Fedora Security Advisories

FEDORA-2026-e3ee465ab3 Packages in this update:

• libkcapi-1.5.1-2.fc46

Update description:

Automatic update for libkcapi-1.5.1-2.fc46.

Changelog * Thu Aug 20 2026 Ondrej Mosnáček <omosnacek@gmail.com> - 1.5.1-2 - Apply pending upstream patch to fix the auxiliary test * Tue Aug 18 2026 Ondrej Mosnáček <omosnacek@gmail.com> - 1.5.1-1 - Update to version 1.5.1 (fedora#2512793) - Fix CVE-2026-71225 (fedora#2511445) - Fix CVE-2026-71226 (fedora#2511484) - Fix CVE-2026-71227 (fedora#2511487)

Automatic update for libkcapi-1.5.1-1.fc46.

FEDORA-2026-1a1eac3dfb Packages in this update:

• libkcapi-1.5.1-2.fc45

Update description:

Automatic update for libkcapi-1.5.1-2.fc45.

Changelog * Thu Aug 20 2026 Ondrej Mosnáček <omosnacek@gmail.com> - 1.5.1-2 - Apply pending upstream patch to fix the auxiliary test * Tue Aug 18 2026 Ondrej Mosnáček <omosnacek@gmail.com> - 1.5.1-1 - Update to version 1.5.1 (fedora#2512793) - Fix CVE-2026-71225 (fedora#2511445) - Fix CVE-2026-71226 (fedora#2511484) - Fix CVE-2026-71227 (fedora#2511487)

Automatic update for libkcapi-1.5.1-1.fc45.

FEDORA-EPEL-2026-ae89cbbac2 Packages in this update:

• rust-anstyle-hyperlink-1.0.2-1.el10_3
• rust-anstyle-progress-0.1.4-1.el10_3
• rust-cargo-0.98.0-1.el10_3
• rust-cargo-c-0.10.24-1.el10_3
• rust-cargo-credential-libsecret-0.5.8-1.el10_3
• rust-cargo-util-0.2.30-1.el10_3
• rust-cargo-util-schemas-0.14.1-1.el10_3
• rust-cargo-util-terminal-0.1.0-1.el10_3
• rust-crates-io-0.41.0-1.el10_3
• rust-rustfix-0.9.7-1.el10_3

Update description:

• Update cargo-c to version 0.10.24 (plus dependency updates).
• Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates.

FEDORA-2026-77528477c2 Packages in this update:

• rust-anstyle-hyperlink-1.0.2-1.fc44
• rust-anstyle-progress-0.1.4-1.fc44
• rust-cargo-0.98.0-1.fc44
• rust-cargo-c-0.10.24-1.fc44
• rust-cargo-credential-libsecret-0.5.8-1.fc44
• rust-cargo-util-0.2.30-1.fc44
• rust-cargo-util-schemas-0.14.1-1.fc44
• rust-cargo-util-terminal-0.1.0-1.fc44
• rust-crates-io-0.41.0-1.fc44
• rust-rustfix-0.9.7-1.fc44

Update description:

• Update cargo-c to version 0.10.24 (plus dependency updates).
• Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates.

FEDORA-2026-67365d8467 Packages in this update:

• rust-anstyle-hyperlink-1.0.2-1.fc45
• rust-anstyle-progress-0.1.4-1.fc45
• rust-cargo-0.98.0-1.fc45
• rust-cargo-c-0.10.24-1.fc45
• rust-cargo-credential-libsecret-0.5.8-1.fc45
• rust-cargo-util-0.2.30-1.fc45
• rust-cargo-util-schemas-0.14.1-1.fc45
• rust-cargo-util-terminal-0.1.0-1.fc45
• rust-crates-io-0.41.0-1.fc45
• rust-rustfix-0.9.7-1.fc45

Update description:

• Update cargo-c to version 0.10.24 (plus dependency updates).
• Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates.

FEDORA-2026-ce471fc0d3 Packages in this update:

• rust-anstyle-hyperlink-1.0.2-1.fc46
• rust-anstyle-progress-0.1.4-1.fc46
• rust-cargo-0.98.0-1.fc46
• rust-cargo-c-0.10.24-1.fc46
• rust-cargo-credential-libsecret-0.5.8-1.fc46
• rust-cargo-util-0.2.30-1.fc46
• rust-cargo-util-schemas-0.14.1-1.fc46
• rust-cargo-util-terminal-0.1.0-1.fc46
• rust-crates-io-0.41.0-1.fc46
• rust-rustfix-0.9.7-1.fc46

Update description:

• Update cargo-c to version 0.10.24 (plus dependency updates).
• Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates.

