Fedora Security Advisories

• mongo-c-driver-1.30.10-1.el10_2

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-1.30.10-1.el9

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-1.30.10-1.el8

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-1.30.10-1.fc44

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-1.30.10-1.fc43

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-2.5.3-1.el10_4

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-2.5.3-1.fc45

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-2.5.3-1.el10_3

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• parted-3.6-14.fc43

• parted: Fix partition number allocation in do_print (bcl)
• fdasd: Make sure data set name is positive (bcl)
• resize: Make sure hfsc_new_cachetable cannot overflow on 32bit (bcl)
• resize: Make sure 32bit build cannot overflow frag_count (bcl)
• libparted: Catch FAT metadata triggered errors (bcl) Resolves: CVE-2026-89085 Resolves: CVE-2026-89088

• parted-3.6-15.fc44

• parted: Fix partition number allocation in do_print (bcl)
• fdasd: Make sure data set name is positive (bcl)
• resize: Make sure hfsc_new_cachetable cannot overflow on 32bit (bcl)
• resize: Make sure 32bit build cannot overflow frag_count (bcl)
• libparted: Catch FAT metadata triggered errors (bcl) Resolves: CVE-2026-89085 Resolves: CVE-2026-89088

• parted-3.7.13-1.fc45

• Removed included patches
• version 3.7.13 (bcl)
• maint: Update to latest gnulib and bootstrap script (bcl)
• parted: Fix partition number allocation in do_print (bcl)
• fdasd: Make sure data set name is positive (bcl)
• resize: Make sure hfsc_new_cachetable cannot overflow on 32bit (bcl)
• resize: Make sure 32bit build cannot overflow frag_count (bcl)
• libparted: Catch FAT metadata triggered errors (bcl) Resolves: CVE-2026-89085 Resolves: CVE-2026-89088

• dotnet8.0-8.0.131-1.fc44

Update to .NET SDK 8.0.131 and Runtime 8.0.31

Fixes: CVE-2026-58649,CVE-2026-69304,CVE-2026-69439,CVE-2026-69522,CVE-2026-71328

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.31/8.0.131.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.31/8.0.31.md

• dotnet8.0-8.0.131-1.fc43

Update to .NET SDK 8.0.131 and Runtime 8.0.31

Fixes: CVE-2026-58649,CVE-2026-69304,CVE-2026-69439,CVE-2026-69522,CVE-2026-71328

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.31/8.0.131.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.31/8.0.31.md

• dotnet9.0-9.0.121-1.fc43

Update to .NET SDK 9.0.121 and Runtime 9.0.20

Fixes: CVE-2026-58649,CVE-2026-69304,CVE-2026-69439,CVE-2026-69522,CVE-2026-69806,CVE-2026-71328

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.20/9.0.121.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.20/9.0.20.md

• dotnet10.0-10.0.112-1.fc44

Update to .NET SDK 10.0.112 and Runtime 10.0.12

Fixes: CVE-2026-58649,CVE-2026-69304,CVE-2026-69439,CVE-2026-69522,CVE-2026-69806,CVE-2026-71328

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.12/10.0.112.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.12/10.0.12.md

• dotnet10.0-10.0.112-1.fc43

Update to .NET SDK 10.0.112 and Runtime 10.0.12

Fixes: CVE-2026-58649,CVE-2026-69304,CVE-2026-69439,CVE-2026-69522,CVE-2026-69806,CVE-2026-71328

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.12/10.0.112.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.12/10.0.12.md

• dotnet9.0-9.0.121-1.fc44

Update to .NET SDK 9.0.121 and Runtime 9.0.20

Fixes: CVE-2026-58649,CVE-2026-69304,CVE-2026-69439,CVE-2026-69522,CVE-2026-69806,CVE-2026-71328

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.20/9.0.121.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.20/9.0.20.md

• dotnet10.0-10.0.112-1.fc45

Update to .NET SDK 10.0.112 and Runtime 10.0.12

Fixes: CVE-2026-58649,CVE-2026-69304,CVE-2026-69439,CVE-2026-69522,CVE-2026-69806,CVE-2026-71328

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.12/10.0.112.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.12/10.0.12.md

• freeipmi-1.6.19-1.fc44

Updates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509, and adds tmpfiles configs for image mode

• postgresql16-anonymizer-3.2.2-1.fc45

Upstream changelog: https://gitlab.com/dalibo/postgresql_anonymizer/-/releases

• [core] CVE-2026-19633: Escalation via custom types, operators and rangevars
• [core] update dependencies
• [static] Define masking policy with parallel static masking
• [pseudo] Add seeded_street_name
• [static] CVE-2026-83534: Elevation in parallel masking
• [make] call extension+install before regress
• [pseudo] new panel of seeded_* functions
• [impexp] CVE-2026-19634: SQL injection via import functions
• [partial] Add anon.array_remove_regex()
• [static] Ignore a TABLESAMPLE sampling ratio on non-plain-table relations
• [parallel] Reject a materialized view before parallel masking
• [dynamic] Proper error message on write operations
• [static] Optionally drop indexes during static masking (beta)
• [doc] update the permission matrix
• [tests] Gate the impexp unit tests on cfg(test) only
• [doc] split Load and Support out of the Install page
• [docker] make the image ready for replica masking
• [tests] Introduce cargo pgrx regress
• [core] Upgrade dependencies
• [core] Remove useless compatibility function
• [image] Define a default value for the sigma parameter
• [doc] Add the "Anonymized Replica" tutorial
• [docker] disable fsync during initdb
• [static] Improve performance and correctness for parallel masking
• [doc] how to fix cargo audit warnings
• [doc] Install on Fedora
• [core] Support PostgreSQL 19 (beta)
• [core] Upgrade to PGRX 0.19