Fedora Security Advisories

FEDORA-2026-e55bcd0c54 Packages in this update:

• python-pendulum-3.2.0-1.fc43

Update description:

Update to 3.2.0 (final). Update PyO3 to 0.29, fixing RUSTSEC-2026-0176 and RUSTSEC-2026-0177.

FEDORA-2026-f4272d87ef Packages in this update:

• php-8.4.23-1.fc43

Update description:

PHP version 8.4.23 (03 Jul 2026)

Core:

• Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block). (Pratik Bhujel)

BCMath:

• Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round(). (edorian)

Date:

• Fix incorrect recurrence check of DatePeriod::createFromISO8601String(). (ndossche)

DOM:

• Fix GH-22219 (Dom\XMLDocument::schemaValidate fails to resolve xs:QName with prefix from imported schema). (David Carlier)

Exif:

• Read correct value for single and double tags. (ndossche)

GD:

• Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return). (iliaal)
• Fixed bug GH-19666 (imageconvolution() unexpected nan filter value). (David Carlier)
• Fixed bug GH-19739 (imageellipse/imagefilledellipse overflow). (David Carlier)
• Fixed bug GH-19730 (imageaffine overflow). (David Carlier)

Intl:

• Fix incorrect argument positions for uninitialized calendar arguments in IntlCalendar::equals(), ::before(), ::after(), and ::isEquivalentTo(), and for invalid start/end arguments in transliterator_transliterate(). (Weilin Du)
• Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types. (Weilin Du)
• Fixed Spoofchecker restriction-level APIs to only be exposed with ICU 53 and later. (Graham Campbell)

mysqli:

• Fix stmt->query leak in mysqli_execute_query() validation errors. (David Carlier)

Opcache:

• Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading). (Levi Morrison)

OpenSSL:

• Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (David Carlier)

Phar:

• Fixed a bypass of the magic ".phar" directory protection in Phar::addEmptyDir() for paths starting with "/.phar", while allowing non-magic directory names that merely share the ".phar" prefix. (Weilin Du)

Reflection:

• Preserve class-name case in ReflectionClass::getProperty() error messages and autoloading. (jorgsowa)

Sqlite:

• Fix error checks for column retrieval. (ndossche)

Zlib:

• Fixed memory leak if deflate initialization fails and there is a dict. (ndossche)
• Fixed memory leak in inflate_add(). (ndossche)

FEDORA-2026-ec9cb4652f Packages in this update:

• php-8.5.8-1.fc44

Update description:

PHP version 8.5.8 (02 Jul 2026)

Core:

• Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block). (Pratik Bhujel)
• Fixed bug GH-22112 (Assertion when error handler throws during NaN to bool/string coercion). (iliaal)

BCMath:

• Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round(). (edorian)

Date:

• Fix incorrect recurrence check of DatePeriod::createFromISO8601String(). (ndossche)

Exif:

• Read correct value for single and double tags. (ndossche)

GD:

• Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return). (iliaal)

Intl:

• Fix incorrect argument positions for invalid start/end arguments in transliterator_transliterate(). (Weilin Du)
• Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types. (Weilin Du)

Lexbor:

• Merge patch c3a6847. (ilutov, timwolla)

Opcache:

• Fixed bug GH-22265 (Another tailcall vm_interrupt bug). (Levi Morrison)
• Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading). (Levi Morrison)
• Fixed bug GH-21972 (Corrupted variable type when a typed by-value return contains a reference wrapper). (Weilin Du)

OpenSSL:

• Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (David Carlier)

Phar:

• Fixed a bypass of the magic ".phar" directory protection in Phar::addEmptyDir() for paths starting with "/.phar", while allowing non-magic directory names that merely share the ".phar" prefix. (Weilin Du)

Reflection:

• Preserve class-name case in ReflectionClass::getProperty() error messages and autoloading. (jorgsowa)

SOAP:

• Fixed bug GH-22218 (SoapServer::handle() crash on $_SERVER not being an array). (David Carlier / Rex-Reynolds)
• Fixed bug GH-22285 (Soap server requires the raw input to be passed to $server->handle). (David Carlier / ndossche)

Sqlite:

• Fix error checks for column retrieval. (ndossche)

URI:

• Add LEXBOR_STATIC to CFLAGS_URI on Windows so ext/uri does not see LXB_API as __declspec(dllimport) when linked statically into PHP. (Luther Monson)
• Clean error logs before each Uri\WhatWg\Url wither call so that errors from previous wither calls are not returned the next time a UrlValidationError is thrown. (kocsismate)

Zlib:

• Fixed memory leak if deflate initialization fails and there is a dict. (ndossche)
• Fixed memory leak in inflate_add(). (ndossche)

FEDORA-2026-abc468979d Packages in this update:

• perl-CSS-Minifier-XS-0.15-1.fc43

Update description:

This package contains the Perl module CSS::Minifier::XS.

