Fedora Security Advisories

• golang-x-perf-0-0.36.20260904git19be9d8.fc44

Update to 19be9d8

• golang-x-perf-0-0.36.20260904git19be9d8.fc43

Update to 19be9d8

• golang-x-perf-0-0.36.20260904git19be9d8.fc45

Update to 19be9d8

• pdns-recursor-5.4.6-2.el10_2

Update to 5.4.6

Resolves: rhbz#2527899

• pdns-recursor-5.4.6-2.fc45

Update to 5.4.6

Resolves: rhbz#2527899

• pdns-recursor-5.4.6-2.el10_3

Update to 5.4.6

Resolves: rhbz#2527899

• pdns-recursor-5.4.6-2.fc44

Update to 5.4.6

Resolves: rhbz#2527899

• corosync-3.1.10-3.fc43

Fix CVE-2026-81666 and CVE-2026-81665

• corosync-3.1.10-6.fc44

Fix CVE-2026-81666 and CVE-2026-81665

• corosync-3.1.10-8.fc45

Fix CVE-2026-81666 and CVE-2026-81665

• php-pecl-mongodb2-2.5.2-1.fc45

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.

• PHPC-2742: Bump libmongocrypt to 1.20.2 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2051
• PHPC-2755: Fix test suite failures with PHP 8.6 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2056
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2060
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2059

• php-pecl-mongodb2-2.5.2-1.el10_4

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.

• PHPC-2742: Bump libmongocrypt to 1.20.2 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2051
• PHPC-2755: Fix test suite failures with PHP 8.6 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2056
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2060
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2059

Release Highlights

• Add support for stringOpts in ClientEncryption::encrypt() in #2033 by @GromNaN
• Support object cloning for ReadConcern, ReadPreference, and WriteConcern in #2002 by @GromNaN

• php-pecl-mongodb2-2.5.2-1.el10_3

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• perl-Protocol-HTTP2-1.14-1.fc43

This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and a license wording.

• perl-Protocol-HTTP2-1.14-1.fc44

This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and a license wording.

• perl-Protocol-HTTP2-1.14-1.fc45

This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and a license wording.

• mongo-c-driver-1.30.9-1.el10_2

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.el9

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.fc44

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.fc43

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963