Aggregator

It was discovered that HTML-Parser incorrectly handled entity references when the input string was identical to an entity value in the lookup table. An attacker could possibly use this issue to obtain sensitive information.

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40333) It was discovered that libgphoto2 did not properly null-terminate buffers when parsing Canon folder entries. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40334) It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing device property values. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40335) It was discovered that libgphoto2 had a memory leak when parsing Sony device property descriptors. An attacker with physical access could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-40336) It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing Sony device property enumeration data. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40338) It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing Sony device property form flags. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40339) It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing object information. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40340) It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS focus information. An attacker with physical access could possibly use this issue to cause libgphoto2 to crash, resulting in a denial of service. (CVE-2026-40341)

It was discovered that Kerberos had an integer underflow vulnerability in the berval2tl_data() function. An attacker could possibly use this issue to cause Kerberos to crash, resulting in a denial of service. (CVE-2026-11850) It was discovered that Kerberos had vulnerabilities in its NegoEx mechanism parsing. A remote attacker could possibly use these issues to cause Kerberos to crash, resulting in a denial of service. (CVE-2026-40355, CVE-2026-40356)

It was discovered that GStreamer Good Plugins incorrectly handled certain Matroska files. An attacker could possibly use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-39043) It was discovered that GStreamer Good Plugins incorrectly handled certain WAV files. An attacker could possibly use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-39044) It was discovered that GStreamer Good Plugins incorrectly handled certain WavPack audio files. An attacker could use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-53705)

It was discovered that GIFLIB incorrectly handled certain GIF image files. If a user or automated system were tricked into opening a specially crafted GIF file, a remote attacker could use this issue to cause GIFLIB to crash, resulting in a denial of service, or possibly execute arbitrary code.

FEDORA-EPEL-2026-c4fcc3f6fd Packages in this update:

• ImageMagick-6.9.13.52-2.el8

Update description:

Add upstream patch to revert the unexpected soname change

Update to upstream 6.9.13-52

FEDORA-2026-0b2cbe3d44 Packages in this update:

• nodejs22-22.23.1-2.fc44

Update description:

Update to version 22.23.1

FEDORA-2026-1b33b87fff Packages in this update:

• firefox-153.0-2.fc44

Update description:

• New upstream release (153.0)

• Updated to latest upstream (153.0)

FEDORA-2026-b51a41732d Packages in this update:

• firefox-153.0-2.fc43

Update description:

• New upstream release (153.0)

• Updated to latest upstream (153.0)

FEDORA-2026-3d18a65cc4 Packages in this update:

• valkey-9.0.5-1.fc44

Update description: Valkey 9.0.5 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

• CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
• CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

