Aggregator

perl-Net-DNS-1.56-1.fc43

Fedora Security Advisories
4 days 15 hours ago
FEDORA-2026-1237afef8a Packages in this update:
  • perl-Net-DNS-1.56-1.fc43
Update description:

Update to Net-DNS 1.56 (from 1.53).

Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR (rt.cpan #179945) - Denial of Service via long DNS compression chains (rt.cpan #179946) - Resolver/UNIX.pm no longer relies on shell for uname (rt.cpan #176900)

Bug fixes: - Fix TCP read loop treating 1-byte recv() of "0" (0x30) as EOF, which corrupted AXFRs (rt.cpan #177003) - Fix unhelpful TAINT error (rt.cpan #178183) - Fix unreachable-code warning under Apache/mod_perl (rt.cpan #179692/#176900) - Documentation fix for Net::DNS::RR::RRSIG::verify() (rt.cpan #180088).

Other: - Resync with IANA DNS parameters and DNSSEC algorithm registries - New DNSKEY adt() accessor; DELEG parser backported to SVCB

perl-Net-DNS-1.56-1.fc44

Fedora Security Advisories
4 days 15 hours ago
FEDORA-2026-a0607111e6 Packages in this update:
  • perl-Net-DNS-1.56-1.fc44
Update description:

Update to Net-DNS 1.56 (from 1.53).

Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR (rt.cpan #179945) - Denial of Service via long DNS compression chains (rt.cpan #179946) - Resolver/UNIX.pm no longer relies on shell for uname (rt.cpan #176900)

Bug fixes: - Fix TCP read loop treating 1-byte recv() of "0" (0x30) as EOF, which corrupted AXFRs (rt.cpan #177003) - Fix unhelpful TAINT error (rt.cpan #178183) - Fix unreachable-code warning under Apache/mod_perl (rt.cpan #179692/#176900) - Documentation fix for Net::DNS::RR::RRSIG::verify() (rt.cpan #180088).

Other: - Resync with IANA DNS parameters and DNSSEC algorithm registries - New DNSKEY adt() accessor; DELEG parser backported to SVCB

mongo-c-driver-2.5.1-1.fc45

Fedora Security Advisories
4 days 16 hours ago
FEDORA-2026-fec1bd0e65 Packages in this update:
  • mongo-c-driver-2.5.1-1.fc45
Update description: libmongoc 2.5.1

Fixes

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)

mongo-c-driver-2.5.1-1.el10_3

Fedora Security Advisories
4 days 16 hours ago
FEDORA-EPEL-2026-4c8991a29d Packages in this update:
  • mongo-c-driver-2.5.1-1.el10_3
Update description: libmongoc 2.5.1

Fixes

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)
libbson 2.5.0

No changes since 2.4.0. Version incremented to match the libmongoc version.

libmongoc 2.5.0

New Features

  • Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.
  • Add collection bulk write getters.

mongo-c-driver-2.5.1-1.el10_4

Fedora Security Advisories
4 days 16 hours ago
FEDORA-EPEL-2026-92974d6ab3 Packages in this update:
  • mongo-c-driver-2.5.1-1.el10_4
Update description: libmongoc 2.5.1

Fixes

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)
libbson 2.5.0

No changes since 2.4.0. Version incremented to match the libmongoc version.

libmongoc 2.5.0

New Features

  • Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.
  • Add collection bulk write getters.

libmongocrypt-1.20.3-1.el10_3

Fedora Security Advisories
4 days 16 hours ago
FEDORA-EPEL-2026-2210b463dc Packages in this update:
  • libmongocrypt-1.20.3-1.el10_3
Update description: Version 1.20.3

Fixed

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

libmongocrypt-1.20.3-1.fc45

Fedora Security Advisories
4 days 16 hours ago
FEDORA-2026-276ef95c83 Packages in this update:
  • libmongocrypt-1.20.3-1.fc45
Update description: Version 1.20.3

