Fedora Security Advisories

FEDORA-2026-336f10ee31 Packages in this update:

• kernel-7.1.4-101.fc43

Update description:

The 7.1.4-101/201 stable kernel update contains a fix for a rather important security issue with net/can.

FEDORA-2026-eb0b86b6f9 Packages in this update:

• kernel-7.1.4-201.fc44

Update description:

The 7.1.4-101/201 stable kernel update contains a fix for a rather important security issue with net/can.

FEDORA-2026-d1cd8e3d25 Packages in this update:

• nginx-1.30.4-1.fc45
• nginx-mod-brotli-1.0.0~rc-13.fc45
• nginx-mod-fancyindex-0.6.0-8.fc45
• nginx-mod-headers-more-0.40-3.fc45
• nginx-mod-js-challenge-0^20230517.gitda6852d-11.fc45
• nginx-mod-modsecurity-1.0.4-16.fc45
• nginx-mod-naxsi-1.6-21.fc45
• nginx-mod-vts-0.2.4-13.fc45

Update description:

nginx-mod-fancyindex:

Rebuild for 1.30.4

nginx-mod-modsecurity:

Rebuild for 1.30.4

nginx-mod-naxsi:

Rebuild for 1.30.4

nginx-mod-headers-more:

Rebuild for 1.30.4

nginx-mod-brotli:

Rebuild for 1.30.4

nginx-mod-js-challenge:

Rebuild for 1.30.4

nginx-mod-vts:

Rebuild for 1.30.4

nginx:

update to 1.30.4 fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434

FEDORA-2026-1c5ffc6018 Packages in this update:

• perl-DBI-1.651-1.fc44

Update description:

1.651 bump - Fix CVE-2026-15043, CVE-2026-15392, CVE-2026-60082 and CVE-2026-60081

FEDORA-2026-c0abcba354 Packages in this update:

• perl-DBI-1.651-1.fc43

Update description:

1.651 bump - Fix CVE-2026-15043, CVE-2026-15392, CVE-2026-60082 and CVE-2026-60081

FEDORA-2026-db53330c8f Packages in this update:

• kronosnet-1.35-1.fc44

Update description:

CVE-2026-15811 (LOW): encryption key exposure in memory after cryptographic configuration changes. Wipe cryptographic keys with explicit_bzero() before freeing to prevent exposure through memory disclosure vulnerabilities. (Resolves rhbz#2500850)

CVE-2026-15812 (LOW): access control list bypass via link ID spoofing on unencrypted dynamic links. Validate source address against claimed link_id and enable ACL by default. (Resolves rhbz#2500852)

CVE-2026-15813 (MEDIUM): memory corruption and out-of-bounds access via malformed network packet defragmentation. Validate fragment sequence numbers before accessing defragmentation buffers. (Resolves rhbz#2500864)

FEDORA-2026-56568b6fe8 Packages in this update:

• kronosnet-1.35-1.fc43

Update description:

CVE-2026-15811 (LOW): encryption key exposure in memory after cryptographic configuration changes. Wipe cryptographic keys with explicit_bzero() before freeing to prevent exposure through memory disclosure vulnerabilities. (Resolves rhbz#2500850)

CVE-2026-15812 (LOW): access control list bypass via link ID spoofing on unencrypted dynamic links. Validate source address against claimed link_id and enable ACL by default. (Resolves rhbz#2500852)

CVE-2026-15813 (MEDIUM): memory corruption and out-of-bounds access via malformed network packet defragmentation. Validate fragment sequence numbers before accessing defragmentation buffers. (Resolves rhbz#2500864)

FEDORA-EPEL-2026-38388e4a82 Packages in this update:

• restic-0.19.1-1.el10_2

Update description:

Update to 0.19.1

FEDORA-EPEL-2026-db7745349d Packages in this update:

• restic-0.19.1-1.el10_3

Update description:

Update to 0.19.1

FEDORA-EPEL-2026-174bbf250e Packages in this update:

• restic-0.19.1-1.el9

Update description:

Update to 0.19.1

FEDORA-2026-3e85d87212 Packages in this update:

• kronosnet-1.35-1.fc45

Update description:

Automatic update for kronosnet-1.35-1.fc45.

