Fedora Security Advisories

• mongo-c-driver-2.5.7-1.el10_3

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645
• Fix container client metadata.

• mongo-c-driver-2.5.7-1.el10_4

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645
• Fix container client metadata.

• mongo-c-driver-2.5.7-1.fc45

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645
• Fix container client metadata.

• libmongocrypt-1.21.1-1.fc45

Fixed

• Validate inputs before interpolating them into a KMS HTTP request. CVE-2026-114655

• libmongocrypt-1.21.1-1.el10_3

Fixed

• Validate inputs before interpolating them into a KMS HTTP request. CVE-2026-114655

• libmongocrypt-1.21.1-1.el10_4

Fixed

• Validate inputs before interpolating them into a KMS HTTP request. CVE-2026-114655

• rust-redlib-0.35.1-12.fc43

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• rust-afterburn-5.11.0-2.fc43

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• rust-qemu-rdp-0.1.1-5.fc43

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• rust-redlib-0.35.1-12.fc44

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• rust-app-store-connect-0.5.0-8.fc43

Rebuilt with the latest Rust dependencies, addressing at least RUSTSEC-2026-0190.

• rust-afterburn-5.11.0-2.fc44

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• roundcubemail-1.6.20-1.el10_2

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.6.20-1.el10_3

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.6.20-1.fc43

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.6.20-1.el10_4

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.7.5-1.fc45

• Installer: Add possibility to detsroy the installer session/cookie
• Enigma: Fix db_sync() never restoring keyring files (#10343)
• Markasjunk: Skip messages whose %s/%h values start with '-' (#10344)
• Password: Replace SQL query placeholders in a single pass (#10345)
• Fix exit code of the healthcheck.sh script (#10337)
• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.7.5-1.fc44

• Installer: Add possibility to detsroy the installer session/cookie
• Enigma: Fix db_sync() never restoring keyring files (#10343)
• Markasjunk: Skip messages whose %s/%h values start with '-' (#10344)
• Password: Replace SQL query placeholders in a single pass (#10345)
• Fix exit code of the healthcheck.sh script (#10337)
• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• libsoup3-3.6.6-11.fc44

Fixes a few CVEs:

• CVE-2026-102560
• CVE-2026-102559
• CVE-2026-102558
• CVE-2026-102555
• CVE-2026-102556
• CVE-2026-102557
• CVE-2026-85197
• CVE-2026-103399
• CVE-2026-85534
• CVE-2026-3633
• CVE-2026-3099

• libsoup3-3.6.6-6.fc43

Fixes a few CVEs:

• CVE-2026-102560
• CVE-2026-102559
• CVE-2026-102558
• CVE-2026-102555
• CVE-2026-102556
• CVE-2026-102557
• CVE-2026-85197
• CVE-2026-103399
• CVE-2026-85534
• CVE-2026-3633
• CVE-2026-3099