Fedora Security Advisories

perl-Net-DNS-1.56-1.el10_3

2 hours 22 minutes ago
FEDORA-EPEL-2026-9d8de529df Packages in this update:
  • perl-Net-DNS-1.56-1.el10_3
Update description:

Security fixes (main reason to update) - Remote code injection via EDNS EXTENDED ERROR (rt.cpan #179945) - 1.56 - DoS via long DNS compression chains (rt.cpan #179946) - 1.56 - UNIX.pm no longer relies on shell for uname (rt.cpan #176900) -1.55

Notable bug fixes across the range - TCP AXFR corruption from 1-byte 0x30 treated as EOF (#177003) - IPv4 loopback disabled in IPv6-only config — Fedora41 (#158714) - Multiple "uninitialized value" fixes in UDP/TCP paths (#158706, #157700) - Nameserver: SOA missing in NODATA response (#157669)

perl-Net-DNS-1.56-1.el10_4

2 hours 32 minutes ago
FEDORA-EPEL-2026-8249fe4a72 Packages in this update:
  • perl-Net-DNS-1.56-1.el10_4
Update description:

1.56 bump

Security fixes (main reason to update) - Remote code injection via EDNS EXTENDED ERROR (rt.cpan #179945) — 1.56 - DoS via long DNS compression chains (rt.cpan #179946) — 1.56 - UNIX.pm no longer relies on shell for uname (rt.cpan #176900) — 1.55

Notable bug fixes across the range

  • TCP AXFR corruption from 1-byte 0x30 treated as EOF (#177003)
  • IPv4 loopback disabled in IPv6-only config — Fedora41 (#158714)
  • Multiple "uninitialized value" fixes in UDP/TCP paths (#158706, #157700)
  • Nameserver: SOA missing in NODATA response (#157669)
  • Resolver base selection bug on non-Unix platforms (#168433)

perl-Net-DNS-1.56-1.fc43

4 hours 50 minutes ago
FEDORA-2026-1237afef8a Packages in this update:
  • perl-Net-DNS-1.56-1.fc43
Update description:

Update to Net-DNS 1.56 (from 1.53).

Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR (rt.cpan #179945) - Denial of Service via long DNS compression chains (rt.cpan #179946) - Resolver/UNIX.pm no longer relies on shell for uname (rt.cpan #176900)

Bug fixes: - Fix TCP read loop treating 1-byte recv() of "0" (0x30) as EOF, which corrupted AXFRs (rt.cpan #177003) - Fix unhelpful TAINT error (rt.cpan #178183) - Fix unreachable-code warning under Apache/mod_perl (rt.cpan #179692/#176900) - Documentation fix for Net::DNS::RR::RRSIG::verify() (rt.cpan #180088).

Other: - Resync with IANA DNS parameters and DNSSEC algorithm registries - New DNSKEY adt() accessor; DELEG parser backported to SVCB

perl-Net-DNS-1.56-1.fc44

4 hours 50 minutes ago
FEDORA-2026-a0607111e6 Packages in this update:
  • perl-Net-DNS-1.56-1.fc44
Update description:

Update to Net-DNS 1.56 (from 1.53).

Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR (rt.cpan #179945) - Denial of Service via long DNS compression chains (rt.cpan #179946) - Resolver/UNIX.pm no longer relies on shell for uname (rt.cpan #176900)

Bug fixes: - Fix TCP read loop treating 1-byte recv() of "0" (0x30) as EOF, which corrupted AXFRs (rt.cpan #177003) - Fix unhelpful TAINT error (rt.cpan #178183) - Fix unreachable-code warning under Apache/mod_perl (rt.cpan #179692/#176900) - Documentation fix for Net::DNS::RR::RRSIG::verify() (rt.cpan #180088).

