, GHSA-pwvr-2q5v-xvw4, GHSA-6759-8c43-4xrv, GHSA-6695-qjj5-533m, GHSA-gmhf-fxfx-m2w9

• syncthing-2.1.3-1.el10_2

Update to version 2.1.3.

• syncthing-2.1.3-1.el10_4

Update to version 2.1.3.

• syncthing-2.1.3-1.el10_3

Update to version 2.1.3.

• kernel-7.2.5-200.fc44

The 7.2.5 stable kernel update contains a number of important fixes across the tree.

• kernel-7.2.5-300.fc45

The 7.2.5 stable kernel update contains a number of important fixes across the tree.

• kernel-7.2.5-100.fc43

The 7.2.5 stable kernel update contains a number of important fixes across the tree.

• asterisk-23.5.0-3.fc45

Fix for CVE-2026-57160

• gegl04-0.4.72-3.fc43
• gimp-3.2.6-1.fc43

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes an overflow in parsing RGBE/HDR image files.

For more information, please consult the GIMP 3.2.6 release announcement and the more detailed changelogs of gimp and gegl04.

• stb-0-0.61.20260802.2c980bb.el8

Patch stb_sprintf: security fix for CVE-2026-79516

• stb-0^20260802.2c980bb-2.el9

Patch stb_sprintf: security fix for CVE-2026-79516

• stb-0^20260802.2c980bb-2.el10_3

Patch stb_sprintf: security fix for CVE-2026-79516

• forgejo-15.0.8-1.fc45

This is an upstream bug and security fix release.

Please consult the upstream release notes for more details.

• evolution-3.58.3-2.fc43

Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859.