Aggregator

USN-8955-1: nginx vulnerabilities

Ubuntu Security Advisories
1 day 9 hours ago
It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93479) It was discovered that nginx incorrectly handled HTTP/3 requests when proxy_request_buffering was enabled. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to inject data into proxied requests. (CVE-2026-95101) It was discovered that nginx incorrectly handled asynchronous file I/O in certain configurations with Server Side Includes pages. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-97205) It was discovered that nginx incorrectly handled SSL session ticket keys when configured with a shared session cache but without explicit ticket key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. A remote attacker could possibly use this issue to forge client SSL sessions and bypass client certificate verification. (CVE-2026-97629)

unbound-1.26.2-1.fc43

Fedora Security Advisories
1 day 10 hours ago
FEDORA-2026-ab4f7ff50a Packages in this update:
  • unbound-1.26.2-1.fc43
Update description: Update to 1.26.2 (rhbz#2558169)

Security fixes from the upstream changelog:

  • Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
  • Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
  • Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
  • Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen (Tsinghua University) for the report.
  • Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

selenium-manager-4.45.0-3.fc45

Fedora Security Advisories
1 day 10 hours ago
FEDORA-2026-ccd3011907 Packages in this update:
  • selenium-manager-4.45.0-3.fc45
Update description:

Rebuilt with latest rustls/rustls-webpki

  • rustls 0.23.46 addresses RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349
  • rustls-webpki 0.103.16 addresses RUSTSEC-2026-0382

unbound-1.26.2-1.fc44

Fedora Security Advisories
1 day 10 hours ago
FEDORA-2026-9142230324 Packages in this update:
  • unbound-1.26.2-1.fc44
Update description: Update to 1.26.2 (rhbz#2558169)

Security fixes from the upstream changelog:

  • Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
  • Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
  • Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
  • Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen (Tsinghua University) for the report.
  • Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

unbound-1.26.2-2.fc45

Fedora Security Advisories
1 day 11 hours ago
FEDORA-2026-7b16c1d7fc Packages in this update:
  • unbound-1.26.2-2.fc45
Update description: Update to 1.26.2 (rhbz#2558169)

Security fixes from the upstream changelog:

  • Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
  • Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
  • Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
  • Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen (Tsinghua University) for the report.
  • Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

python3.9-3.9.25-15.fc46

Fedora Security Advisories
1 day 13 hours ago
FEDORA-2026-2d80410324 Packages in this update:
  • python3.9-3.9.25-15.fc46
Update description:

Automatic update for python3.9-3.9.25-15.fc46.

Changelog * Wed Sep 23 2026 Miro Hrončok <mhroncok@redhat.com> - 3.9.25-15 - Security fix for CVE-2026-11940 * Wed Sep 23 2026 Lukáš Zachar <lzachar@redhat.com> - 3.9.25-14 - Security fix for CVE-2026-15308 Resolves: rhbz#2498693

uv-0.10.2-14.el10_2

Fedora Security Advisories
1 day 13 hours ago
FEDORA-EPEL-2026-93806300a6 Packages in this update:
  • uv-0.10.2-14.el10_2
Update description:

The uv package has been rebuilt with updated rustls and webpki dependencies, fixing RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. This includes fixes for the eMudhra intermediate CA compromise. Futhermore, we have backported the latest managed CPython builds for 3.11 and newer from uv 0.13.5; these builds distrust the eMudhra certificates. For more details and caveats, read the 0.13.5 changelogs. Finally, the system-wide configuration file (uv.toml) now sets system-certs = true, which means that, by default, the system-wide trust store is used instead of the root certificates bundled with uv. This better integrates with system-wide trust settings, and uv users can benefit from prompt security updates to the system-wide CA list.