Fedora Security Advisories

rust-backtrace-0.3.76-4.el9 rust-object-0.40.0-1.el9 rust-object0.37-0.37.3-3.el9 rust-object0.38-0.38.1-2.el9 rust-object0.39-0.39.1-1.el9 rust-ruzstd-0.9.1-1.el9

Fedora Security Advisories
1 day 14 hours ago
FEDORA-EPEL-2026-4645488364 Packages in this update:
  • rust-backtrace-0.3.76-4.el9
  • rust-object0.37-0.37.3-3.el9
  • rust-object0.38-0.38.1-2.el9
  • rust-object0.39-0.39.1-1.el9
  • rust-object-0.40.0-1.el9
  • rust-ruzstd-0.9.1-1.el9
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.el10_4 rust-object-0.40.0-1.el10_4 rust-object0.37-0.37.3-3.el10_4 rust-object0.38-0.38.1-2.el10_4 rust-object0.39-0.39.1-1.el10_4 rust-ruzstd-0.9.1-1.el10_4

Fedora Security Advisories
1 day 14 hours ago
FEDORA-EPEL-2026-4c9681f2f1 Packages in this update:
  • rust-backtrace-0.3.76-4.el10_4
  • rust-object0.37-0.37.3-3.el10_4
  • rust-object0.38-0.38.1-2.el10_4
  • rust-object0.39-0.39.1-1.el10_4
  • rust-object-0.40.0-1.el10_4
  • rust-ruzstd-0.9.1-1.el10_4
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.fc43 rust-object-0.40.0-1.fc43 rust-object0.37-0.37.3-3.fc43 rust-object0.38-0.38.1-2.fc43 rust-object0.39-0.39.1-1.fc43 rust-ruzstd-0.9.1-1.fc43

Fedora Security Advisories
1 day 14 hours ago
FEDORA-2026-9e7597548d Packages in this update:
  • rust-backtrace-0.3.76-4.fc43
  • rust-object0.37-0.37.3-3.fc43
  • rust-object0.38-0.38.1-2.fc43
  • rust-object0.39-0.39.1-1.fc43
  • rust-object-0.40.0-1.fc43
  • rust-ruzstd-0.9.1-1.fc43
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.fc44 rust-object-0.40.0-1.fc44 rust-object0.37-0.37.3-3.fc44 rust-object0.38-0.38.1-2.fc44 rust-object0.39-0.39.1-1.fc44 rust-ruzstd-0.9.1-1.fc44

Fedora Security Advisories
1 day 14 hours ago
FEDORA-2026-09783712f4 Packages in this update:
  • rust-backtrace-0.3.76-4.fc44
  • rust-object0.37-0.37.3-3.fc44
  • rust-object0.38-0.38.1-2.fc44
  • rust-object0.39-0.39.1-1.fc44
  • rust-object-0.40.0-1.fc44
  • rust-ruzstd-0.9.1-1.fc44
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.fc45 rust-object-0.40.0-1.fc45 rust-object0.37-0.37.3-3.fc45 rust-object0.38-0.38.1-2.fc45 rust-object0.39-0.39.1-1.fc45 rust-ruzstd-0.9.1-1.fc45

Fedora Security Advisories
1 day 14 hours ago
FEDORA-2026-e10e41c5b3 Packages in this update:
  • rust-backtrace-0.3.76-4.fc45
  • rust-object0.37-0.37.3-3.fc45
  • rust-object0.38-0.38.1-2.fc45
  • rust-object0.39-0.39.1-1.fc45
  • rust-object-0.40.0-1.fc45
  • rust-ruzstd-0.9.1-1.fc45
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

rust-backtrace-0.3.76-4.fc46 rust-object-0.40.0-1.fc46 rust-object0.37-0.37.3-3.fc46 rust-object0.38-0.38.1-2.fc46 rust-object0.39-0.39.1-1.fc46 rust-ruzstd-0.9.1-1.fc46

Fedora Security Advisories
1 day 14 hours ago
FEDORA-2026-d591b1e061 Packages in this update:
  • rust-backtrace-0.3.76-4.fc46
  • rust-object0.37-0.37.3-3.fc46
  • rust-object0.38-0.38.1-2.fc46
  • rust-object0.39-0.39.1-1.fc46
  • rust-object-0.40.0-1.fc46
  • rust-ruzstd-0.9.1-1.fc46
Update description:
  • Update the object crate to version 0.40.0.
  • Add a compat package for version 0.39 of the object crate.
  • Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

erlang-26.2.5.21-10.fc43

Fedora Security Advisories
1 day 18 hours ago
FEDORA-2026-a5783c8008 Packages in this update:
  • erlang-26.2.5.21-10.fc43
Update description:

