Fedora Security Advisories

FEDORA-2026-1f4dd1b9ff Packages in this update:

• 3proxy-1.0.2-1.fc45

Update description:

Update to 1.0.2 (rhbz#2560278)

Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

FEDORA-EPEL-2026-e91b9637fd Packages in this update:

• 3proxy-1.0.2-2.el8

Update description:

Update to 1.0.2 (rhbz#2560278)

Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

FEDORA-EPEL-2026-4c8e4f578b Packages in this update:

• 3proxy-1.0.2-1.el10_4

Update description:

Update to 1.0.2 (rhbz#2560278)

Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

FEDORA-2026-1b5ddbaeb5 Packages in this update:

• 3proxy-1.0.2-1.fc44

Update description:

Update to 1.0.2 (rhbz#2560278)

Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

FEDORA-EPEL-2026-b8ac6029a2 Packages in this update:

• 3proxy-1.0.2-1.el9

Update description:

Update to 1.0.2 (rhbz#2560278)

Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

FEDORA-2026-540af356f2 Packages in this update:

• 3proxy-1.0.2-1.fc43

Update description:

Update to 1.0.2 (rhbz#2560278)

Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

FEDORA-2026-01926f9706 Packages in this update:

• freeipa-4.13.4-4.fc45
• krb5-1.22.2-11.fc45
• samba-4.25.1-1.fc45

Update description:

Update to Samba 4.25.1 (along with freeipa rebuild) and security fix CVE-2026-11850 in krb5

FEDORA-2026-82cc570aba Packages in this update:

• freeipa-4.13.4-4.fc46
• krb5-1.22.2-11.fc46
• samba-4.25.1-1.fc46

Update description:

Update to Samba 4.25.1 (along with freeipa rebuild) and security fix CVE-2026-11850 in krb5

FEDORA-EPEL-2026-811beeabe0 Packages in this update:

• python3.13-3.13.18-1.el10_2

Update description:

New version of the Python interpreter

New version of Python 3.13. There are no significant changes.

FEDORA-EPEL-2026-b1708ddbd3 Packages in this update:

• python3.13-3.13.18-1.el10_4

Update description:

New version of the Python interpreter

New version of Python 3.13. There are no significant changes.

FEDORA-EPEL-2026-4ef24154ea Packages in this update:

• python3.13-3.13.18-1.el10_3

Update description:

New version of the Python interpreter

New version of Python 3.13. There are no significant changes.

FEDORA-2026-d6b8383232 Packages in this update:

• python3.13-3.13.18-1.fc43

Update description:

New version of the Python interpreter

New version of Python 3.13. There are no significant changes.

FEDORA-2026-77153b01c6 Packages in this update:

• python3.13-3.13.18-1.fc45

Update description:

New version of the Python interpreter

New version of Python 3.13. There are no significant changes.

FEDORA-2026-a85529a028 Packages in this update:

• python3.13-3.13.18-1.fc44

Update description:

New version of the Python interpreter

New version of Python 3.13. There are no significant changes.

FEDORA-EPEL-2026-54d355f2f0 Packages in this update:

• python3.13-3.13.18-1.el9

Update description:

New version of the Python interpreter

New version of Python 3.13. There are no significant changes.

FEDORA-2026-6530ce786a Packages in this update:

• python3.14-3.14.10-1.fc45

Update description:

New version of the Python interpreter

New version of the Python interpreter.

FEDORA-2026-1520dedf55 Packages in this update:

• python3.14-3.14.10-1.fc43
• python3-docs-3.14.10-1.fc43

Update description:

New version of the Python interpreter

New version of the Python interpreter

FEDORA-2026-46b48b717f Packages in this update:

• libvirt-11.6.0-4.fc43

Update description:

• CVE-2026-18917 (bz #2520165)

FEDORA-2026-2a34d74310 Packages in this update:

• python3.14-3.14.10-1.fc44
• python3-docs-3.14.10-1.fc44

Update description:

New version of the Python interpreter

New version of the Python interpeter

FEDORA-EPEL-2026-72a1c9956e Packages in this update:

• valkey-8.0.12-1.el8

Update description: Valkey 8.0.12 - Released Mon 26 October 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

• GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message by @roshkhatri (#5030)

Bug Fixes

• Fix stream commands that mutate consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) not triggering WATCH and client-side tracking invalidation by @Tarte12 (#3459)
• Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data by @enjoy-binbin (#4733)
• Reject module write commands while the server is paused for writes, preventing a crash from module timer callbacks during CLIENT PAUSE WRITE or CLUSTER FAILOVER by @smkher (#3645)
• Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION by @leomurillo (#4997)
• Correct ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry and ValkeyModule_ACLAddLogEntryByUserName declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks by @rainsupreme (#4676)
• Fix valkey-benchmark spinning on would-block writes, which could starve reply processing and the --duration timer by @thweetkomputer (#4567)
• Fix a huge memory allocation when a command such as COMMAND GETKEYS EVAL declares a far larger key count than the arguments provided by @murphyjacob4 (#3598)
• Reject relative expire times in SET/GETEX, RESTORE, and ValkeyModule_SetExpire that overflow when added to the current time, preventing server aborts from negative expires by @madolson (#4880)
• Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis by @magic-peach (#4214)
• Sorted set range commands with a negative LIMIT offset now return an empty result instead of a spurious element on btree-encoded keys by @xiaocj (#4637)
• Redact error text in server logs when hide-user-data-from-log is enabled, so command arguments no longer leak into logs by @zackcam (#4815)
• Fix cluster config saving to avoid publishing truncated nodes.conf files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate nodes.conf.lock file by @KewangZhili (#4489)
• Fix LSET on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error by @charsyam (#4823)