Fedora Security Advisories

• rest-0.10.2-9.fc44

Fix for https://access.redhat.com/security/cve/cve-2026-16615

• rest-0.10.2-12.fc45

Fix for https://access.redhat.com/security/cve/cve-2026-16615

• rest-0.10.2-5.fc43

Fix for https://access.redhat.com/security/cve/cve-2026-16615

• mingw-gstreamer1-plugins-base-1.26.11-2.fc43
• mingw-gstreamer1-plugins-good-1.26.11-3.fc43

Backport multiple security fixes.

• mingw-gstreamer1-1.28.6-1.fc44
• mingw-gstreamer1-plugins-bad-free-1.28.6-1.fc44
• mingw-gstreamer1-plugins-base-1.28.6-1.fc44
• mingw-gstreamer1-plugins-good-1.28.6-1.fc44

Update to 1.28.6.

• mingw-expat-2.8.3-1.fc45

Update to expat-2.8.3.

• mingw-expat-2.8.3-1.fc43

Update to expat-2.8.3.

• mingw-expat-2.8.3-1.fc44

Update to expat-2.8.3.

• mingw-openexr-3.4.15-1.fc45

Update to openexr 3.4.15 resp 3.3.14.

• mingw-openexr-3.4.15-1.fc44

Update to openexr 3.4.15 resp 3.3.14.

• mingw-openexr-3.3.14-1.fc43

Update to openexr 3.4.15 resp 3.3.14.

• libopenmpt-0.8.9-1.fc43

Security uppdate from 0.8.7 to 0.8.9 plus bug-fixes: https://lib.openmpt.org/libopenmpt/2026/08/19/security-updates-0.8.9-0.7.21-0.6.30-0.5.44-0.4.56/ https://lib.openmpt.org/libopenmpt/2026/08/15/releases-0.8.8-0.7.20-0.6.29-0.5.43-0.4.55/

• libopenmpt-0.8.9-1.fc44

Security uppdate from 0.8.7 to 0.8.9 plus bug-fixes: https://lib.openmpt.org/libopenmpt/2026/08/19/security-updates-0.8.9-0.7.21-0.6.30-0.5.44-0.4.56/ https://lib.openmpt.org/libopenmpt/2026/08/15/releases-0.8.8-0.7.20-0.6.29-0.5.43-0.4.55/

• neovim-0.12.5-1.fc46
• tree-sitter-0.26.13-1.fc46

Update neovim and tree-sitter

• emacs-30.2-28.fc44

Fix CVE-2026-77219: Integer overflow in PBM/PPM/PGM image loader.

• emacs-30.2-10.fc43

Fix CVE-2026-77219: Integer overflow in PBM/PPM/PGM image loader.

• golang-1.26.7-1.fc44

Update to 1.26.7 upstream release

• curl-8.18.0-9.fc44

• Fix QUIC zero-length UDP datagrams busy-loop (CVE-2026-11352)
• Fix WS Auto-PONG memory exhaustion (CVE-2026-11586)
• Fix proto-default skips SSH verification (CVE-2026-12064)
• Fix wrong STARTTLS connection reuse (CVE-2026-8286)
• Fix SASL double-free (CVE-2026-8925)
• Fix env-set cross-proxy Digest auth state leak (CVE-2026-8927)
• Fix sending old referer (CVE-2026-9546)
• Fix exposing HTTP/3 early data (CVE-2026-9545)
• Fix UAF after pause in socket callback (CVE-2026-9080)

• proftpd-1.3.9d-2.el10_4

Current upstream maintenance release, with a handful of potentially security-related bugfixes.

• gum-2.0.0-1.el10_4

Update to version 2.0.0 and override bundled golang.org/x/net to v0.55.0. The latter fixes CVE-2026-25680, CVE-2026-25681, and CVE-2026-42506.

https://github.com/charmbracelet/gum/releases/tag/v2.0.0