Fedora Security Advisories

• dotnet11.0-11.0.100~rc.3.26522.148-0.13.fc43

Update to .NET SDK 11.0.100-rc.3.26522.148 and Runtime 11.0.0-rc.3.26522.148

Fixes: CVE-2026-102870, CVE-2026-105016, CVE-2026-111497, CVE-2026-114148, CVE-2026-58280, CVE-2026-66822, CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70159, CVE-2026-70161, CVE-2026-70162, CVE-2026-70165, CVE-2026-70174, CVE-2026-70183, CVE-2026-70188, CVE-2026-70190, CVE-2026-70194, CVE-2026-70197, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-85790, CVE-2026-87697, CVE-2026-88092, CVE-2026-92707, CVE-2026-96224, CVE-2026-96225, CVE-2026-96229, CVE-2026-96230, CVE-2026-96231, CVE-2026-96232, CVE-2026-96233, CVE-2026-96234, CVE-2026-96235, CVE-2026-96236, CVE-2026-96238, CVE-2026-96957, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960

Release Notes: - SDK: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.2.26504.105/11.0.100-rc.2.26504.105.md - SDK: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.3.26522.148/11.0.100-rc.3.26522.148.md - Runtime: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.2.26504.105/11.0.0-rc.2.26504.105.md - Runtime: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.3.26522.148/11.0.0-rc.3.26522.148.md

• java-latest-openjdk-27.0.1.3.1-0.1.0.el8

October java CPU

• java-25-openjdk-25.0.5.0.8-3.1.fc44
• java-latest-openjdk-27.0.1.3.1-0.1.0.fc44

October java CPU

• java-25-openjdk-25.0.5.0.8-3.1.fc43
• java-latest-openjdk-27.0.1.3.1-0.1.0.fc43

October java CPU

• java-latest-openjdk-27.0.1.3.1-0.1.0.el10_3
• java-latest-openjdk-portable-27.0.1.3.1-0.rolling.el8

October java CPU

• java-latest-openjdk-27.0.1.3.1-0.1.0.el10_2

October java CPU

• java-latest-openjdk-27.0.1.3.1-0.1.0.el9

October java CPU

• java-25-openjdk-25.0.5.0.8-3.1.fc45
• java-latest-openjdk-27.0.1.3.1-0.1.0.fc45

October java CPU

• dotnet11.0-11.0.100~rc.3.26522.148-0.13.fc44

Update to .NET SDK 11.0.100-rc.3.26522.148 and Runtime 11.0.0-rc.3.26522.148

Fixes: CVE-2026-102870, CVE-2026-105016, CVE-2026-111497, CVE-2026-114148, CVE-2026-58280, CVE-2026-66822, CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70159, CVE-2026-70161, CVE-2026-70162, CVE-2026-70165, CVE-2026-70174, CVE-2026-70183, CVE-2026-70188, CVE-2026-70190, CVE-2026-70194, CVE-2026-70197, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-85790, CVE-2026-87697, CVE-2026-88092, CVE-2026-92707, CVE-2026-96224, CVE-2026-96225, CVE-2026-96229, CVE-2026-96230, CVE-2026-96231, CVE-2026-96232, CVE-2026-96233, CVE-2026-96234, CVE-2026-96235, CVE-2026-96236, CVE-2026-96238, CVE-2026-96957, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960

Release Notes: - SDK: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.2.26504.105/11.0.100-rc.2.26504.105.md - SDK: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.3.26522.148/11.0.100-rc.3.26522.148.md - Runtime: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.2.26504.105/11.0.0-rc.2.26504.105.md - Runtime: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.3.26522.148/11.0.0-rc.3.26522.148.md

• dotnet11.0-11.0.100~rc.3.26522.148-0.13.fc45

Update to .NET SDK 11.0.100-rc.3.26522.148 and Runtime 11.0.0-rc.3.26522.148

Fixes: CVE-2026-102870, CVE-2026-105016, CVE-2026-111497, CVE-2026-114148, CVE-2026-58280, CVE-2026-66822, CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70159, CVE-2026-70161, CVE-2026-70162, CVE-2026-70165, CVE-2026-70174, CVE-2026-70183, CVE-2026-70188, CVE-2026-70190, CVE-2026-70194, CVE-2026-70197, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-85790, CVE-2026-87697, CVE-2026-88092, CVE-2026-92707, CVE-2026-96224, CVE-2026-96225, CVE-2026-96229, CVE-2026-96230, CVE-2026-96231, CVE-2026-96232, CVE-2026-96233, CVE-2026-96234, CVE-2026-96235, CVE-2026-96236, CVE-2026-96238, CVE-2026-96957, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960

Release Notes: - SDK: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.2.26504.105/11.0.100-rc.2.26504.105.md - SDK: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.3.26522.148/11.0.100-rc.3.26522.148.md - Runtime: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.2.26504.105/11.0.0-rc.2.26504.105.md - Runtime: https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0-rc.3.26522.148/11.0.0-rc.3.26522.148.md

• erlang-26.2.5.21-11.fc43

Security update: backport upstream Erlang/OTP security fixes to OTP 26.2.5.21.

• CVE-2026-59696: denial of service via unbounded integer parsing (uri_string port, httpc headers/Content-Length, eldap referral port, snmp BER integers). httpc gains max_header_size / max_body_size request options.
• CVE-2026-94200: a malicious TLS 1.3 server could crash the ssl application on the client through a malformed NewSessionTicket; extensions are now only accepted in the handshake messages that may carry them.
• CVE-2026-105236: TLS 1.2 session resumption now checks that the SNI host matches the one the session was established for, preventing an authentication bypass across virtual hosts with different client-certificate trust.

Backport fixes for CVE-2026-75538 (Erlang/OTP TCP driver: remote DoS via signed length overflow) and CVE-2026-73270 (Erlang/OTP inets httpd: information disclosure via case-insensitive path bypass).

• erlang-26.2.5.21-11.fc44

Security update: backport upstream Erlang/OTP security fixes to OTP 26.2.5.21.

• CVE-2026-59696: denial of service via unbounded integer parsing (uri_string port, httpc headers/Content-Length, eldap referral port, snmp BER integers). httpc gains max_header_size / max_body_size request options.
• CVE-2026-94200: a malicious TLS 1.3 server could crash the ssl application on the client through a malformed NewSessionTicket; extensions are now only accepted in the handshake messages that may carry them.
• CVE-2026-105236: TLS 1.2 session resumption now checks that the SNI host matches the one the session was established for, preventing an authentication bypass across virtual hosts with different client-certificate trust.

Backport fixes for CVE-2026-75538 (Erlang/OTP TCP driver: remote DoS via signed length overflow) and CVE-2026-73270 (Erlang/OTP inets httpd: information disclosure via case-insensitive path bypass).

• python-crate-ingredients-0.3.3-2.fc44

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

• rust-siguldry-fedora-autopen-0.2.2-4.fc44

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

• asterisk-18.26.4-2.el9

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

• asterisk-18.26.4-2.el8

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

• asterisk-18.26.4-2.fc44

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

• asterisk-18.26.4-2.fc43

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

• nextcloud-35.0.2-1.el10_2

35.0.2 Release

• nextcloud-35.0.2-1.el10_3

35.0.2 Release