Backport fixes for CVE-2026-75538 (Erlang/OTP TCP driver: remote DoS via signed length overflow) and CVE-2026-73270 (Erlang/OTP inets httpd: information disclosure via case-insensitive path bypass).

bind9-next-9.21.26-1.fc43

Fedora Security Advisories
1 day 19 hours ago
FEDORA-2026-d47a436e71 Packages in this update:
  • bind9-next-9.21.26-1.fc43
Update description: Update to 9.21.26 (rhbz#2489832) Security Fixes:
  • Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
  • Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
  • Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
  • Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
  • DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
  • Reject oversized negative cache records. (CVE-2026-19667)
  • Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
  • Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
  • Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
  • Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
  • Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
  • Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
  • Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
  • Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)
Feature Changes:
  • Reject oversized and malformed DNSKEY records up front.
  • Reject out-of-zone records in zone transfers and zone files.
Removed Features:
  • Remove the RFC 1918 reverse-lookup leakage warning.

bind9-next-9.21.26-1.fc44

Fedora Security Advisories
1 day 19 hours ago
FEDORA-2026-87d221ec8c Packages in this update:
  • bind9-next-9.21.26-1.fc44
Update description: Update to 9.21.26 (rhbz#2489832) Security Fixes:
  • Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
  • Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
  • Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
  • Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
  • DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
  • Reject oversized negative cache records. (CVE-2026-19667)
  • Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
  • Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
  • Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
  • Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
  • Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
  • Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
  • Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
  • Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)
Feature Changes:
  • Reject oversized and malformed DNSKEY records up front.
  • Reject out-of-zone records in zone transfers and zone files.
Removed Features:
  • Remove the RFC 1918 reverse-lookup leakage warning.

bind9-next-9.21.26-1.fc45

Fedora Security Advisories
1 day 19 hours ago
FEDORA-2026-57cc6eadd3 Packages in this update:
  • bind9-next-9.21.26-1.fc45
Update description: Update to 9.21.26 (rhbz#2489832) Security Fixes:
  • Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
  • Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
  • Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
  • Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
  • DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
  • Reject oversized negative cache records. (CVE-2026-19667)
  • Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
  • Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
  • Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
  • Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
  • Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
  • Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
  • Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
  • Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)
Feature Changes:
  • Reject oversized and malformed DNSKEY records up front.
  • Reject out-of-zone records in zone transfers and zone files.
Removed Features:
  • Remove the RFC 1918 reverse-lookup leakage warning.

erlang-26.2.5.21-10.fc44

Fedora Security Advisories
1 day 19 hours ago
FEDORA-2026-0cc9a54ffe Packages in this update:
  • erlang-26.2.5.21-10.fc44
Update description:

Backport fixes for CVE-2026-75538 (Erlang/OTP TCP driver: remote DoS via signed length overflow) and CVE-2026-73270 (Erlang/OTP inets httpd: information disclosure via case-insensitive path bypass).

maradns-3.5.0039-1.fc44

Fedora Security Advisories
1 day 19 hours ago
FEDORA-2026-eb61896ed1 Packages in this update:
  • maradns-3.5.0039-1.fc44
Update description:

update to 3.5.0039 MaraDNS 3.5.0039 has been released. In addition to revamping how the cryptographic secure pseudo random number generator is seeded to be more secure and no longer generate Valgrind warnings, adding better IPv6 support to the askmara tool, updating the compile process to be more future-proof (by freezing things at C99), etc. it fixes two minor security problems: * It was possible to perform a denial of service to disable Deadwood’s DNS-over-TCP feature. (DNS-over-UDP was not affected and DNS-over-TCP is disabled by default) * RFC8482 replies made public 19 bytes of memory in the heap in Deadwood. There does not appear to be any vulnerable private data leaked.

libzip-1.12.1-1.fc45

Fedora Security Advisories
1 day 20 hours ago
FEDORA-2026-3523480992 Packages in this update:
  • libzip-1.12.1-1.fc45
Update description: Version 1.12.1 - 2026-10-14
  • Protect against denial of service attack (advisory GHSA-m3wq-j48p-jxwh, actually fixed in 1.12).
  • Fix compile issues.
  • Fix adding and replacing files in torrentzip archives.
  • Fix error handling in zip_source_filep_create().
Checked
26 minutes 56 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security