Fedora Security Advisories

unbound-1.26.2-1.fc44

Fedora Security Advisories
3 days 14 hours ago
FEDORA-2026-9142230324 Packages in this update:
  • unbound-1.26.2-1.fc44
Update description: Update to 1.26.2 (rhbz#2558169)

Security fixes from the upstream changelog:

  • Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
  • Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
  • Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
  • Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen (Tsinghua University) for the report.
  • Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

unbound-1.26.2-2.fc45

Fedora Security Advisories
3 days 14 hours ago
FEDORA-2026-7b16c1d7fc Packages in this update:
  • unbound-1.26.2-2.fc45
Update description: Update to 1.26.2 (rhbz#2558169)

Security fixes from the upstream changelog:

  • Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
  • Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
  • Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
  • Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen (Tsinghua University) for the report.
  • Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

python3.9-3.9.25-15.fc46

Fedora Security Advisories
3 days 16 hours ago
FEDORA-2026-2d80410324 Packages in this update:
  • python3.9-3.9.25-15.fc46
Update description:

Automatic update for python3.9-3.9.25-15.fc46.

Changelog * Wed Sep 23 2026 Miro Hrončok <mhroncok@redhat.com> - 3.9.25-15 - Security fix for CVE-2026-11940 * Wed Sep 23 2026 Lukáš Zachar <lzachar@redhat.com> - 3.9.25-14 - Security fix for CVE-2026-15308 Resolves: rhbz#2498693

uv-0.10.2-14.el10_2

Fedora Security Advisories
3 days 16 hours ago
FEDORA-EPEL-2026-93806300a6 Packages in this update:
  • uv-0.10.2-14.el10_2
Update description:

The uv package has been rebuilt with updated rustls and webpki dependencies, fixing RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. This includes fixes for the eMudhra intermediate CA compromise. Futhermore, we have backported the latest managed CPython builds for 3.11 and newer from uv 0.13.5; these builds distrust the eMudhra certificates. For more details and caveats, read the 0.13.5 changelogs. Finally, the system-wide configuration file (uv.toml) now sets system-certs = true, which means that, by default, the system-wide trust store is used instead of the root certificates bundled with uv. This better integrates with system-wide trust settings, and uv users can benefit from prompt security updates to the system-wide CA list.

rubygem-gist-6.1.0-1.fc46

Fedora Security Advisories
3 days 17 hours ago
FEDORA-2026-203a947c26 Packages in this update:
  • rubygem-gist-6.1.0-1.fc46
Update description:

Automatic update for rubygem-gist-6.1.0-1.fc46.

Changelog * Mon Oct 26 2026 Georg Sauthoff <mail@gms.tf> - 6.1.0-1 - Verify TLS server certificate (fixes fedora#2546280)

uv-0.12.7-11.el10_3

Fedora Security Advisories
3 days 17 hours ago
FEDORA-EPEL-2026-2004bc76b4 Packages in this update:
  • uv-0.12.7-11.el10_3
Update description:

The uv package has been rebuilt with updated rustls and webpki dependencies, fixing RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. This includes fixes for the eMudhra intermediate CA compromise. Futhermore, we have backported the latest managed CPython builds for 3.11 and newer from uv 0.13.5; these builds distrust the eMudhra certificates. For more details and caveats, read the 0.13.5 changelogs. Finally, the system-wide configuration file (uv.toml) now sets system-certs = true, which means that, by default, the system-wide trust store is used instead of the root certificates bundled with uv. This better integrates with system-wide trust settings, and uv users can benefit from prompt security updates to the system-wide CA list.

libsidplayfp-3.1.2-1.fc46

Fedora Security Advisories
3 days 19 hours ago
FEDORA-2026-6ebd8db1af Packages in this update:
  • libsidplayfp-3.1.2-1.fc46
Update description:

Automatic update for libsidplayfp-3.1.2-1.fc46.

Changelog * Mon Oct 26 2026 Karel Volný <kvolny@redhat.com> - 3.1.2-1 - Update to 3.1.2 (rhbz#2560385) - Fixes CVE-2026-111148 - possible OOB read (rhbz#2554229)
Checked
29 minutes 31 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security