Fedora Security Advisories

• bind-9.18.50-2.fc43

Fixes multiple CVEs

• Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
• Key Record using PRIVATEDNS algorithm may lead to exit (CVE-2026-10822)
• Record ordering based unexpected exit with CNAME or DNAME (CVE-2026-12617)
• Potential memory usage beyond configured limits (CVE-2026-11622)
• Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
• Incorrect acceptance of NSEC3 records (CVE-2026-10723)
• Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
• DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

• bind-9.18.50-2.fc44

Fixes multiple CVEs

• Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
• Key Record using PRIVATEDNS algorithm may lead to exit (CVE-2026-10822)
• Record ordering based unexpected exit with CNAME or DNAME (CVE-2026-12617)
• Potential memory usage beyond configured limits (CVE-2026-11622)
• Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
• Incorrect acceptance of NSEC3 records (CVE-2026-10723)
• Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
• DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

• bind-9.18.50-34.fc45

Fixes multiple CVEs, without a rebase to newer version

• Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
• Key Record using PRIVATEDNS algorithm may lead to exit (CVE-2026-10822)
• Record ordering based unexpected exit with CNAME or DNAME (CVE-2026-12617)
• Potential memory usage beyond configured limits (CVE-2026-11622)
• Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
• Incorrect acceptance of NSEC3 records (CVE-2026-10723)
• Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
• DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

• mrtg-2.17.10-15.fc45

Fix CVE-2026-72694: symlink-following privilege escalation in PID file handling

• mrtg-2.17.10-13.fc43

Fix CVE-2026-72694: symlink-following privilege escalation in PID file handling

• mrtg-2.17.10-14.fc44

Fix CVE-2026-72694: symlink-following privilege escalation in PID file handling

• rest-0.10.2-9.fc44

Fix for https://access.redhat.com/security/cve/cve-2026-16615

• rest-0.10.2-12.fc45

Fix for https://access.redhat.com/security/cve/cve-2026-16615

• rest-0.10.2-5.fc43

Fix for https://access.redhat.com/security/cve/cve-2026-16615

• mingw-gstreamer1-plugins-base-1.26.11-2.fc43
• mingw-gstreamer1-plugins-good-1.26.11-3.fc43

Backport multiple security fixes.

• mingw-gstreamer1-1.28.6-1.fc44
• mingw-gstreamer1-plugins-bad-free-1.28.6-1.fc44
• mingw-gstreamer1-plugins-base-1.28.6-1.fc44
• mingw-gstreamer1-plugins-good-1.28.6-1.fc44

Update to 1.28.6.

• mingw-expat-2.8.3-1.fc45

Update to expat-2.8.3.

• mingw-expat-2.8.3-1.fc43

Update to expat-2.8.3.

• mingw-expat-2.8.3-1.fc44

Update to expat-2.8.3.

• mingw-openexr-3.4.15-1.fc45

Update to openexr 3.4.15 resp 3.3.14.

• mingw-openexr-3.4.15-1.fc44

Update to openexr 3.4.15 resp 3.3.14.

• mingw-openexr-3.3.14-1.fc43

Update to openexr 3.4.15 resp 3.3.14.

• libopenmpt-0.8.9-1.fc43

Security uppdate from 0.8.7 to 0.8.9 plus bug-fixes: https://lib.openmpt.org/libopenmpt/2026/08/19/security-updates-0.8.9-0.7.21-0.6.30-0.5.44-0.4.56/ https://lib.openmpt.org/libopenmpt/2026/08/15/releases-0.8.8-0.7.20-0.6.29-0.5.43-0.4.55/

• libopenmpt-0.8.9-1.fc44

Security uppdate from 0.8.7 to 0.8.9 plus bug-fixes: https://lib.openmpt.org/libopenmpt/2026/08/19/security-updates-0.8.9-0.7.21-0.6.30-0.5.44-0.4.56/ https://lib.openmpt.org/libopenmpt/2026/08/15/releases-0.8.8-0.7.20-0.6.29-0.5.43-0.4.55/

• neovim-0.12.5-1.fc46
• tree-sitter-0.26.13-1.fc46

Update neovim and tree-sitter