FEDORA-2026-d6763b4c84 Packages in this update:

• rsync-3.5.0-1.fc43

Update description:

New version 3.5.0. Includes fixes for following CVEs: CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789, CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795, CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455, CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461, CVE-2026-70462, CVE-2026-70463, CVE-2026-70464

FEDORA-2026-bfae8723e2 Packages in this update:

• rsync-3.5.0-1.fc44

Update description:

New version 3.5.0. Includes fixes for following CVEs: CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789, CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795, CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455, CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461, CVE-2026-70462, CVE-2026-70463, CVE-2026-70464

FEDORA-2026-903d904933 Packages in this update:

• freeipa-4.13.3-1.fc44
• samba-4.24.6-1.fc44

Update description:

Update to Samba 4.24.6 (and rebuild of freeipa)

FEDORA-2026-4757e7a415 Packages in this update:

• rust-h2-0.4.17-1.fc44

Update description:

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

FEDORA-2026-c3233bfa3f Packages in this update:

• rust-h2-0.4.17-1.fc43

Update description:

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

FEDORA-EPEL-2026-7e8d44c091 Packages in this update:

• rust-h2-0.4.17-1.el10_3

Update description:

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

FEDORA-EPEL-2026-60c29a92fa Packages in this update:

• rust-h2-0.4.17-1.el9

Update description:

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

FEDORA-EPEL-2026-05b2ce23e5 Packages in this update:

• rust-h2-0.4.17-1.el10_2

Update description:

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

FEDORA-2026-7de7d03796 Packages in this update:

• ceph-20.2.4-1.fc44

Update description: Ceph 20.2.4 GA

• CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC.

  https://docs.ceph.com/en/latest/security/CVE-2025-30156

• CVE-2026-39944 shares the unauthenticated-encryption root cause of CVE-2025-30156

  https://docs.ceph.com/en/latest/security/CVE-2026-39944

• CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor subscription handler.

  https://docs.ceph.com/en/latest/security/CVE-2026-50152

• CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 cryptographic signatures in RGW's SigV4 verifier.

  https://docs.ceph.com/en/latest/security/CVE-2026-54330

FEDORA-2026-ebffec502b Packages in this update:

• ceph-19.2.6-1.fc43

Update description: Ceph 19.2.6 GA

• CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC.

  https://docs.ceph.com/en/latest/security/CVE-2025-30156

• CVE-2026-39944 shares the unauthenticated-encryption root cause of CVE-2025-30156

  https://docs.ceph.com/en/latest/security/CVE-2026-39944

• CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor subscription handler.

  https://docs.ceph.com/en/latest/security/CVE-2026-50152

• CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 cryptographic signatures in RGW's SigV4 verifier.

  https://docs.ceph.com/en/latest/security/CVE-2026-54330

FEDORA-2026-40b2544dda Packages in this update:

• java-21-openjdk-21.0.12.1.1-1.0.fc43
• java-21-openjdk-portable-21.0.12.1.1-1.0.fc43

Update description:

First monthly cadence release candidate

FEDORA-2026-a1cdcc1604 Packages in this update:

• bluez-5.87-4.fc43

Update description:

An out-of-bounds read flaw was found in BlueZ in the AVRCP profile implementation. The vulnerability exists in the parse_media_element() and parse_media_folder() functions in profiles/audio/avrcp.c, where insufficient validation of packet length fields in GetFolderItems responses allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This can result in a crash of the bluetoothd daemon (denial of service) and potentially expose sensitive heap memory contents.

This update fixes this issue (CVE-2026-75032)

FEDORA-2026-1bbec06c4d Packages in this update:

• bluez-5.87-4.fc44

Update description:

An out-of-bounds read flaw was found in BlueZ in the AVRCP profile implementation. The vulnerability exists in the parse_media_element() and parse_media_folder() functions in profiles/audio/avrcp.c, where insufficient validation of packet length fields in GetFolderItems responses allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This can result in a crash of the bluetoothd daemon (denial of service) and potentially expose sensitive heap memory contents.

This update fixes this issue (CVE-2026-75032)

FEDORA-2026-1b05b6dad1 Packages in this update:

• postgresql16-anonymizer-3.1.3-1.fc44

Update description:

Update to 3.1.3