Fedora Security Advisories

• fractal-14.3-1.fc43

14.3

14.2

• fractal-14.3-1.fc45

14.3

14.2

• libvirt-12.0.0-6.fc44

• CVE-2026-18917 (bz #2520165)
• Fix ceph pool start (bz #2529178)

• libvirt-12.6.0-4.fc45

• CVE-2026-18917 (bz #2520165)
• Fix ceph pool start (bz #2529178)

• zchunk-1.5.5-1.el10_2

Update to 1.5.5, fixing a number of bugs around memory usage and correctness

• zchunk-1.5.5-1.el10_3

Update to 1.5.5, fixing a number of bugs around memory usage and correctness

• zchunk-1.5.5-1.fc44

Update to 1.5.5, fixing a number of bugs around memory usage and correctness

• zchunk-1.5.5-1.fc45

Update to 1.5.5, fixing a number of bugs around memory usage and correctness

• zchunk-1.5.5-1.el10_4

Update to 1.5.5, fixing a number of bugs around memory usage and correctness

• zchunk-1.5.5-1.fc43

Update to 1.5.5, fixing a number of bugs around memory usage and correctness

• zchunk-1.5.5-1.el9

Update to 1.5.5, fixing a number of bugs around memory usage and correctness

• zchunk-1.5.5-1.el8

Update to 1.5.5, fixing a number of bugs around memory usage and correctness

• selenium-manager-4.34.0-6.fc43

Rebuilt with latest rustls/rustls-webpki

• rustls 0.23.46 addresses RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349
• rustls-webpki 0.103.16 addresses RUSTSEC-2026-0382

• selenium-manager-4.34.0-7.fc44

Rebuilt with latest rustls/rustls-webpki

• rustls 0.23.46 addresses RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349
• rustls-webpki 0.103.16 addresses RUSTSEC-2026-0382

• python3.12-3.12.16-1.fc43

New version of the Python interpeter

• python3.12-3.12.16-1.fc45

New version of the Python interpeter

• python3.12-3.12.16-1.fc44

New version of the Python interpreter

• mingw-harfbuzz-14.6.0-1.fc44

Update to 14.6.0 and backport fix for CVE-2026-113679.

• unbound-1.26.2-1.fc43

Security fixes from the upstream changelog:

• Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
• Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
• Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
• Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen (Tsinghua University) for the report.
• Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

• selenium-manager-4.45.0-3.fc45

Rebuilt with latest rustls/rustls-webpki

• rustls 0.23.46 addresses RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349
• rustls-webpki 0.103.16 addresses RUSTSEC-2026-0382