Fedora Security Advisories

• mongo-c-driver-1.30.13-1.el10_2

• Fix edge case in Decimal128 parsing. CVE-2026-106438
• Enforce minimum size in bson_reserve_buffer. CVE-2026-106437
• Fix bson_writer_new when writing empty documents. CVE-2026-106431

• Fix SCRAM parser. CVE-2026-106428

• mongo-c-driver-1.30.13-1.fc44

• Fix edge case in Decimal128 parsing. CVE-2026-106438
• Enforce minimum size in bson_reserve_buffer. CVE-2026-106437
• Fix bson_writer_new when writing empty documents. CVE-2026-106431

• Fix SCRAM parser. CVE-2026-106428

• mongo-c-driver-1.30.13-1.fc43

• Fix edge case in Decimal128 parsing. CVE-2026-106438
• Enforce minimum size in bson_reserve_buffer. CVE-2026-106437
• Fix bson_writer_new when writing empty documents. CVE-2026-106431

• Fix SCRAM parser. CVE-2026-106428

• curl-8.18.0-13.fc44

• Fix Negotiate ambient user conn reuse (CVE-2026-19931)

• mongo-c-driver-2.5.6-1.fc45

• Fix edge case in Decimal128 parsing. CVE-2026-106438
• Enforce minimum size in bson_reserve_buffer. CVE-2026-106437
• Fix bson_writer_new when writing empty documents. CVE-2026-106431

• mongo-c-driver-2.5.6-1.el10_3

• Fix edge case in Decimal128 parsing. CVE-2026-106438
• Enforce minimum size in bson_reserve_buffer. CVE-2026-106437
• Fix bson_writer_new when writing empty documents. CVE-2026-106431

• mongo-c-driver-2.5.6-1.el10_4

• Fix edge case in Decimal128 parsing. CVE-2026-106438
• Enforce minimum size in bson_reserve_buffer. CVE-2026-106437
• Fix bson_writer_new when writing empty documents. CVE-2026-106431

• docker-buildx-0.38.0-1.fc43

• Update to release v0.38.0
• Resolves: rhbz#2544412

• Update to release v0.37.2
• Resolves: rhbz#2544198
• Resolves CVE-2026-56855: rhbz#2530594
• resolves CVE-2026-78662: rhbz#2530802
• Upstream fix

• docker-buildx-0.38.0-1.fc45

• Update to release v0.38.0
• Resolves: rhbz#2544412

• Update to release v0.37.2
• Resolves: rhbz#2544198
• Resolves CVE-2026-56855: rhbz#2530594
• resolves CVE-2026-78662: rhbz#2530802
• Upstream fix

• rust-onefetch-3.0.0-2.fc46
• rust-onefetch-ascii-3.0.0-1.fc46
• rust-onefetch-image-3.0.0-1.fc46
• rust-onefetch-manifest-3.0.0-1.fc46

https://github.com/o2sh/onefetch/releases/tag/3.0.0

• hamlib-4.5.5-2.el8

This is an update fixing stack out-of-bounds write and uninitialized memory disclosure (CVE-2026-54634).

• hamlib-4.5.5-2.el9

This is an update fixing stack out-of-bounds write and uninitialized memory disclosure (CVE-2026-54634).

• chezmoi-2.73.0-2.el10_2

Update to 2.73.0

• chezmoi-2.73.0-2.el10_4

Update to 2.73.0

• chezmoi-2.73.0-2.el9

Update to 2.73.0

• chezmoi-2.73.0-2.el10_3

Update to 2.73.0

• python-django5-5.2.18-1.fc44

Update Django 5 to version 5.2.18

• Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in get_supported_language_variant()
• Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing
• Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values
• Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

See https://docs.djangoproject.com/en/dev/releases/5.2.18/ for more details

• python-django5-5.2.18-1.fc45

Update Django 5 to version 5.2.18

• Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in get_supported_language_variant()
• Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing
• Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values
• Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

See https://docs.djangoproject.com/en/dev/releases/5.2.18/ for more details

• python-django5-5.2.18-1.fc43

Update Django 5 to version 5.2.18

• Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in get_supported_language_variant()
• Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing
• Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values
• Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

See https://docs.djangoproject.com/en/dev/releases/5.2.18/ for more details

• tor-0.4.9.14-1.el9

Update to latest upstream release