Bug Fixes

• Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed by @enjoy-binbin (#2872)
• Fix a use-after-free crash when creating slot import jobs during manual slot migrations by @twooster (#3283)
• Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed by @sarthakaggarwal97 (#3342)
• Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type by @madolson (#3516)
• Fix a crash from a race between IO threads and asynchronous client freeing by @deepakrn (#3458)
• Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE by @enjoy-binbin (#3498)
• Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted by @smkher (#3591)
• Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active by @eifrah-aws (#3578)
• Fix a NULL pointer crash in TLS pending-data handling by @zuiderkwast (#3641)
• Fix a server crash when multiple RDMA clients disconnect at the same time by @quanyeyang (#3448)
• Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately by @ranshid (#3800)
• Fix a use-after-free when a module unregisters the first registered cluster message receiver for a message type by @eifrah-aws (#3846)
• Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count by @cjx-zar (#4047)
• Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY by @enjoy-binbin (#4024)
• Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected by @lukepalmer (#4068)
• Fix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly by @dvkashapov (#3306)
• Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue by @jjuleslasarte (#3878)
• Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket by @ranshid (#3950)
• Fix a file descriptor leak when a blocking connection attempt, such as MIGRATE to an unreachable host, times out by @madolson (#3541)
• Fix a potential crash from a dangling slot migration job reference when the migration client is reset by @murphyjacob4 (#3554)
• Remove cached EVAL scripts when their scripting engine is unregistered, preventing dangling engine references by @eifrah-aws (#3503)
• Fix a memory leak in GEOSEARCH BYPOLYGON when argument parsing fails, such as on an invalid COUNT by @bandalgomsu (#3568)
• Fix a crash when a slot migration target node is removed from the cluster before the migration connects by @chenshi5012 (#3596)
• Fix a crash when the module GetLRU/SetLRU/GetLFU/SetLFU APIs are called with a NULL key by @yaronsananes (#3610)
• Fix an assertion failure in hash field expiration commands when a module blocks the client in a keyspace notification by @enjoy-binbin (#3743)
• Fix a cluster UPDATE log message reading shard IDs past their fixed-length buffer by @enjoy-binbin (#3942)
• Fix undefined behavior in the failover delay calculation when cluster-node-timeout is set below 30 milliseconds by @enjoy-binbin (#3941)
• Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
• Reject NAN scores in listpack- and ziplist-encoded sorted sets on RDB/RESTORE load, preventing a later crash on skiplist conversion by @madolson (#3921)
• Fix a startup crash on 32-bit systems with 64-bit time_t, such as Alpine 3.23, caused by time value formatting mismatches by @chenshi5012 (#3787)
• Fix corrupted client replies when IO threads are enabled, caused by a race between in-flight writes and reply buffer reuse by @nanyan0312 (#4060)
• COMMAND INFO in RESP3 now returns the subcommands field as an Array instead of a Set for commands without subcommands by @rickrams (#3939)
• The dual-channel replication RDB connection now announces the configured replica-announce-ip, avoiding stale replica entries behind NAT by @jdheyburn (#2846)
• Prevent replicas from processing stale cluster packets and incorrectly promoting themselves to an empty primary within a shard by @zhijun42 (#2811)
• Send the replica version on the dual-channel RDB connection so full syncs of data like hash field TTLs no longer fail by @hpatro (#4105)
• Fix slot migration failure handling running twice on ownership changes and an out-of-order error reply in the internal SYNCSLOTS FINISH command by @chx9 (#3723)
• Allow slot-migration-max-failover-repl-bytes to be set to -1 to disable the limit, as documented by @enjoy-binbin (#3443)
• Fix CONFIG REWRITE producing negative values for memory configs such as maxmemory when set to very large values by @enjoy-binbin (#3440)
• Reject SENTINEL SET values containing control characters and safely quote Sentinel config values to prevent config file injection by @eifrah-aws (#3847)
• Reject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to prevent nodes.conf corruption or injection by @eifrah-aws (#3848)
• Fix changes to lua-enable-insecure-api via CONFIG SET not taking effect when the option was set at startup by @enjoy-binbin (#4182)
• Fix incorrect memory overhead reported for watched keys in client memory usage tracking by @enjoy-binbin (#3359)
• Replica logs now report 'Connection reset by peer' instead of the misleading 'Success' when the primary closes the connection by @abmathur-ie (#3580)
• Redact key names and user data from more log messages when hide-user-data-from-log is enabled by @zackcam (#3872)
• Fix INFO replication reporting negative sync transfer sizes when the RDB exceeds 2GB during disk-based sync by @chx9 (#3811)
• Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)
• valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No such node ID' by @yang-z-o (#3209)
• Fix valkey-cli crashing after --eval script execution on jemalloc/tcmalloc builds by @bandalgomsu (#3281)
• valkey-cli --cluster fix now spreads uncovered slots randomly across primaries instead of assigning them all to one node by @abmathur-ie (#3586)

FEDORA-2026-9de44775c7 Packages in this update:

• valkey-8.1.9-1.fc43

Update description: Valkey 8.1.9 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

• CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
• CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

Bug Fixes

• Fix clients being left on the wrong database after module keyspace notifications from commands like MOVE and COPY by @enjoy-binbin (#4024)
• Fix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64 by @jjuleslasarte (#3878)
• Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
• Reject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted RESTORE payloads by @madolson (#3921)
• Fix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit (e.g. Alpine time64) by @chenshi5012 (#3787)
• Fix COMMAND INFO in RESP3 to reply with an empty Array instead of a Set for commands without subcommands by @rickrams (#3939)
• Reject invalid characters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf corruption and injection by @eifrah-aws (#3848)
• Fix lua-enable-insecure-api having no effect when enabled at startup via config file or command line by @enjoy-binbin (#3548)
• Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)

FEDORA-EPEL-2026-f5b9d860d8 Packages in this update:

• valkey-8.0.10-1.el8

Update description: Valkey 8.0.10 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

• CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to crash the server using CLIENT KILL (#4234)
• CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers. Reported by @z0v3r1n and @lifip. (#4073)

