Fedora Security Advisories

valkey-9.0.5-1.fc44

Fedora Security Advisories
45 minutes 38 seconds ago
FEDORA-2026-3d18a65cc4 Packages in this update:
  • valkey-9.0.5-1.fc44
Update description: Valkey 9.0.5 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
  • CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)
Bug Fixes
  • Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed by @enjoy-binbin (#2872)
  • Fix a use-after-free crash when creating slot import jobs during manual slot migrations by @twooster (#3283)
  • Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed by @sarthakaggarwal97 (#3342)
  • Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type by @madolson (#3516)
  • Fix a crash from a race between IO threads and asynchronous client freeing by @deepakrn (#3458)
  • Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE by @enjoy-binbin (#3498)
  • Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted by @smkher (#3591)
  • Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active by @eifrah-aws (#3578)
  • Fix a NULL pointer crash in TLS pending-data handling by @zuiderkwast (#3641)
  • Fix a server crash when multiple RDMA clients disconnect at the same time by @quanyeyang (#3448)
  • Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately by @ranshid (#3800)
  • Fix a use-after-free when a module unregisters the first registered cluster message receiver for a message type by @eifrah-aws (#3846)
  • Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count by @cjx-zar (#4047)
  • Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY by @enjoy-binbin (#4024)
  • Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected by @lukepalmer (#4068)
  • Fix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly by @dvkashapov (#3306)
  • Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue by @jjuleslasarte (#3878)
  • Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket by @ranshid (#3950)
  • Fix a file descriptor leak when a blocking connection attempt, such as MIGRATE to an unreachable host, times out by @madolson (#3541)
  • Fix a potential crash from a dangling slot migration job reference when the migration client is reset by @murphyjacob4 (#3554)
  • Remove cached EVAL scripts when their scripting engine is unregistered, preventing dangling engine references by @eifrah-aws (#3503)
  • Fix a memory leak in GEOSEARCH BYPOLYGON when argument parsing fails, such as on an invalid COUNT by @bandalgomsu (#3568)
  • Fix a crash when a slot migration target node is removed from the cluster before the migration connects by @chenshi5012 (#3596)
  • Fix a crash when the module GetLRU/SetLRU/GetLFU/SetLFU APIs are called with a NULL key by @yaronsananes (#3610)
  • Fix an assertion failure in hash field expiration commands when a module blocks the client in a keyspace notification by @enjoy-binbin (#3743)
  • Fix a cluster UPDATE log message reading shard IDs past their fixed-length buffer by @enjoy-binbin (#3942)
  • Fix undefined behavior in the failover delay calculation when cluster-node-timeout is set below 30 milliseconds by @enjoy-binbin (#3941)
  • Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
  • Reject NAN scores in listpack- and ziplist-encoded sorted sets on RDB/RESTORE load, preventing a later crash on skiplist conversion by @madolson (#3921)
  • Fix a startup crash on 32-bit systems with 64-bit time_t, such as Alpine 3.23, caused by time value formatting mismatches by @chenshi5012 (#3787)
  • Fix corrupted client replies when IO threads are enabled, caused by a race between in-flight writes and reply buffer reuse by @nanyan0312 (#4060)
  • COMMAND INFO in RESP3 now returns the subcommands field as an Array instead of a Set for commands without subcommands by @rickrams (#3939)
  • The dual-channel replication RDB connection now announces the configured replica-announce-ip, avoiding stale replica entries behind NAT by @jdheyburn (#2846)
  • Prevent replicas from processing stale cluster packets and incorrectly promoting themselves to an empty primary within a shard by @zhijun42 (#2811)
  • Send the replica version on the dual-channel RDB connection so full syncs of data like hash field TTLs no longer fail by @hpatro (#4105)
  • Fix slot migration failure handling running twice on ownership changes and an out-of-order error reply in the internal SYNCSLOTS FINISH command by @chx9 (#3723)
  • Allow slot-migration-max-failover-repl-bytes to be set to -1 to disable the limit, as documented by @enjoy-binbin (#3443)
  • Fix CONFIG REWRITE producing negative values for memory configs such as maxmemory when set to very large values by @enjoy-binbin (#3440)
  • Reject SENTINEL SET values containing control characters and safely quote Sentinel config values to prevent config file injection by @eifrah-aws (#3847)
  • Reject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to prevent nodes.conf corruption or injection by @eifrah-aws (#3848)
  • Fix changes to lua-enable-insecure-api via CONFIG SET not taking effect when the option was set at startup by @enjoy-binbin (#4182)
  • Fix incorrect memory overhead reported for watched keys in client memory usage tracking by @enjoy-binbin (#3359)
  • Replica logs now report 'Connection reset by peer' instead of the misleading 'Success' when the primary closes the connection by @abmathur-ie (#3580)
  • Redact key names and user data from more log messages when hide-user-data-from-log is enabled by @zackcam (#3872)
  • Fix INFO replication reporting negative sync transfer sizes when the RDB exceeds 2GB during disk-based sync by @chx9 (#3811)
  • Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)
  • valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No such node ID' by @yang-z-o (#3209)
  • Fix valkey-cli crashing after --eval script execution on jemalloc/tcmalloc builds by @bandalgomsu (#3281)
  • valkey-cli --cluster fix now spreads uncovered slots randomly across primaries instead of assigning them all to one node by @abmathur-ie (#3586)

