Fedora Security Advisories

FEDORA-2026-3dbdc5d71d Packages in this update:

• nebula-1.11.2-1.fc44

Update description:

Windows tracks NLMTU per address family and Nebula only ever set it for AF_INET, so the IPv6 MTU on every Windows adapter sat at the adapter default of 65535 regardless of tun.mtu and the stack could hand Nebula packets far larger than configured. An IPv6 enabled overlay with tun.mtu under 1280 now refuses to start, matching the other platforms. (#1871) Android 11+ denies bind() on netlink route sockets inside the app sandbox, so local address discovery failed and an Android node advertised no underlay addresses, leaving peers on the same LAN to reach it only at the address a lighthouse observed. (#1881) Recompute the transport checksum on packets a host sends to its own overlay address. On macOS the kernel leaves the checksum unfinished for hardware offload, which does not survive the trip through userspace, so TCP and UDP to a host's own IPv6 overlay address were dropped as corrupt. (#1862)

FEDORA-2026-1aa327b369 Packages in this update:

• nebula-1.11.2-1.fc45

Update description:

Windows tracks NLMTU per address family and Nebula only ever set it for AF_INET, so the IPv6 MTU on every Windows adapter sat at the adapter default of 65535 regardless of tun.mtu and the stack could hand Nebula packets far larger than configured. An IPv6 enabled overlay with tun.mtu under 1280 now refuses to start, matching the other platforms. (#1871) Android 11+ denies bind() on netlink route sockets inside the app sandbox, so local address discovery failed and an Android node advertised no underlay addresses, leaving peers on the same LAN to reach it only at the address a lighthouse observed. (#1881) Recompute the transport checksum on packets a host sends to its own overlay address. On macOS the kernel leaves the checksum unfinished for hardware offload, which does not survive the trip through userspace, so TCP and UDP to a host's own IPv6 overlay address were dropped as corrupt. (#1862)

FEDORA-2026-1a11502f81 Packages in this update:

• gopass-1.17.4-1.fc44
• gopass-jsonapi-1.17.4-1.fc44

Update description:

Update

FEDORA-2026-3bf1e0b3f9 Packages in this update:

• perl-GD-SecurityImage-1.75-23.fc44

Update description:

Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is predictable and reversible. With this update, the module is patched to use Crypt::URandom::MonkeyPatch to override built-in rand (CVE-2026-13082)

FEDORA-2026-bdeade52d9 Packages in this update:

• perl-GD-SecurityImage-1.75-22.fc43

Update description:

Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is predictable and reversible. With this update, the module is patched to use Crypt::URandom::MonkeyPatch to override built-in rand (CVE-2026-13082)

FEDORA-2026-825527e021 Packages in this update:

• perl-GD-SecurityImage-1.75-24.fc45

Update description:

Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is predictable and reversible. With this update, the module is patched to use Crypt::URandom::MonkeyPatch to override built-in rand (CVE-2026-13082)

FEDORA-2026-535e7d2281 Packages in this update:

• perl-Net-Whois-Raw-2.99.044-1.fc45

Update description:

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. This tool now uses Net::IDN::Encode instead of Net::IDN::Punycode, which fixes the issue.

FEDORA-2026-78d9d79627 Packages in this update:

• perl-Net-Whois-Raw-2.99.044-1.fc44

Update description:

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. This tool now uses Net::IDN::Encode instead of Net::IDN::Punycode, which fixes the issue.

FEDORA-2026-c330a15c68 Packages in this update:

• perl-Net-Whois-Raw-2.99.044-1.fc43

Update description:

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. This tool now uses Net::IDN::Encode instead of Net::IDN::Punycode, which fixes the issue.

FEDORA-2026-8918b368f4 Packages in this update:

• mkvtoolnix-96.0-2.fc43

Update description:

Backported fix for CVE-2026-90783.

FEDORA-2026-b56cbfe203 Packages in this update:

• libebml-1.4.7-1.fc44
• libmatroska-1.7.2-1.fc44
• mkvtoolnix-102.0-1.fc44

Update description:

Latest mkvtoolnix stable update (changes: https://mkvtoolnix.download/doc/NEWS.md), with the fix for CVE-2026-90783. Includes required updates of libebml and libmatroska.

FEDORA-2026-3100f3c686 Packages in this update:

• perl-Net-IDN-Encode-2.502-1.fc44

Update description:

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. This also leak the output buffer on every rejected label in decode_punycode.

This update fixes both issues (and others).

FEDORA-2026-2aac921262 Packages in this update:

• perl-Net-IDN-Encode-2.502-1.fc45

Update description:

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. This also leak the output buffer on every rejected label in decode_punycode.

This update fixes both issues (and others).

FEDORA-2026-4aec7019eb Packages in this update:

• perl-Net-IDN-Encode-2.502-1.fc43

Update description:

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. This also leak the output buffer on every rejected label in decode_punycode.

This update fixes both issues (and others).

FEDORA-EPEL-2026-954982c495 Packages in this update:

• rclone-1.75.2-2.el9

Update description:

Update to 1.75.2

FEDORA-2026-7aab7a2bbe Packages in this update:

• rclone-1.75.2-1.fc45

Update description:

Update to 1.75.2

FEDORA-2026-a334235332 Packages in this update:

• xapian-bindings-1.4.32-1.fc46
• xapian-core-1.4.32-1.fc46

Update description:

closes rhbz#2521816

FEDORA-2026-85ac5e79b9 Packages in this update:

• ImageMagick-7.1.2.33-1.fc44

Update description:

Automatic update for ImageMagick-7.1.2.33-1.fc44.

Changelog for ImageMagick * Sun Oct 11 2026 Luya Tshimbalanga <luya@fedoraproject.org> - 1:7.1.2.33-1 - Update to version 7.1.2.33 - Resolves: rhbz#2391123 - Resolves: rhbz#2392771 - Resolves: rhbz#2393598 - Resolves: rhbz#2418551 - Resolves: rhbz#2548419 - Resolves: rhbz#2548420 - Resolves: rhbz#2548997

FEDORA-2026-31fd9bddda Packages in this update:

• ImageMagick-7.1.2.33-1.fc45

Update description:

Automatic update for ImageMagick-7.1.2.33-1.fc45.

Changelog for ImageMagick * Sun Oct 11 2026 Luya Tshimbalanga <luya@fedoraproject.org> - 1:7.1.2.33-1 - Update to version 7.1.2.33 - Resolves: rhbz#2391123 - Resolves: rhbz#2392771 - Resolves: rhbz#2393598 - Resolves: rhbz#2418551 - Resolves: rhbz#2548419 - Resolves: rhbz#2548420 - Resolves: rhbz#2548997

FEDORA-2026-1400fecbbc Packages in this update:

• ImageMagick-7.1.2.33-1.fc43

Update description:

Automatic update for ImageMagick-7.1.2.33-1.fc43.

Changelog for ImageMagick * Sun Oct 11 2026 Luya Tshimbalanga <luya@fedoraproject.org> - 1:7.1.2.33-1 - Update to version 7.1.2.33 - Resolves: rhbz#2391123 - Resolves: rhbz#2392771 - Resolves: rhbz#2393598 - Resolves: rhbz#2418551 - Resolves: rhbz#2548419 - Resolves: rhbz#2548420 - Resolves: rhbz#2548997