Bug Fixes

• Strictly validate CRLF line endings when parsing the RESP protocol, rejecting malformed requests as protocol errors by @enjoy-binbin (#2872)
• Fix memory leak in ZDIFF/ZDIFFSTORE when the result set becomes empty before all input sets are processed by @sarthakaggarwal97 (#3342)
• Fix crash caused by a race between asynchronous client freeing and IO threads reading from the closing client by @deepakrn (#3458)
• Fix double free when loading corrupt stream RDB data containing duplicate consumer PEL entries by @enjoy-binbin (#3498)
• Fix stream corruption and crash when XTRIM marks the last entry of a listpack node as deleted by @smkher (#3591)
• Fix potential crash in TLS pending-data handling when the connection has no SSL object by @zuiderkwast (#3641)
• Fix use-after-free when ACL LOAD removes a user whose authenticated client's free is deferred by @ranshid (#3800)
• Fix use-after-free when a module unregisters the first-registered cluster message receiver for a message type by @eifrah-aws (#3846)
• Fix crash when loading functions after FUNCTION FLUSH ASYNC and make FUNCTION FLUSH actually release Lua VM memory by @enjoy-binbin (#1826)
• Fix file descriptor leak when a blocking connect times out, such as MIGRATE to an unreachable host by @madolson (#3541)
• Fix crash in module LRU/LFU API functions (GetLRU, SetLRU, GetLFU, SetLFU) when passed a NULL key by @yaronsananes (#3610)
• TLS synchronous I/O no longer leaves a blocking socket in non-blocking mode, preventing unexpected short reads by @xbasel (#1298)
• Fix crash when CLUSTER SLOTS is called without a real client connection, such as from a module timer callback by @bandalgomsu (#2915)
• Fix assertion crash in the IO thread job queue on ARM/aarch64 caused by memory store reordering by @jjuleslasarte (#3878)
• Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
• Reject NAN scores in listpack and ziplist encoded sorted sets on RDB load, preventing a later crash on skiplist conversion by @madolson (#3921)
• Fix crash on 32-bit systems where time_t is 64-bit (e.g. Alpine with time64) when generating INFO output by @chenshi5012 (#3787)
• COMMAND INFO in RESP3 now returns an empty Array instead of a Set for the subcommands field of commands without subcommands by @rickrams (#3939)
• Manual failover votes are no longer restricted by two times the node timeout, preventing manual failover timeouts by @enjoy-binbin (#1305)
• Automatic failover votes are no longer restricted by two times the node timeout, matching the manual failover change by @enjoy-binbin (#1356)
• SENTINEL SET now rejects values containing control characters and config rewrite escapes them, preventing config injection by @eifrah-aws (#3847)
• Reject control characters and delimiters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf injection by @eifrah-aws (#3848)
• Fix lua-enable-insecure-api yes not taking effect when set at startup via config file or command line by @enjoy-binbin (#3548)
• Log 'Connection reset by peer' instead of the misleading 'Success' when the connection to the primary closes during sync by @abmathur-ie (#3580)
• Redact key names and user data from additional server log messages when hide-user-data-from-log is enabled by @zackcam (#3872)
• Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @pkhartsk (#3843)
• valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No such node ID' by @yang-z-o (#3209)
• Fix valkey-cli --cluster assigning all uncovered slots to the same primary instead of distributing them randomly by @abmathur-ie (#3586)

FEDORA-2026-da44c3870f Packages in this update:

• dotnet8.0-8.0.129-2.fc43

Update description:

Update to .NET SDK 8.0.129 and Runtime 8.0.29

Fixes: CVE-2026-47300,CVE-2026-47302,CVE-2026-47303,CVE-2026-47304,CVE-2026-50524,CVE-2026-50525,CVE-2026-50526,CVE-2026-50527,CVE-2026-50528,CVE-2026-50646,CVE-2026-50648,CVE-2026-50649,CVE-2026-50650,CVE-2026-50651,CVE-2026-50659,CVE-2026-56158,CVE-2026-57108

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.29/8.0.129.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.29/8.0.29.md

USN-8580-1 fixed vulnerabilities in AccountsService. This update provides the corresponding fixes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that the Ubuntu-specific SetLanguage patch to AccountsService incorrectly handled dropping privileges. A local attacker could use this issue to execute arbitrary commands as an administrator. (CVE-2026-61897) It was discovered that the Ubuntu-specific SetLanguage helpers for AccountsService incorrectly handled parsing configuration files. A local attacker could use this issue to execute arbitrary commands. (CVE-2026-61898)

FEDORA-2026-9aef53fa96 Packages in this update:

• dotnet8.0-8.0.129-2.fc44

Update description:

Update to .NET SDK 8.0.129 and Runtime 8.0.29

Fixes: CVE-2026-47300,CVE-2026-47302,CVE-2026-47303,CVE-2026-47304,CVE-2026-50524,CVE-2026-50525,CVE-2026-50526,CVE-2026-50527,CVE-2026-50528,CVE-2026-50646,CVE-2026-50648,CVE-2026-50649,CVE-2026-50650,CVE-2026-50651,CVE-2026-50659,CVE-2026-56158,CVE-2026-57108

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.29/8.0.129.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.29/8.0.29.md

FEDORA-EPEL-2026-58bc6905cb Packages in this update:

• proftpd-1.3.9c-3.el10_3

Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.

FEDORA-EPEL-2026-8258136556 Packages in this update:

• proftpd-1.3.9c-3.el10_2

Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.