Fedora Security Advisories

• rust-h2-0.4.17-1.fc44

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

• rust-h2-0.4.17-1.fc43

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

• rust-h2-0.4.17-1.el10_3

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

• rust-h2-0.4.17-1.el9

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

• rust-h2-0.4.17-1.el10_2

Update to version 0.4.17.

This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h.

• ceph-20.2.4-1.fc44

• CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC.

  https://docs.ceph.com/en/latest/security/CVE-2025-30156

• CVE-2026-39944 shares the unauthenticated-encryption root cause of CVE-2025-30156

  https://docs.ceph.com/en/latest/security/CVE-2026-39944

• CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor subscription handler.

  https://docs.ceph.com/en/latest/security/CVE-2026-50152

• CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 cryptographic signatures in RGW's SigV4 verifier.

  https://docs.ceph.com/en/latest/security/CVE-2026-54330

• ceph-19.2.6-1.fc43

• CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC.

  https://docs.ceph.com/en/latest/security/CVE-2025-30156

• CVE-2026-39944 shares the unauthenticated-encryption root cause of CVE-2025-30156

  https://docs.ceph.com/en/latest/security/CVE-2026-39944

• CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor subscription handler.

  https://docs.ceph.com/en/latest/security/CVE-2026-50152

• CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 cryptographic signatures in RGW's SigV4 verifier.

  https://docs.ceph.com/en/latest/security/CVE-2026-54330

• java-21-openjdk-21.0.12.1.1-1.0.fc43
• java-21-openjdk-portable-21.0.12.1.1-1.0.fc43

First monthly cadence release candidate

• bluez-5.87-4.fc43

An out-of-bounds read flaw was found in BlueZ in the AVRCP profile implementation. The vulnerability exists in the parse_media_element() and parse_media_folder() functions in profiles/audio/avrcp.c, where insufficient validation of packet length fields in GetFolderItems responses allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This can result in a crash of the bluetoothd daemon (denial of service) and potentially expose sensitive heap memory contents.

This update fixes this issue (CVE-2026-75032)

• bluez-5.87-4.fc44

An out-of-bounds read flaw was found in BlueZ in the AVRCP profile implementation. The vulnerability exists in the parse_media_element() and parse_media_folder() functions in profiles/audio/avrcp.c, where insufficient validation of packet length fields in GetFolderItems responses allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This can result in a crash of the bluetoothd daemon (denial of service) and potentially expose sensitive heap memory contents.

This update fixes this issue (CVE-2026-75032)

• postgresql16-anonymizer-3.1.3-1.fc44

Update to 3.1.3

• openssh-10.2p1-14.fc44

Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded

• openssh-10.0p1-12.fc43

Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded

• opkssh-0.16.0-2.el10_3

Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing via chi's RealIP middleware).

opkssh bundles only chi's root router package and never the affected middleware package, so the vulnerable code was not actually shipped in any opkssh build.

• opkssh-0.16.0-2.el10_2

Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing via chi's RealIP middleware).

opkssh bundles only chi's root router package and never the affected middleware package, so the vulnerable code was not actually shipped in any opkssh build.

• opkssh-0.16.0-2.fc43

Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing via chi's RealIP middleware).

opkssh bundles only chi's root router package and never the affected middleware package, so the vulnerable code was not actually shipped in any opkssh build.

• opkssh-0.16.0-2.fc44

Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing via chi's RealIP middleware).

opkssh bundles only chi's root router package and never the affected middleware package, so the vulnerable code was not actually shipped in any opkssh build.

• firefox-154.0-3.fc44

Implement buffer stride support for PipeWire camera.

• Update to latest upstream (154.0)
• Enabled Wayland session restore on KDE.

• openbao-2.6.2-1.el8

Update to upstream 2.6.2, including security fixes for GHSA-rh46-vc3j-w2w3 and GHSA-g892-p242-8g86.

• openbao-2.6.2-1.el10_3

Update to upstream 2.6.2, including security fixes for GHSA-rh46-vc3j-w2w3 and GHSA-g892-p242-8g86.