valkey-8.1.9-1.fc43

Fedora Security Advisories
50 minutes 59 seconds ago
FEDORA-2026-9de44775c7 Packages in this update:
  • valkey-8.1.9-1.fc43
Update description: Valkey 8.1.9 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
  • CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)
Bug Fixes
  • Fix clients being left on the wrong database after module keyspace notifications from commands like MOVE and COPY by @enjoy-binbin (#4024)
  • Fix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64 by @jjuleslasarte (#3878)
  • Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
  • Reject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted RESTORE payloads by @madolson (#3921)
  • Fix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit (e.g. Alpine time64) by @chenshi5012 (#3787)
  • Fix COMMAND INFO in RESP3 to reply with an empty Array instead of a Set for commands without subcommands by @rickrams (#3939)
  • Reject invalid characters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf corruption and injection by @eifrah-aws (#3848)
  • Fix lua-enable-insecure-api having no effect when enabled at startup via config file or command line by @enjoy-binbin (#3548)
  • Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)

valkey-8.0.10-1.el8

Fedora Security Advisories
52 minutes 16 seconds ago
FEDORA-EPEL-2026-f5b9d860d8 Packages in this update:
  • valkey-8.0.10-1.el8
Update description: Valkey 8.0.10 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to crash the server using CLIENT KILL (#4234)
  • CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers. Reported by @z0v3r1n and @lifip. (#4073)
Bug Fixes
  • Strictly validate CRLF line endings when parsing the RESP protocol, rejecting malformed requests as protocol errors by @enjoy-binbin (#2872)
  • Fix memory leak in ZDIFF/ZDIFFSTORE when the result set becomes empty before all input sets are processed by @sarthakaggarwal97 (#3342)
  • Fix crash caused by a race between asynchronous client freeing and IO threads reading from the closing client by @deepakrn (#3458)
  • Fix double free when loading corrupt stream RDB data containing duplicate consumer PEL entries by @enjoy-binbin (#3498)
  • Fix stream corruption and crash when XTRIM marks the last entry of a listpack node as deleted by @smkher (#3591)
  • Fix potential crash in TLS pending-data handling when the connection has no SSL object by @zuiderkwast (#3641)
  • Fix use-after-free when ACL LOAD removes a user whose authenticated client's free is deferred by @ranshid (#3800)
  • Fix use-after-free when a module unregisters the first-registered cluster message receiver for a message type by @eifrah-aws (#3846)
  • Fix crash when loading functions after FUNCTION FLUSH ASYNC and make FUNCTION FLUSH actually release Lua VM memory by @enjoy-binbin (#1826)
  • Fix file descriptor leak when a blocking connect times out, such as MIGRATE to an unreachable host by @madolson (#3541)
  • Fix crash in module LRU/LFU API functions (GetLRU, SetLRU, GetLFU, SetLFU) when passed a NULL key by @yaronsananes (#3610)
  • TLS synchronous I/O no longer leaves a blocking socket in non-blocking mode, preventing unexpected short reads by @xbasel (#1298)
  • Fix crash when CLUSTER SLOTS is called without a real client connection, such as from a module timer callback by @bandalgomsu (#2915)
  • Fix assertion crash in the IO thread job queue on ARM/aarch64 caused by memory store reordering by @jjuleslasarte (#3878)
  • Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
  • Reject NAN scores in listpack and ziplist encoded sorted sets on RDB load, preventing a later crash on skiplist conversion by @madolson (#3921)
  • Fix crash on 32-bit systems where time_t is 64-bit (e.g. Alpine with time64) when generating INFO output by @chenshi5012 (#3787)
  • COMMAND INFO in RESP3 now returns an empty Array instead of a Set for the subcommands field of commands without subcommands by @rickrams (#3939)
  • Manual failover votes are no longer restricted by two times the node timeout, preventing manual failover timeouts by @enjoy-binbin (#1305)
  • Automatic failover votes are no longer restricted by two times the node timeout, matching the manual failover change by @enjoy-binbin (#1356)
  • SENTINEL SET now rejects values containing control characters and config rewrite escapes them, preventing config injection by @eifrah-aws (#3847)
  • Reject control characters and delimiters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf injection by @eifrah-aws (#3848)
  • Fix lua-enable-insecure-api yes not taking effect when set at startup via config file or command line by @enjoy-binbin (#3548)
  • Log 'Connection reset by peer' instead of the misleading 'Success' when the connection to the primary closes during sync by @abmathur-ie (#3580)
  • Redact key names and user data from additional server log messages when hide-user-data-from-log is enabled by @zackcam (#3872)
  • Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @pkhartsk (#3843)
  • valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No such node ID' by @yang-z-o (#3209)
  • Fix valkey-cli --cluster assigning all uncovered slots to the same primary instead of distributing them randomly by @abmathur-ie (#3586)

dotnet8.0-8.0.129-2.fc43

Fedora Security Advisories
11 hours 29 minutes ago
FEDORA-2026-da44c3870f Packages in this update:
  • dotnet8.0-8.0.129-2.fc43
Update description:

