Fedora Security Advisories

• perl-HTTP-Parser-XS-0.18-1.el10_2

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• perl-HTTP-Parser-XS-0.18-1.fc45

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• perl-HTTP-Parser-XS-0.18-1.fc43

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• perl-HTTP-Parser-XS-0.18-1.fc44

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

• ignition-2.28.0-2.fc45

Rebuild against the patched Go toolchain (golang 1.27.3) to pick up the fix for CVE-2026-111943. Go's crypto/x509 now rejects certificate chains that use any of eight compromised eMudhra intermediate CA public keys. There are no source changes to ignition itself -- this rebuild simply links the fixed standard library into the binary.

Update to Ignition 2.28.0, including Butane OpenShift 5.0 support. See https://github.com/coreos/ignition/issues/2336.

Patch build to resolve home_dir symlinks to avoid an issue with a recent libselinux update leading to relabelling failures.

• udns-0.7-1.fc44

Update to 0.7

• python3.9-3.9.25-16.fc45

• Ensure the bundled pip (used on Fedora 45+) uses system certificates

• tigervnc-1.16.2-9.fc44

Rebuild against new xorg-x11-server to fix CVE-2026-88812, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93523.

• tigervnc-1.16.2-9.fc45

Rebuild against new xorg-x11-server to fix CVE-2026-88812, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93523.

• freerdp-3.33.0-1.fc43

Update to 3.33.0

• freerdp-3.33.0-1.fc44

Update to 3.33.0

• freerdp-3.33.0-1.fc45

Update to 3.33.0

• udns-0.7-1.fc45

Update to 0.7

• udns-0.7-1.el10_3

Update to 0.7

• udns-0.7-1.el10_4

Update to 0.7

• python-robotframework-7.5.1-1.fc45

Upgrade to 7.5.1 (rhbz#2548546 and rhbz#2548558)

• php-getid3-1.9.28-1.fc43

• GHSA-4pp3-6hmx-mfmg memory exhaustion in Quicktime
• DTS typo
• keep composer.json in dist archives
• copy replaygain_album_peak
• TIPL/TMCL/IPL/IPLS ID3v2 consistency

• php-getid3-1.9.28-1.fc44

• GHSA-4pp3-6hmx-mfmg memory exhaustion in Quicktime
• DTS typo
• keep composer.json in dist archives
• copy replaygain_album_peak
• TIPL/TMCL/IPL/IPLS ID3v2 consistency

• php-getid3-1.9.28-1.fc45

• GHSA-4pp3-6hmx-mfmg memory exhaustion in Quicktime
• DTS typo
• keep composer.json in dist archives
• copy replaygain_album_peak
• TIPL/TMCL/IPL/IPLS ID3v2 consistency

• udns-0.7-1.el9

Update to 0.7