Changelog * Mon Jul 20 2026 Fabio M. Di Nitto <fdinitto@redhat.com> - 1.35-1 - New upstream release - CVE-2026-15811 (LOW): encryption key exposure in memory after cryptographic configuration changes. Wipe cryptographic keys with explicit_bzero() before freeing to prevent exposure through memory disclosure vulnerabilities. (Resolves rhbz#2500850) - CVE-2026-15812 (LOW): access control list bypass via link ID spoofing on unencrypted dynamic links. Validate source address against claimed link_id and enable ACL by default. (Resolves rhbz#2500852) - CVE-2026-15813 (MEDIUM): memory corruption and out-of-bounds access via malformed network packet defragmentation. Validate fragment sequence numbers before accessing defragmentation buffers. (Resolves rhbz#2500864) - tests: add coverage for connected named AF_UNIX SOCK_STREAM sockets - libnozzle: Introduce test macros similar to libknet - docs: convert README to markdown format * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.34-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

FEDORA-2026-c87cc5b948 Packages in this update:

• restic-0.19.1-1.fc44

Update description:

Update to 0.19.1

FEDORA-2026-a006788209 Packages in this update:

• restic-0.19.1-1.fc43

Update description:

Update to 0.19.1

FEDORA-2026-3298e71891 Packages in this update:

• nodejs22-22.23.1-2.fc45

Update description:

Automatic update for nodejs22-22.23.1-2.fc45.

Changelog * Mon Jul 20 2026 tjuhasz <tjuhasz@redhat.com> - 1:22.23.1-2 - CVE-2026-42338 ip-address HTML escaping fix (rhbz#2487625) * Mon Jul 20 2026 tjuhasz <tjuhasz@redhat.com> - 1:22.23.1-1 - Update to version 22.23.1 (rhbz#2477273). * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:22.22.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

FEDORA-2026-1528cb06a7 Packages in this update:

• btrbk-0.32.7-1.fc43

Update description:

Update to 0.32.7 (RHBZ#2502632) which includes fix for CVE-2026-62943

FEDORA-2026-131c82812a Packages in this update:

• btrbk-0.32.7-1.fc44

Update description:

Update to 0.32.7 (RHBZ#2502632) which includes fix for CVE-2026-62943

FEDORA-2026-3b93aae2d6 Packages in this update:

• nginx-1.30.4-1.fc43
• nginx-mod-brotli-1.0.0~rc-13.fc43
• nginx-mod-fancyindex-0.6.0-8.fc43
• nginx-mod-headers-more-0.40-3.fc43
• nginx-mod-modsecurity-1.0.4-16.fc43
• nginx-mod-naxsi-1.6-21.fc43
• nginx-mod-vts-0.2.4-13.fc43

Update description:

nginx-mod-vts:

• Rebuild for 1.30.4

nginx-mod-brotli:

• Rebuild for 1.30.4

nginx-mod-fancyindex:

• Rebuild for 1.30.4

nginx-mod-headers-more:

• Rebuild for 1.30.4

nginx-mod-modsecurity:

• Rebuild for 1.30.4

nginx-mod-naxsi:

• Rebuild for 1.30.4

nginx:

• update to 1.30.4
• fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434

FEDORA-2026-60fc198d3b Packages in this update:

• nginx-1.30.4-1.fc44
• nginx-mod-brotli-1.0.0~rc-13.fc44
• nginx-mod-fancyindex-0.6.0-8.fc44
• nginx-mod-headers-more-0.40-3.fc44
• nginx-mod-js-challenge-0^20230517.gitda6852d-11.fc44
• nginx-mod-modsecurity-1.0.4-16.fc44
• nginx-mod-naxsi-1.6-21.fc44
• nginx-mod-vts-0.2.4-13.fc44

Update description:

nginx-mod-fancyindex:

• Rebuild for 1.30.4

nginx-mod-modsecurity:

• Rebuild for 1.30.4

nginx-mod-naxsi:

• Rebuild for 1.30.4

nginx-mod-headers-more:

• Rebuild for 1.30.4

nginx-mod-brotli:

• Rebuild for 1.30.4

nginx-mod-js-challenge:

• Rebuild for 1.30.4

nginx-mod-vts:

• Rebuild for 1.30.4

nginx:

• update to 1.30.4
• fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434

FEDORA-EPEL-2026-881ac51c15 Packages in this update:

• opkssh-0.16.0-1.el10_3

Update description:

Update to 0.16.0.

This release includes a security fix for GQ-commitment PK Tokens (upgrades the openpubkey dependency to v0.25.0), addressing a vulnerability affecting GitLab-CI GQ-commitment PK Tokens. Note that opkssh currently only supports GitLab user OP (not GitLab-CI), so the vulnerable code path is not reachable through opkssh; severity is set low accordingly. Also drops the now-obsolete go-jose dependency_overrides pin, since upstream now requires go-jose v4.1.4 natively.

FEDORA-EPEL-2026-cb5a2d1e66 Packages in this update:

• opkssh-0.16.0-1.el10_2

Update description:

Update to 0.16.0.

This release includes a security fix for GQ-commitment PK Tokens (upgrades the openpubkey dependency to v0.25.0), addressing a vulnerability affecting GitLab-CI GQ-commitment PK Tokens. Note that opkssh currently only supports GitLab user OP (not GitLab-CI), so the vulnerable code path is not reachable through opkssh; severity is set low accordingly. Also drops the now-obsolete go-jose dependency_overrides pin, since upstream now requires go-jose v4.1.4 natively.