1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)
Backport fixes for CVE-2026-{88047-88054}
Backport fixes for CVE-2026-{88047-88054}
Backport fixes for CVE-2026-{88047-88054}
Automatic update for rootlesskit-3.2.0-1.fc46.
Changelog * Sun Sep 20 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 3.2.0-1 - Update to release v3.2.0 - Resolves: rhbz#2530874 - Resolves CVE-2026-56855: rhbz#2530631 - Resolves CVE-2026-78662: rhbz#2530678 - Upstream enhancements and fixesUpdates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509, and adds tmpfiles configs for image mode
Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval.
deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itself (localised) before loading, rather than relying on YAML.pm's ambient defaults, and the minimum YAML is raised to 1.30.
Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval.
deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itself (localised) before loading, rather than relying on YAML.pm's ambient defaults, and the minimum YAML is raised to 1.30.
Catalyst::Plugin::Static::Simple for Perl sets the Cache‑Control header to "public" for every static asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and later serve content that was intended to be private, thereby exposing sensitive data to unintended recipients.
In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the Expires header to be set to 0.
Catalyst::Plugin::Static::Simple for Perl sets the Cache‑Control header to "public" for every static asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and later serve content that was intended to be private, thereby exposing sensitive data to unintended recipients.
In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the Expires header to be set to 0.
Catalyst::Plugin::Static::Simple for Perl sets the Cache‑Control header to "public" for every static asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and later serve content that was intended to be private, thereby exposing sensitive data to unintended recipients.
In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the Expires header to be set to 0.
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. In this package, a max_counter attribute has been added to Repeatable elements that caps the client-supplied repeat count from the query string. Default is 100, inherited from a new form-level repeatable_max_counter attribute.
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. In this package, a max_counter attribute has been added to Repeatable elements that caps the client-supplied repeat count from the query string. Default is 100, inherited from a new form-level repeatable_max_counter attribute.
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. In this package, a max_counter attribute has been added to Repeatable elements that caps the client-supplied repeat count from the query string. Default is 100, inherited from a new form-level repeatable_max_counter attribute.
Fix CVE-2026-91837
Updated to 1.20.26 release Includes fixes for CVE-2026-75131 & CVE-2026-93337
Fix CVE-2026-91837