Fedora Security Advisories

• perl-Authen-SASL-2.2100-1.fc45

2.2100 - CVE-2026-86219: Replay attack in Authen::SASL::Perl::DIGEST_MD5 Thanks to TIMLEGGE (@timlegge) and the CPANSec team for the AI-assisted detection and fix!

• perl-Authen-SASL-2.2100-1.fc44

2.2100 - CVE-2026-86219: Replay attack in Authen::SASL::Perl::DIGEST_MD5 Thanks to TIMLEGGE (@timlegge) and the CPANSec team for the AI-assisted detection and fix!

• sblim-sfcb-1.4.9-38.fc43

Fix CVE-2026-73583 and CVE-2026-73584

• sblim-sfcb-1.4.9-40.fc44

Fix CVE-2026-73583 and CVE-2026-73584

• sblim-sfcb-1.4.9-44.fc45

Fix CVE-2026-73583 and CVE-2026-73584

• knot-3.5.8-1.fc44

Update to 3.5.8 (security fixes in XDP, DDNS, and TSIG).

• knot-3.5.8-1.fc45

Update to 3.5.8 (security fixes in XDP, DDNS, and TSIG).

• environment-modules-5.6.2-1.fc43

Update to 5.6.2 (fix CVE-2026-85013)

• GitPython-3.1.62-1.fc44

Update to 3.1.62 (close RHBZ#2529282)

• Fixes GHSA-hmq2-w58f-27jc

• python-configargparse-1.7.7-1.el9

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• environment-modules-5.6.2-1.fc44

Update to 5.6.2 (fix CVE-2026-85013)

• python-configargparse-1.7.7-1.el10_3

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• perl-Dancer2-1.1.2-4.fc43

Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.

• perl-Dancer2-2.0.1-4.fc44

Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.

• perl-Dancer2-2.1.0-3.fc45

Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.

• python-configargparse-1.7.7-1.el10_4

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• python-configargparse-1.7.7-1.fc43

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• python-configargparse-1.7.7-1.fc44

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• python-configargparse-1.7.7-1.fc45

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• rust-lru0.16-0.16.4-1.el9
• rust-lru-0.18.4-1.el9

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39