Other: - Resync with IANA DNS parameters and DNSSEC algorithm registries - New DNSKEY adt() accessor; DELEG parser backported to SVCB

mongo-c-driver-2.5.1-1.fc45

5 hours 58 minutes ago
FEDORA-2026-fec1bd0e65 Packages in this update:
  • mongo-c-driver-2.5.1-1.fc45
Update description: libmongoc 2.5.1

Fixes

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)

mongo-c-driver-2.5.1-1.el10_3

5 hours 58 minutes ago
FEDORA-EPEL-2026-4c8991a29d Packages in this update:
  • mongo-c-driver-2.5.1-1.el10_3
Update description: libmongoc 2.5.1

Fixes

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)
libbson 2.5.0

No changes since 2.4.0. Version incremented to match the libmongoc version.

libmongoc 2.5.0

New Features

  • Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.
  • Add collection bulk write getters.

mongo-c-driver-2.5.1-1.el10_4

5 hours 58 minutes ago
FEDORA-EPEL-2026-92974d6ab3 Packages in this update:
  • mongo-c-driver-2.5.1-1.el10_4
Update description: libmongoc 2.5.1

Fixes

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)
libbson 2.5.0

No changes since 2.4.0. Version incremented to match the libmongoc version.

libmongoc 2.5.0

New Features

  • Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.
  • Add collection bulk write getters.

libmongocrypt-1.20.3-1.el10_3

6 hours 15 minutes ago
FEDORA-EPEL-2026-2210b463dc Packages in this update:
  • libmongocrypt-1.20.3-1.el10_3
Update description: Version 1.20.3

Fixed

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

libmongocrypt-1.20.3-1.fc45

6 hours 15 minutes ago
FEDORA-2026-276ef95c83 Packages in this update:
  • libmongocrypt-1.20.3-1.fc45
Update description: Version 1.20.3

Fixed

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

libmongocrypt-1.20.3-1.el10_4

6 hours 15 minutes ago
FEDORA-EPEL-2026-eac81454b1 Packages in this update:
  • libmongocrypt-1.20.3-1.el10_4
Update description: Version 1.20.3

Fixed

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

valkey-8.0.11-1.el8

7 hours 13 minutes ago
FEDORA-EPEL-2026-d90913b1f1 Packages in this update:
  • valkey-8.0.11-1.el8
Update description: Valkey 8.0.11 - Released Mon 31 August 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
Bug Fixes
  • Fix a double-free crash when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
  • Fix AOF truncation after a partially persisted MULTI/EXEC block so writes made after recovery are not lost on a later restart by @chzhoo (#4342)
  • Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands let users write keys outside their permitted patterns by @tjade273 (#3971)
  • Fix a use-after-free crash when a cluster message for a module-registered type arrives after the module is unloaded by @enjoy-binbin (#4360)
  • Fix out-of-bounds access on cluster module messages of type 255, which is now a valid message type by @enjoy-binbin (#4410)
  • Fix silent data loss where ACL checks were wrongly applied to commands replayed from the AOF file by @lukepalmer (#3984)
  • Fix a client memory accounting leak that inflated the mem_clients_normal INFO field on replicas by @enjoy-binbin (#4395)
  • Always deep-validate listpack payloads on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload is deprecated and now a no-op by @jjuleslasarte (#3721)
  • Fix module VM_Yield timing so repeated yields honor busy-reply-threshold instead of the server hz interval by @PingXie (#2131)
  • Fix a stack overflow crash when a large TLS write is retried after an OpenSSL write error by @murphyjacob4 (#4307)
  • Fix a crash caused by forged cluster bus PUBLISH or MODULE packets carrying oversized payload length fields by @tjade273 (#3972)
  • Reject crafted stream payloads in RDB load and RESTORE whose length or field-count metadata is inconsistent, preventing later server panics by @madolson (#3922)
  • Fix a cluster link disconnect loop after network failures that caused pub/sub messages between nodes to be lost by @dvkashapov (#2817)
  • Fix a use-after-free crash when a client blocked on a key is freed while other clients blocked on the same key are being served by @quanyeyang (#4212)
  • Reject crafted stream payloads that misstate live and deleted record counts, preventing data loss on XDEL by @roshkhatri (#4381)
  • Fix incorrect CLUSTER SLOT-STATS ORDERBY ordering when slot statistics differ by more than 2^31 by @jzy1688 (#4459)
Checked
3 minutes 58 seconds ago