Fedora Security Advisories

FEDORA-2026-57cc6eadd3 Packages in this update:

• bind9-next-9.21.26-1.fc45

Update description: Update to 9.21.26 (rhbz#2489832) Security Fixes:

• Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
• Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
• Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
• Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
• DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
• Reject oversized negative cache records. (CVE-2026-19667)
• Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
• Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
• Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
• Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
• Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
• Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
• Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
• Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

Feature Changes:

• Reject oversized and malformed DNSKEY records up front.
• Reject out-of-zone records in zone transfers and zone files.

Removed Features:

• Remove the RFC 1918 reverse-lookup leakage warning.

FEDORA-2026-0cc9a54ffe Packages in this update:

• erlang-26.2.5.21-10.fc44

Update description:

Backport fixes for CVE-2026-75538 (Erlang/OTP TCP driver: remote DoS via signed length overflow) and CVE-2026-73270 (Erlang/OTP inets httpd: information disclosure via case-insensitive path bypass).

FEDORA-2026-eb61896ed1 Packages in this update:

• maradns-3.5.0039-1.fc44

Update description:

update to 3.5.0039 MaraDNS 3.5.0039 has been released. In addition to revamping how the cryptographic secure pseudo random number generator is seeded to be more secure and no longer generate Valgrind warnings, adding better IPv6 support to the askmara tool, updating the compile process to be more future-proof (by freezing things at C99), etc. it fixes two minor security problems: * It was possible to perform a denial of service to disable Deadwood’s DNS-over-TCP feature. (DNS-over-UDP was not affected and DNS-over-TCP is disabled by default) * RFC8482 replies made public 19 bytes of memory in the heap in Deadwood. There does not appear to be any vulnerable private data leaked.

FEDORA-2026-3523480992 Packages in this update:

• libzip-1.12.1-1.fc45

Update description: Version 1.12.1 - 2026-10-14

• Protect against denial of service attack (advisory GHSA-m3wq-j48p-jxwh, actually fixed in 1.12).
• Fix compile issues.
• Fix adding and replacing files in torrentzip archives.
• Fix error handling in zip_source_filep_create().

FEDORA-2026-3be88652b5 Packages in this update:

• jupyterlab-4.6.3-1.fc45
• python-jupyter-builder-1.2.3-1.fc45
• python-nbdime-4.0.4-7.fc45
• python-notebook-7.6.2-1.fc45

Update description:

New releases of packages in Jupyter stack fixing various CVEs.

FEDORA-2026-c2a516081f Packages in this update:

• knot-resolver-5.7.8-2.fc45

Update description:

New upstream release.

FEDORA-2026-97432ec1d3 Packages in this update:

• knot-resolver-5.7.8-1.fc44

Update description:

New upstream release.

FEDORA-2026-a99da3001b Packages in this update:

• clevis-pin-trustee-0.1.1-2.fc44

Update description:

Merge #6 Rebuild for CVE-2026-93600

FEDORA-2026-d68095cc3f Packages in this update:

• clevis-pin-trustee-0.1.1-2.fc45

Update description:

Merge #5 Rebuild for CVE-2026-93600

FEDORA-2026-a2113d0598 Packages in this update:

• freerdp-3.32.2-1.fc43

Update description:

Update to 3.32.2

FEDORA-2026-87944ba9bf Packages in this update:

• freerdp-3.32.2-1.fc44

Update description:

Update to 3.32.2

FEDORA-2026-b00e938d06 Packages in this update:

• freerdp-3.32.2-1.fc45

Update description:

Update to 3.32.2

FEDORA-EPEL-2026-a86b5f45be Packages in this update:

• python-cairosvg-2.9.1-1.el10_3

Update description:

Update to 2.9.1 (CVE-2026-107378)

FEDORA-EPEL-2026-e28a7e55a9 Packages in this update:

• python-cairosvg-2.9.1-1.el10_2

Update description:

Update to 2.9.1 (CVE-2026-107378)

FEDORA-EPEL-2026-fa42712b3f Packages in this update:

• python-cairosvg-2.9.1-1.el10_4

Update description:

Update to 2.9.1 (CVE-2026-107378)

FEDORA-2026-25e13e26b3 Packages in this update:

• rust-onefetch-2.28.1-4.fc45

Update description:

Backport fix for CVE-2026-100866 from 3.0.0

FEDORA-2026-0bf84c3130 Packages in this update:

• log4net-3.5.0-1.fc44
• nant-0.92-43.fc44

Update description:

Update log4net to 3.5.0. Nant is rebuilt (only dependency in Fedora).

FEDORA-2026-6515ac01d8 Packages in this update:

• log4net-3.5.0-1.fc45
• nant-0.92-43.fc45

Update description:

Update log4net to 3.5.0. Nant is rebuilt (only dependency in Fedora).

FEDORA-2026-588bc7e01c Packages in this update:

• log4net-3.5.0-1.fc43
• nant-0.92-43.fc43

Update description:

Update log4net to 3.5.0. Nant is rebuilt (only dependency in Fedora).

FEDORA-EPEL-2026-7addd7a2bf Packages in this update:

• syncthing-2.1.6-1.el10_3

Update description:

Update to version 2.1.6.

Release notes:

• https://github.com/syncthing/syncthing/releases/tag/v2.1.4
• https://github.com/syncthing/syncthing/releases/tag/v2.1.5
• https://github.com/syncthing/syncthing/releases/tag/v2.1.6