Backport updated Python distributions from Hatch 1.18.2
The latest managed CPython interpreters for Python 3.11 and later should now distrust the compromised eMudhra/emSign intermediate CA certificates, as described in the release notes for uv 0.13.5. Both hatch and uv use python-build-standalone for their managed Python interpreters.
Update to 3.3.4
Update to 3.3.4
Update to 3.3.4
Automatic update for goose-1.45.0-2.fc46.
Changelog * Tue Oct 27 2026 thepetk <thepetk@gmail.com> - 1.45.0-2 - Backport for CVE rhbz#2558803Update to version 0.18.2.
The latest managed CPython interpreters for Python 3.11 and later should now distrust the compromised eMudhra/emSign intermediate CA certificates, as described in the release notes for uv 0.13.5. Both hatch and uv use python-build-standalone for their managed Python interpreters.
Update to version 0.18.2.
The latest managed CPython interpreters for Python 3.11 and later should now distrust the compromised eMudhra/emSign intermediate CA certificates, as described in the release notes for uv 0.13.5. Both hatch and uv use python-build-standalone for their managed Python interpreters.
Fix CVE-2026-89407 CVE-2026-89425 CVE-2026-68497 CVE-2026-83557 CVE-2026-19032 CVE-2026-91777 across aligned packages updated to version 2.21.8
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.
Starman 0.4019 fixes several CVEs: Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Reject Transfer-Encoding other than "chunked" (400/501) and close the connection after a request with both Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560
Starman 0.4019 fixes several CVEs: Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Reject Transfer-Encoding other than "chunked" (400/501) and close the connection after a request with both Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560
Starman 0.4019 fixes several CVEs: Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Reject Transfer-Encoding other than "chunked" (400/501) and close the connection after a request with both Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. Version 0.10 uses substrings, not regexes to prevent this from happening.
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. Version 0.10 uses substrings, not regexes to prevent this from happening.
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. Version 0.10 uses substrings, not regexes to prevent this from happening.
Backport fix for CVE-2026-112393.
Backport fix for CVE-2026-112892.
Backport fix for CVE-2026-112393.