Versions of the module before 0.14 have a memory leak when the entire document is minified away (CVE-2026-13593). This update brings version 0.15 which fixes this issue.

FEDORA-2026-9f14575d85 Packages in this update:

• perl-CSS-Minifier-XS-0.15-1.fc44

Update description:

This package contains the Perl module CSS::Minifier::XS.

Versions of the module before 0.14 have a memory leak when the entire document is minified away (CVE-2026-13593). This update brings version 0.15 which fixes this issue.

FEDORA-2026-b43264dedb Packages in this update:

• jq-1.8.2-4.fc45

Update description:

Automatic update for jq-1.8.2-4.fc45.

Changelog * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-4 - removed old upstreamed patches * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-3 - opt-in to packit for rawhide * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-2 - simplify .gitignore file * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-1 - update to 1.8.2 fixes rhbz#2458354 rhbz#2477179 rhbz#2477180 rhbz#2477235 rhbz#2477236 rhbz#2477522 rhbz#2477523

FEDORA-2026-2559684e58 Packages in this update:

• python-pendulum-3.2.0-1.fc44

Update description:

Update to 3.2.0 (final). Update PyO3 to 0.29, fixing RUSTSEC-2026-0176 and RUSTSEC-2026-0177.

FEDORA-2026-0ed2011b62 Packages in this update:

• transmission-4.1.3-1.fc43

Update description:

Fixed a CORS bug that leaked the anti-CSRF nonce. (#8938) Fixed a use-after-free bug in peer code. (#8921) Fixed build error when compiling with fmt 12.2.0. (#8942)

Fix qt icon

FEDORA-2026-0c067e5040 Packages in this update:

• transmission-4.1.3-1.fc44

Update description:

Fixed a CORS bug that leaked the anti-CSRF nonce. (#8938) Fixed a use-after-free bug in peer code. (#8921) Fixed build error when compiling with fmt 12.2.0. (#8942)

FEDORA-2026-00901a5e8f Packages in this update:

• ipp-usb-0.9.34-2.fc44

Update description:

0.9.34 - security fix for CVE-2026-27145

FEDORA-2026-7eaf5e3510 Packages in this update:

• ipp-usb-0.9.34-2.fc45

Update description:

Automatic update for ipp-usb-0.9.34-2.fc45.

Changelog * Tue Jun 30 2026 Zdenek Dohnal <zdohnal@redhat.com> - 0.9.34-2 - ipp-usb-0.9.34 is available (fedora#2463247, fedora#2484207, fedora#2494316)

FEDORA-2026-5ebb12f543 Packages in this update:

• python-nh3-0.3.6-1.fc44

Update description:

Update to 0.3.6; this includes an update to PyO3 0.29, which fixes RUSTSEC-2026-0176 and RUSTSEC-2026-0177.

FEDORA-2026-d7dfd8e9ba Packages in this update:

• golang-github-openprinting-ipp-usb-0.9.34-1.fc43

Update description:

0.9.34 - security fixes for CVE-2026-27145

FEDORA-2026-93da8dcc2c Packages in this update:

• python-rpds-py-0.29.0-4.fc44

Update description:

Update to PyO3 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177.

FEDORA-2026-5b642da12e Packages in this update:

• helm-4.2.2-1.fc44

Update description:

Update to 4.2.2

FEDORA-EPEL-2026-a087e5a86b Packages in this update:

• python-cramjam-2.11.0-8.el10_3

Update description:

Update to PyO3 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177.

FEDORA-2026-75b3256794 Packages in this update:

• python-pillow-jxl-plugin-1.3.7-2.fc43

Update description:

Update to 1.3.7, and update PyO3 to 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177.

FEDORA-2026-97d351d54e Packages in this update:

• betterleaks-1.6.0-1.fc43

Update description:

Update to 1.6.0

FEDORA-2026-6f573784e6 Packages in this update:

• betterleaks-1.6.0-1.fc44

Update description:

Update to 1.6.0

FEDORA-EPEL-2026-6e8fb57b18 Packages in this update:

• betterleaks-1.6.0-1.el10_3

Update description:

Update to 1.6.0