Fedora Security Advisories

• prometheus-3.13.1-1.fc44

Update to 3.13.1

• prometheus-3.13.1-1.fc43

Update to 3.13.1

• node-exporter-1.12.0-1.el10_2

Update to 1.12.0

• node-exporter-1.12.0-1.el10_3

Update to 1.12.0

• node-exporter-1.12.0-1.el9

Update to 1.12.0

• node-exporter-1.12.0-1.fc44

Update to 1.12.0

• node-exporter-1.12.0-1.fc43

Update to 1.12.0

• mbedtls-3.6.7-1.el10_3

• Update to 3.6.7
• Fixes CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583, CVE-2026-50584, CVE-2026-50585, CVE-2026-50586, CVE-2026-50587, CVE-2026-50588, CVE-2026-50640, CVE-2026-50713, CVE-2026-54435, CVE-2026-54441

Release notes: https://github.com/Mbed-TLS/mbedtls/releases#release-mbedtls-3.6.7

• mbedtls-3.6.7-1.el10_2

• Update to 3.6.7
• Fixes CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583, CVE-2026-50584, CVE-2026-50585, CVE-2026-50586, CVE-2026-50587, CVE-2026-50588, CVE-2026-50640, CVE-2026-50713, CVE-2026-54435, CVE-2026-54441

Release notes: https://github.com/Mbed-TLS/mbedtls/releases#release-mbedtls-3.6.7

• mbedtls-3.6.7-1.fc44

• Update to 3.6.7
• Fixes CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583, CVE-2026-50584, CVE-2026-50585, CVE-2026-50586, CVE-2026-50587, CVE-2026-50588, CVE-2026-50640, CVE-2026-50713, CVE-2026-54435, CVE-2026-54441

Release notes: https://github.com/Mbed-TLS/mbedtls/releases#release-mbedtls-3.6.7

• mbedtls-3.6.7-1.fc43

• Update to 3.6.7
• Fixes CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583, CVE-2026-50584, CVE-2026-50585, CVE-2026-50586, CVE-2026-50587, CVE-2026-50588, CVE-2026-50640, CVE-2026-50713, CVE-2026-54435, CVE-2026-54441

Release notes: https://github.com/Mbed-TLS/mbedtls/releases#release-mbedtls-3.6.7

• antlr4-project-4.13.2-14.fc43

This update contains a fix for CVE-2026-13503.

• antlr4-project-4.13.2-18.fc44

This update contains a fix for CVE-2026-13503.

• opam-2.5.2-1.fc44

Version 2.5.2 of opam fixes CVE-2026-57825. See https://github.com/ocaml/opam/releases/tag/2.5.2 for more information.

• opam-2.5.2-1.fc43

Version 2.5.2 of opam fixes CVE-2026-57825. See https://github.com/ocaml/opam/releases/tag/2.5.2 for more information.

• erlang-26.2.5.21-4.fc43

Backport fixes for CVE-2026-48858 (ftp SSRF), CVE-2026-49759 (SCTP DoS), CVE-2026-48860 (dist-over-TLS auth bypass), CVE-2026-54886 (ssh SFTP DoS), CVE-2026-54891 (TLS handshake data injection), and CVE-2026-55952 (TLS 1.3 session ticket DoS). These are fixed upstream in OTP 27.x (rawhide/f45); backported here to the OTP 26.x line.

• erlang-26.2.5.21-4.fc44

Backport fixes for CVE-2026-48858 (ftp SSRF), CVE-2026-49759 (SCTP DoS), CVE-2026-48860 (dist-over-TLS auth bypass), CVE-2026-54886 (ssh SFTP DoS), CVE-2026-54891 (TLS handshake data injection), and CVE-2026-55952 (TLS 1.3 session ticket DoS). These are fixed upstream in OTP 27.x (rawhide/f45); backported here to the OTP 26.x line.

• c-ares-1.34.8-1.fc43

1.34.7 accidentally broke the API compatibility, this is fixed in 1.34.8.

• update to 1.34.7
• fixes CVE-2026-33630 (GHSA-6wfj-rwm7-3542) and GHSA-pjmc-gx33-gc76 and GHSA-jv8r-gqr9-68wj

• python-dulwich-1.2.9-1.fc44

1.2.9, CVE fixes

• python-orjson-3.11.9-3.fc43

Update PyO3 to 0.29, fixing RUSTSEC-2026-0194 and RUSTSEC-2026-0195.