Fedora Security Advisories

FEDORA-2026-ea090e0910 Packages in this update:

• python-loguru-0.7.3-23.fc43

Update description:

Backport fix for CVE-2026-120217

FEDORA-EPEL-2026-71ec297b96 Packages in this update:

• rust-routinator-0.15.2-5.el9

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

FEDORA-2026-1b494a5097 Packages in this update:

• python-loguru-0.7.3-23.fc44

Update description:

Backport fix for CVE-2026-120217

FEDORA-2026-1ec7ec0a69 Packages in this update:

• python-loguru-0.7.3-23.fc45

Update description:

Backport fix for CVE-2026-120217

FEDORA-EPEL-2026-1ddf75b939 Packages in this update:

• rust-routinator-0.15.2-5.el10_3

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

FEDORA-EPEL-2026-9d1bd41c65 Packages in this update:

• rust-routinator-0.15.2-5.el10_4

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

FEDORA-2026-3d50e0ef85 Packages in this update:

• python-loguru-0.7.3-23.fc46

Update description:

Automatic update for python-loguru-0.7.3-23.fc46.

Changelog * Wed Nov 4 2026 Benjamin A. Beasley <code@musicinmybrain.net> - 0.7.3-23 - Backport fix for CVE-2026-120217; Fixes RHBZ#2565692

FEDORA-2026-d52e740b90 Packages in this update:

• rust-routinator-0.15.2-5.fc43

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

FEDORA-2026-d284dab04d Packages in this update:

• rust-routinator-0.15.2-5.fc44

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

FEDORA-2026-ba69e92e04 Packages in this update:

• rust-routinator-0.15.2-5.fc45

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

FEDORA-2026-981a830ea5 Packages in this update:

• nginx-1.30.6-1.fc46
• nginx-mod-brotli-1.0.0~rc-15.fc46
• nginx-mod-fancyindex-0.6.0-10.fc46
• nginx-mod-headers-more-0.40-5.fc46
• nginx-mod-js-challenge-0^20230517.gitda6852d-13.fc46
• nginx-mod-modsecurity-1.0.4-19.fc46
• nginx-mod-naxsi-1.6-23.fc46
• nginx-mod-vts-0.2.7-3.fc46

Update description:

Update nginx stack to 1.30.6 to fix some CVEs: https://nginx.org/en/CHANGES-1.30

FEDORA-EPEL-2026-79b7b2864a Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.el10_3

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-EPEL-2026-c4e44302ce Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.el10_4

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-EPEL-2026-0389d75dbd Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.el9

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-EPEL-2026-b613641941 Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.el10_2

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-2fe77b7737 Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.fc45

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-8eb916e28d Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.fc43

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-d4bdbe1e68 Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.fc44

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-e3b4074098 Packages in this update:

• ignition-2.28.0-2.fc45

Update description:

Rebuild against the patched Go toolchain (golang 1.27.3) to pick up the fix for CVE-2026-111943. Go's crypto/x509 now rejects certificate chains that use any of eight compromised eMudhra intermediate CA public keys. There are no source changes to ignition itself -- this rebuild simply links the fixed standard library into the binary.

Update to Ignition 2.28.0, including Butane OpenShift 5.0 support. See https://github.com/coreos/ignition/issues/2336.

Patch build to resolve home_dir symlinks to avoid an issue with a recent libselinux update leading to relabelling failures.

FEDORA-2026-26a68b65cc Packages in this update:

• udns-0.7-1.fc44

Update description:

Update to 0.7