Fedora Security Advisories

FEDORA-2026-b382f3a576 Packages in this update:

• spoofdpi-1.5.3-1.fc45

Update description:

Automatic update for spoofdpi-1.5.3-1.fc45.

Changelog * Tue Jul 14 2026 Emir Akdag <infraw.linux@proton.me> - 1.5.3-1 - Update spoofdpi to 1.5.3 - Update to 1.5.3 to fix CVE-2026-27145 - Add missing license for go-localereader - Fix build directory case sensitivity issue - Resolves: rhbz#2494220, rhbz#2494389

FEDORA-EPEL-2026-7dd185cbc6 Packages in this update:

• yq-4.53.3-1.el9

Update description:

Update to 4.53.3

FEDORA-EPEL-2026-47e9adee0a Packages in this update:

• yq-4.53.3-1.el10_2

Update description:

Update to 4.53.3

FEDORA-EPEL-2026-32169dd0b8 Packages in this update:

• yq-4.53.3-1.el10_3

Update description:

Update to 4.53.3

FEDORA-2026-990cdd8329 Packages in this update:

• yq-4.53.3-1.fc43

Update description:

Update to 4.53.3

FEDORA-2026-710adfa806 Packages in this update:

• yq-4.53.3-1.fc44

Update description:

Update to 4.53.3

FEDORA-EPEL-2026-57e759c14c Packages in this update:

• perl-YAML-Syck-1.47-1.el9

Update description:

This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags:

• CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input
• CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table
• CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)
• CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input

There are also a few other bug-fixes included.

FEDORA-EPEL-2026-22c2f092d6 Packages in this update:

• perl-YAML-Syck-1.47-1.el10_3

Update description:

This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags:

• CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input
• CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table
• CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)
• CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input

There are also a few other bug-fixes included.

FEDORA-2026-2139aa7dce Packages in this update:

• perl-YAML-Syck-1.47-1.fc44

Update description:

This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags:

• CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input
• CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table
• CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)
• CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input

There are also a few other bug-fixes included.

FEDORA-2026-c8484f1afb Packages in this update:

• perl-YAML-Syck-1.47-1.fc43

Update description:

This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags:

• CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input
• CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table
• CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)
• CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input

There are also a few other bug-fixes included.

FEDORA-EPEL-2026-8b5b8778ee Packages in this update:

• perl-YAML-Syck-1.47-1.el10_2

Update description:

This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags:

• CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input
• CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table
• CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)
• CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input

There are also a few other bug-fixes included.

FEDORA-2026-77f23c0bc4 Packages in this update:

• spoofdpi-1.5.3-2.fc43

Update description:

Fix Go version requirement for F43 build compatibility

FEDORA-EPEL-2026-9214d617c1 Packages in this update:

• spoofdpi-1.5.3-1.el9

Update description:

Update spoofdpi to 1.5.3

FEDORA-EPEL-2026-09c2d23aa6 Packages in this update:

• spoofdpi-1.5.3-1.el10_3

Update description:

Update spoofdpi to 1.5.3

FEDORA-2026-812049f95c Packages in this update:

• spoofdpi-1.5.3-1.fc44

Update description:

Update spoofdpi to 1.5.3

FEDORA-2026-e8e294a7fa Packages in this update:

• kernel-7.1.3-201.fc44

Update description:

The 7.1.3-101/201 builds contain an important fix for XFS filesystem users.

FEDORA-2026-085c9e92a4 Packages in this update:

• kernel-7.1.3-101.fc43

Update description:

The 7.1.3-101/201 builds contain an important fix for XFS filesystem users.

FEDORA-2026-e2b3dd1ec0 Packages in this update:

• collectl-4.3.20.3-1.fc43

Update description:

• handle insecure code properly in colmux

FEDORA-2026-71a9784a57 Packages in this update:

• collectl-4.3.20.3-1.fc44

Update description:

• handle insecure code properly in colmux

FEDORA-2026-b1bdb7c518 Packages in this update:

• perl-HTTP-Date-6.08-1.fc43

Update description:

Changes:

6.08 2026-07-09 02:04:21Z

- [SECURITY] Reject input longer than 64 characters in parse_date() to prevent quadratic regex backtracking (a denial of service) on hostile date strings. Fixes CVE-2026-14741. (Olaf Alders)

6.07 2026-06-25 15:12:09Z

- Add test with Time::Zone (GH#25) (Michal Josef Špaček) - Add test with bad Time::Zone string (GH#26) (Michal Josef Špaček) - Add tests with negative time (GH#26) (Michal Josef Špaček) - Replace all instances of \d with [0-9] in regular expressions to reject non-ASCII Unicode digits, with a regression test (GH#27) (Robert Rothenberg) - Reject malformed ISO 8601 timezones with a doubled colon (GH#31) (Olaf Alders) - Document day/month/year ordering for numeric dates (GH#32) (Olaf Alders)