Fedora Security Advisories

FEDORA-2026-614b6429cb Packages in this update:

• python3.6-3.6.15-60.fc46

Update description:

Automatic update for python3.6-3.6.15-60.fc46.

Changelog * Tue Oct 27 2026 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-60 - Security fixes for CVE-2026-12345, CVE-2026-19445, CVE-2026-19553 Resolves: rhbz#2547342, rhbz#2545939, rhbz#2546325 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-59 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

FEDORA-2026-59352ce434 Packages in this update:

• bind9-next-9.21.27-3.fc44

Update description: Update to 9.21.27 (rhbz#2558180) Security Fixes:

• Prevent exhaustion of CPU while parsing crafted DNS messages. (CVE-2026-19630)
• Prevent concurrent GSS-TSIG traffic from terminating named. (CVE-2026-94300)
• Fix a crash with redirect zones and strict QNAME minimization. (CVE-2026-96888)
• Fix a crash when resuming from a query initiated by RPZ. (CVE-2026-97313)

New Features:

• Add NXNAME to the known type mnemonics.

Feature Changes:

• Reject DNS messages that repeat a SOA, CNAME, or DNAME record.
• Reject compressed names in record types that forbid compression.

Multiple bug fixes.

Source: https://downloads.isc.org/isc/bind9/9.21.27/doc/arm/html/notes.html#notes-for-bind-9-21-27

FEDORA-2026-95b54d6bad Packages in this update:

• bind9-next-9.21.27-4.fc45

Update description: Update to 9.21.27 (rhbz#2558180) Security Fixes:

• Prevent exhaustion of CPU while parsing crafted DNS messages. (CVE-2026-19630)
• Prevent concurrent GSS-TSIG traffic from terminating named. (CVE-2026-94300)
• Fix a crash with redirect zones and strict QNAME minimization. (CVE-2026-96888)
• Fix a crash when resuming from a query initiated by RPZ. (CVE-2026-97313)

New Features:

• Add NXNAME to the known type mnemonics.

Feature Changes:

• Reject DNS messages that repeat a SOA, CNAME, or DNAME record.
• Reject compressed names in record types that forbid compression.

Multiple bug fixes.

Source: https://downloads.isc.org/isc/bind9/9.21.27/doc/arm/html/notes.html#notes-for-bind-9-21-27

FEDORA-2026-b7979527cc Packages in this update:

• criu-4.3.1-1.fc45

Update description:

Update to 4.3.1 🚀

FEDORA-2026-5af71de42d Packages in this update:

• criu-4.3.1-1.fc44

Update description:

Update to 4.3.1 🚀

FEDORA-2026-d50e3e2a7e Packages in this update:

• markdownlint-cli2-0.24.1-1.fc46

Update description:

Automatic update for markdownlint-cli2-0.24.1-1.fc46.

Changelog * Thu Nov 12 2026 Fabio Porcedda <fabio.porcedda@gmail.com> - 0.24.1-1 - Update to version 0.24.1 (rhbz#2572230, rhbz#2565796)

FEDORA-2026-3a9945b706 Packages in this update:

• aws-26.0.0-5.fc44

Update description:

This is a backported fix for the path traversal vulnerability AWS-0175.

FEDORA-2026-cbdf2a98ef Packages in this update:

• python-loguru-0.8.0-1.fc43

Update description:

Update to 0.8.0 upstream release

Backport fix for CVE-2026-120217

FEDORA-2026-63ebc7d33c Packages in this update:

• tpm2-tss-4.1.6-1.fc44

Update description:

Security

GHSA-89w7-5q38-fgm3 CVE-ID requested

Fixes

mu: fix offset of NULL in TPMS_EMPTY marshalling ESYS: avoid zero-length VLA in iesys_decrypt_param SAPI: fix alignment of the response parameter pointer FAPI: Prevent count underflow in POLICYNAMEHASH instantiation FAPI: Reject out-of-range PCR indices in policy JSON deserialization TCTI: Reject undersized TPM responses in swtpm receive path FAPI: fix oob access of policy during name hash calculation

FEDORA-2026-5d641a851f Packages in this update:

• tpm2-tss-4.1.6-1.fc43

Update description:

Security

GHSA-89w7-5q38-fgm3 CVE-ID requested

Fixes

mu: fix offset of NULL in TPMS_EMPTY marshalling ESYS: avoid zero-length VLA in iesys_decrypt_param SAPI: fix alignment of the response parameter pointer FAPI: Prevent count underflow in POLICYNAMEHASH instantiation FAPI: Reject out-of-range PCR indices in policy JSON deserialization TCTI: Reject undersized TPM responses in swtpm receive path FAPI: fix oob access of policy during name hash calculation

FEDORA-2026-66a5101223 Packages in this update:

• perl-Text-JSCalendar-0.11-1.fc45

Update description:

Many changes. See bugzilla ticket.

FEDORA-2026-0866c99872 Packages in this update:

• tpm2-tss-4.2.2-1.fc45

Update description:

Security

GHSA-89w7-5q38-fgm3 CVE-ID requested

Fixes

mu: fix offset of NULL in TPMS_EMPTY marshalling ESYS: avoid zero-length VLA in iesys_decrypt_param SAPI: fix alignment of the response parameter pointer FAPI: Reject out-of-range PCR indices in policy JSON deserialization FAPI: Prevent count underflow in POLICYNAMEHASH instantiation TCTI: Reject undersized TPM responses in swtpm receive path FAPI: fix oob access of policy during name hash calculation

FEDORA-2026-04383cf016 Packages in this update:

• dr_libs-0^20261030.35b5c39-2.fc43

Update description:

Update to 0^20261030.35b5c39

• dr_flac 0.13.4
• dr_mp3 0.7.4
• dr_wav 0.14.6

FEDORA-2026-4708e42849 Packages in this update:

• dr_libs-0^20261030.35b5c39-3.fc44

Update description:

Update to 0^20261030.35b5c39

• dr_flac 0.13.4
• dr_mp3 0.7.4
• dr_wav 0.14.6

FEDORA-EPEL-2026-9cf8208467 Packages in this update:

• radicale-3.9.1-1.el8

Update description:

Update to 3.9.1

FEDORA-EPEL-2026-ca96ec0034 Packages in this update:

• radicale-3.9.1-1.el9

Update description:

Update to 3.9.1

FEDORA-EPEL-2026-0ee7144a26 Packages in this update:

• radicale-3.9.1-1.el10_4

Update description:

Update to 3.9.1

FEDORA-EPEL-2026-d99d13a0a2 Packages in this update:

• radicale-3.9.1-1.el10_3

Update description:

Update to 3.9.1

FEDORA-2026-863af1a339 Packages in this update:

• radicale-3.9.1-1.fc43

Update description:

Update to 3.9.1

FEDORA-2026-4081ce30bf Packages in this update:

• radicale-3.9.1-1.fc44

Update description:

Update to 3.9.1