Fedora Security Advisories

• nginx-1.30.6-1.fc46
• nginx-mod-brotli-1.0.0~rc-15.fc46
• nginx-mod-fancyindex-0.6.0-10.fc46
• nginx-mod-headers-more-0.40-5.fc46
• nginx-mod-js-challenge-0^20230517.gitda6852d-13.fc46
• nginx-mod-modsecurity-1.0.4-19.fc46
• nginx-mod-naxsi-1.6-23.fc46
• nginx-mod-vts-0.2.7-3.fc46

Update nginx stack to 1.30.6 to fix some CVEs: https://nginx.org/en/CHANGES-1.30

• perl-HTTP-Parser-XS-0.18-1.el10_3

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• perl-HTTP-Parser-XS-0.18-1.el10_4

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• perl-HTTP-Parser-XS-0.18-1.el9

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• perl-HTTP-Parser-XS-0.18-1.el10_2

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• perl-HTTP-Parser-XS-0.18-1.fc45

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• perl-HTTP-Parser-XS-0.18-1.fc43

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• perl-HTTP-Parser-XS-0.18-1.fc44

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• ignition-2.28.0-2.fc45

Rebuild against the patched Go toolchain (golang 1.27.3) to pick up the fix for CVE-2026-111943. Go's crypto/x509 now rejects certificate chains that use any of eight compromised eMudhra intermediate CA public keys. There are no source changes to ignition itself -- this rebuild simply links the fixed standard library into the binary.

Update to Ignition 2.28.0, including Butane OpenShift 5.0 support. See https://github.com/coreos/ignition/issues/2336.

Patch build to resolve home_dir symlinks to avoid an issue with a recent libselinux update leading to relabelling failures.

• udns-0.7-1.fc44

Update to 0.7

• python3.9-3.9.25-16.fc45

• Ensure the bundled pip (used on Fedora 45+) uses system certificates

• tigervnc-1.16.2-9.fc44

Rebuild against new xorg-x11-server to fix CVE-2026-88812, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93523.

• tigervnc-1.16.2-9.fc45

Rebuild against new xorg-x11-server to fix CVE-2026-88812, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93523.

• freerdp-3.33.0-1.fc43

Update to 3.33.0

• freerdp-3.33.0-1.fc44

Update to 3.33.0

• freerdp-3.33.0-1.fc45

Update to 3.33.0

• udns-0.7-1.fc45

Update to 0.7

• udns-0.7-1.el10_3

Update to 0.7

• udns-0.7-1.el10_4

Update to 0.7

• python-robotframework-7.5.1-1.fc45

Upgrade to 7.5.1 (rhbz#2548546 and rhbz#2548558)