rsync-3.5.2-1.fc45
FEDORA-2026-a950e9c818
Packages in this update:
- rsync-3.5.2-1.fc45
New version 3.5.2, includes the fix for CVE-2026-119741
Fedora Security Advisories
rsync-3.5.2-1.fc44
FEDORA-2026-ae26fd0508
Packages in this update:
- rsync-3.5.2-1.fc44
New version 3.5.2, includes the fix for CVE-2026-119741
rsync-3.5.2-1.fc43
FEDORA-2026-1a0ff57ef3
Packages in this update:
- rsync-3.5.2-1.fc43
New version 3.5.2, includes the fix for CVE-2026-119741
dnf5-5.2.18.0-6.fc43
FEDORA-2026-5879bc27e1
Packages in this update:
- dnf5-5.2.18.0-6.fc43
This release fixes CVE-2026-111253 (dnf5daemon-server: missing session-owner check allows foreign D-Bus callers to replace another client's resolved transaction)
python-h5io-0.2.6-2.fc43
FEDORA-2026-814e78984b
Packages in this update:
- python-h5io-0.2.6-2.fc43
Update to 0.2.6 upstream release
This release fixes GHSA-vwvw-f6v4-w737 / CVE-2026-120499: read_hdf5 could execute arbitrary code when reading a crafted HDF5 file.
As part of the fix, loading files containing classes, objects written with use_state=True, or pandas DataFrame/Series objects is disabled by default and will now raise a ValueError; see the release notes for details.
python-h5io-0.2.6-2.fc44
FEDORA-2026-e9e305c64c
Packages in this update:
- python-h5io-0.2.6-2.fc44
Update to 0.2.6 upstream release
This release fixes GHSA-vwvw-f6v4-w737 / CVE-2026-120499: read_hdf5 could execute arbitrary code when reading a crafted HDF5 file.
As part of the fix, loading files containing classes, objects written with use_state=True, or pandas DataFrame/Series objects is disabled by default and will now raise a ValueError; see the release notes for details.
python-h5io-0.2.6-2.fc45
FEDORA-2026-4a16e04d4b
Packages in this update:
- python-h5io-0.2.6-2.fc45
Update to 0.2.6 upstream release
This release fixes GHSA-vwvw-f6v4-w737 / CVE-2026-120499: read_hdf5 could execute arbitrary code when reading a crafted HDF5 file.
As part of the fix, loading files containing classes, objects written with use_state=True, or pandas DataFrame/Series objects is disabled by default and will now raise a ValueError; see the release notes for details.
hugo-0.165.0-1.fc44
FEDORA-2026-667d0938f0
Packages in this update:
- hugo-0.165.0-1.fc44
Update to Hugo 0.165.0, which includes security fixes for several CVEs.
This release fixes CVE-2026-75926 (Tailwind CSS Node permission model bypass) and CVE-2026-89258 (symlink confinement bypass), as well as earlier escaping and sandbox issues fixed upstream.
Fedora 44 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release that can be built for this Fedora release.
The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.
Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0
hugo-0.165.0-1.fc43
FEDORA-2026-9521359c66
Packages in this update:
- hugo-0.165.0-1.fc43
Update to Hugo 0.165.0.
Fedora 43 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release that can be built for this Fedora release. This update therefore skips 0.167.0 and 0.168.0, neither of which was published for Fedora 43. It is intended to be the final Hugo update for Fedora 43.
The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.
Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0
hugo-0.169.0-2.fc45
FEDORA-2026-97aa8e408a
Packages in this update:
- hugo-0.169.0-2.fc45
Update to Hugo 0.169.0, which includes a security fix.
Menu pre and post values defined in front matter are no longer rendered as unescaped HTML. Because front matter is untrusted content, a content contributor could previously inject arbitrary HTML, including script, into pages that render menu entries. These values are now HTML escaped unless text/html is allowed in security.allowContent, and a warning-menu-pre-post-html-escaped warning is logged when markup is escaped. Menu entries defined in the site configuration are not affected.
This update also requires Go 1.27.0 and continues to build the extended edition with bundled LibSass, so the package does not depend on a system libsass.
Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.169.0
mysql9.7-9.7.4-3.fc44
FEDORA-2026-c870d7ced5
Packages in this update:
- mysql9.7-9.7.4-3.fc44
MySQL 9.7.4
Release notes: https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-4.html Changelog: https://dev.mysql.com/doc/relnotes/mysql/9.7/en/ Released: 2026-10-20mysql9.7-9.7.4-3.fc43
FEDORA-2026-a8e910e972
Packages in this update:
- mysql9.7-9.7.4-3.fc43
MySQL 9.7.4
Release notes: https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-4.html Changelog: https://dev.mysql.com/doc/relnotes/mysql/9.7/en/ Released: 2026-10-20python-joserfc-1.7.7-1.fc44
FEDORA-2026-7888ffd011
Packages in this update:
- python-joserfc-1.7.7-1.fc44
Update to 1.7.7 (rhbz#2567025)
xen-4.20.4-5.fc43
FEDORA-2026-94fa41e927
Packages in this update:
- xen-4.20.4-5.fc43
arbitrary read/write via grant copy [XSA-523, CVE-2026-102703, CVE-2026-102704]
wrong version of xsa518 patch in last build x86/AMD: ineffectual Zenbleed workaround [XSA-515, CVE-2026-79608] x86: XPTI may break on huge-memory systems [XSA-516, CVE-2026-79609] grant-table: double version change race [XSA-517, CVE-2026-79610] VMX: VMentry failure with branch tracing and blocked states [XSA-518, CVE-2026-79611] Arm: multiple issues with GNTTABOP_cache_flush [XSA-519, CVE-2026-102699, CVE-2026-102702] gnttab: cache-flush handling may cause page reference leak [XSA-520, CVE-2026-102700]
xen-4.21.2-5.fc44
FEDORA-2026-0d1924f837
Packages in this update:
- xen-4.21.2-5.fc44
arbitrary read/write via grant copy [XSA-523, CVE-2026-102703, CVE-2026-102704]
python-joserfc-1.8.0-1.fc45
FEDORA-2026-a4d05e8333
Packages in this update:
- python-joserfc-1.8.0-1.fc45
Update to 1.8.0 (rhbz#2567025)
bind-9.18.51^git20261102.973d8646-3.fc44
FEDORA-2026-cf9d4ec5e6
Packages in this update:
- bind-9.18.51^git20261102.973d8646-3.fc44
- CVE-2026-94300 Fix remote termination of named under concurrent GSS-TSIG traffic (rhbz#2558420)
- CVE-2026-97313 Fix a bug when resuming from a query initiated by RPZ (rhbz#2558427)
- CVE-2026-96888 Possible crash with redirect and qname-minimization strict (rhbz#2558424)
- CVE-2026-19630 Crafted DNS messages could exhaust CPU while being parsed (rhbz#2558488)
bind-9.18.51^git20261102.973d8646-1.fc45
FEDORA-2026-7198802985
Packages in this update:
- bind-9.18.51^git20261102.973d8646-1.fc45
- CVE-2026-94300 Fix remote termination of named under concurrent GSS-TSIG traffic (rhbz#2558420)
- CVE-2026-97313 Fix a bug when resuming from a query initiated by RPZ (rhbz#2558427)
- CVE-2026-96888 Possible crash with redirect and qname-minimization strict (rhbz#2558424)
- CVE-2026-19630 Crafted DNS messages could exhaust CPU while being parsed (rhbz#2558488)
python-joserfc-1.8.0-1.fc46
FEDORA-2026-6527dc724a
Packages in this update:
- python-joserfc-1.8.0-1.fc46
Automatic update for python-joserfc-1.8.0-1.fc46.
Changelog * Thu Nov 5 2026 Chih-Tao Lee <chihlee@redhat.com> - 1.8.0-1 - Update to 1.8.0 (rhbz#2567025)sngrep-1.9.0-4.fc43
FEDORA-2026-f194aee07b
Packages in this update:
- sngrep-1.9.0-4.fc43
Backport fixes for two memory-safety issues reported upstream (irontec/sngrep#589):
- CVE-2026-121943: off-by-one length guard in the SIP parser accepts a 10240-byte payload that fills the stack buffer with no NUL terminator, so regexec()/strdup() read past its end (OOB read).
- CVE-2026-121944: an NFLOG TLV with length < 4 never advances the parse offset, making the capture thread spin forever (DoS).
Submitted upstream as irontec/sngrep#591 and #592.