Update to .NET SDK 8.0.129 and Runtime 8.0.29

Fixes: CVE-2026-47300,CVE-2026-47302,CVE-2026-47303,CVE-2026-47304,CVE-2026-50524,CVE-2026-50525,CVE-2026-50526,CVE-2026-50527,CVE-2026-50528,CVE-2026-50646,CVE-2026-50648,CVE-2026-50649,CVE-2026-50650,CVE-2026-50651,CVE-2026-50659,CVE-2026-56158,CVE-2026-57108

Release Notes:

dotnet8.0-8.0.129-2.fc44

Fedora Security Advisories
11 hours 38 minutes ago
FEDORA-2026-9aef53fa96 Packages in this update:
  • dotnet8.0-8.0.129-2.fc44
Update description:

Update to .NET SDK 8.0.129 and Runtime 8.0.29

Fixes: CVE-2026-47300,CVE-2026-47302,CVE-2026-47303,CVE-2026-47304,CVE-2026-50524,CVE-2026-50525,CVE-2026-50526,CVE-2026-50527,CVE-2026-50528,CVE-2026-50646,CVE-2026-50648,CVE-2026-50649,CVE-2026-50650,CVE-2026-50651,CVE-2026-50659,CVE-2026-56158,CVE-2026-57108

Release Notes:

proftpd-1.3.9c-3.el10_3

Fedora Security Advisories
13 hours 13 minutes ago
FEDORA-EPEL-2026-58bc6905cb Packages in this update:
  • proftpd-1.3.9c-3.el10_3
Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.

proftpd-1.3.9c-3.el10_2

Fedora Security Advisories
13 hours 13 minutes ago
FEDORA-EPEL-2026-8258136556 Packages in this update:
  • proftpd-1.3.9c-3.el10_2
Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.

kernel-7.1.4-102.fc43

Fedora Security Advisories
13 hours 33 minutes ago
FEDORA-2026-f1fc7772c3 Packages in this update:
  • kernel-7.1.4-102.fc43
Update description:

The 7.1.4-102/202 stable kernel updates contain a few important fixes across the tree.

The 7.1.4-101/201 stable kernel update contains a fix for a rather important security issue with net/can.

kernel-7.1.4-202.fc44

Fedora Security Advisories
13 hours 34 minutes ago
FEDORA-2026-2dd8b600bb Packages in this update:
  • kernel-7.1.4-202.fc44
Update description:

The 7.1.4-102/202 stable kernel updates contain a few important fixes across the tree.

The 7.1.4-101/201 stable kernel update contains a fix for a rather important security issue with net/can.

proftpd-1.3.9c-3.fc43

Fedora Security Advisories
13 hours 50 minutes ago
FEDORA-2026-d314ce6051 Packages in this update:
  • proftpd-1.3.9c-3.fc43
Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.

proftpd-1.3.9c-3.fc44

Fedora Security Advisories
13 hours 50 minutes ago
FEDORA-2026-2994824419 Packages in this update:
  • proftpd-1.3.9c-3.fc44
Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.

golang-x-image-0.44.0-1.fc45

Fedora Security Advisories
18 hours 54 minutes ago
FEDORA-2026-3e4b43a4cd Packages in this update:
  • golang-x-image-0.44.0-1.fc45
Update description:

Automatic update for golang-x-image-0.44.0-1.fc45.

Changelog * Tue Jul 21 2026 Packit <hello@packit.dev> - 0.44.0-1 - Update to 0.44.0 upstream release - Resolves: rhbz#2343804 - Resolves: rhbz#2434621 - Resolves: rhbz#2494479 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 0.23.0-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Mon Feb 9 2026 Miroslav Suchý <msuchy@redhat.com> - 0.23.0-6 - migrate license to SPDX * Tue Feb 3 2026 Maxwell G <maxwell@gtmx.me> - 0.23.0-5 - Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26 * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 0.23.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild

llvm-22.1.8-4.fc44

Fedora Security Advisories
21 hours 30 minutes ago
FEDORA-2026-597e8f9de1 Packages in this update:
  • llvm-22.1.8-4.fc44
Update description:

Backport fixes from LLVM 23

  • Fix an issue that could cause a buffer overflow when reading a corrupted bitcode file.
  • Fix a miscompilation known to affect rust applications.
  • Fix a miscompilation in x86 vectorized code.
  • Fix 2 issues in LLD.
Checked
1 minute 28 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security