Fedora Security Advisories

• libmodsecurity-3.0.17-1.fc44
• nginx-mod-modsecurity-1.0.4-18.fc44

Update to latest libmodsecurity to address several CVEs: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/

• libmodsecurity-3.0.17-1.fc45
• nginx-mod-modsecurity-1.0.4-18.fc45

Update to latest libmodsecurity to address several CVEs: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/

• perl-DBI-1.655-1.fc44

1.655 - Fix for C89; Ignore invalid handles consistently

1.654 bump

Fix CVE-2026-88815 (DBI::sql_type_cast on IV/NV) Fix CVE-2026-88816 (FetchHashKeyName on IV/NV)

• perl-DBI-1.655-1.fc43

1.655 - Fix for C89; Ignore invalid handles consistently

1.654 bump

Fix CVE-2026-88815 (DBI::sql_type_cast on IV/NV) Fix CVE-2026-88816 (FetchHashKeyName on IV/NV)

• perl-DBI-1.655-1.fc45

1.655 - Fix for C89; Ignore invalid handles consistently

1.654 bump

Fix CVE-2026-88815 (DBI::sql_type_cast on IV/NV) Fix CVE-2026-88816 (FetchHashKeyName on IV/NV)

• GitPython-3.2.0-1.fc43

Update to 3.2.0

Fixes GHSA-gq48-pqfc-9p58, GHSA-23mf-xhv8-69c2, GHSA-f9j4-qggq-h239, GHSA-w8jc-g24h-crhw, GHSA-m64x-33q8-m5h7, and GHSA-fx3j-rwgx-fr94.

• openssl3-3.5.9-1.fc45

Rebase to OpenSSL 3.5.9

• qdl-2.8-5.fc45

EPEL9 fixes

• GitPython-3.2.0-1.fc44

Update to 3.2.0

Fixes GHSA-gq48-pqfc-9p58, GHSA-23mf-xhv8-69c2, GHSA-f9j4-qggq-h239, GHSA-w8jc-g24h-crhw, GHSA-m64x-33q8-m5h7, and GHSA-fx3j-rwgx-fr94.

• GitPython-3.2.0-1.fc45

Update to 3.2.0

Fixes GHSA-gq48-pqfc-9p58, GHSA-23mf-xhv8-69c2, GHSA-f9j4-qggq-h239, GHSA-w8jc-g24h-crhw, GHSA-m64x-33q8-m5h7, and GHSA-fx3j-rwgx-fr94.

• openssl-3.5.9-1.fc44

Rebase to OpenSSL 3.5.9

• openssl-3.5.9-1.fc43

Rebase to OpenSSL 3.5.9

• mstflint-4.37.0_1.1-2.fc45

Update to upstream release v4.37.0-1.1.

Fix licensing issues.

For upstream release information, see: https://github.com/Mellanox/mstflint/releases

• libX11-1.8.13-3.fc45

xkb: Check the keysym range in _XkbReadKeyActions (CVE-2026-88806)

• curl-8.21.0-6.fc45

• fix HTTP/2 server push UAF (CVE-2026-18924)
• fix Negotiate ambient user conn reuse (CVE-2026-19931)
• remove test1701 - HTTP/2 Upgrade in a HTTP/1.1 POST request is no longer supported

• flatpak-1.18.4-1.fc44

Update to 1.18.4

• barman-3.20.1-1.el10_4

Update to 3.20.1.

• barman-3.20.1-1.fc43

Update to 3.20.1.

• barman-3.20.1-1.fc44

Update to 3.20.1.

• barman-3.20.1-1.el10_3

Update to 3.20.1.