Fixed

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

libmongocrypt-1.20.3-1.el10_4

Fedora Security Advisories
4 days 16 hours ago
FEDORA-EPEL-2026-eac81454b1 Packages in this update:
  • libmongocrypt-1.20.3-1.el10_4
Update description: Version 1.20.3

Fixed

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

valkey-8.0.11-1.el8

Fedora Security Advisories
4 days 17 hours ago
FEDORA-EPEL-2026-d90913b1f1 Packages in this update:
  • valkey-8.0.11-1.el8
Update description: Valkey 8.0.11 - Released Mon 31 August 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
Bug Fixes
  • Fix a double-free crash when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
  • Fix AOF truncation after a partially persisted MULTI/EXEC block so writes made after recovery are not lost on a later restart by @chzhoo (#4342)
  • Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands let users write keys outside their permitted patterns by @tjade273 (#3971)
  • Fix a use-after-free crash when a cluster message for a module-registered type arrives after the module is unloaded by @enjoy-binbin (#4360)
  • Fix out-of-bounds access on cluster module messages of type 255, which is now a valid message type by @enjoy-binbin (#4410)
  • Fix silent data loss where ACL checks were wrongly applied to commands replayed from the AOF file by @lukepalmer (#3984)
  • Fix a client memory accounting leak that inflated the mem_clients_normal INFO field on replicas by @enjoy-binbin (#4395)
  • Always deep-validate listpack payloads on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload is deprecated and now a no-op by @jjuleslasarte (#3721)
  • Fix module VM_Yield timing so repeated yields honor busy-reply-threshold instead of the server hz interval by @PingXie (#2131)
  • Fix a stack overflow crash when a large TLS write is retried after an OpenSSL write error by @murphyjacob4 (#4307)
  • Fix a crash caused by forged cluster bus PUBLISH or MODULE packets carrying oversized payload length fields by @tjade273 (#3972)
  • Reject crafted stream payloads in RDB load and RESTORE whose length or field-count metadata is inconsistent, preventing later server panics by @madolson (#3922)
  • Fix a cluster link disconnect loop after network failures that caused pub/sub messages between nodes to be lost by @dvkashapov (#2817)
  • Fix a use-after-free crash when a client blocked on a key is freed while other clients blocked on the same key are being served by @quanyeyang (#4212)
  • Reject crafted stream payloads that misstate live and deleted record counts, preventing data loss on XDEL by @roshkhatri (#4381)
  • Fix incorrect CLUSTER SLOT-STATS ORDERBY ordering when slot statistics differ by more than 2^31 by @jzy1688 (#4459)

valkey-8.1.10-1.fc43

Fedora Security Advisories
4 days 17 hours ago
FEDORA-2026-cda5ad190f Packages in this update:
  • valkey-8.1.10-1.fc43
Update description: Valkey 8.1.10 - Released Mon 31 August 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
Bug Fixes
  • Fix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
  • RESET now clears the CLIENT IMPORT-SOURCE flag so reused pooled connections stop reading logically expired keys by @tjade273 (#3973)
  • Fix AOF recovery of a truncated MULTI/EXEC block that could cause new writes to be lost after a subsequent restart by @chzhoo (#4342)
  • Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands escaped key write permission checks by @tjade273 (#3971)
  • Fix a use-after-free crash when a cluster message of a module-registered type arrives after the module is unloaded by @enjoy-binbin (#4360)
  • Fix out-of-bounds access when registering or receiving cluster module messages of type 255, which is now fully supported by @enjoy-binbin (#4410)
  • Skip ACL permission checks when replaying the AOF, preventing silent data loss when users are restricted or disabled by @lukepalmer (#3984)
  • Fix a client memory accounting leak that inflated mem_clients_normal on replicas after disconnecting from the primary by @enjoy-binbin (#4395)
  • Always validate listpacks on RDB load and RESTORE to prevent deferred crashes; sanitize-dump-payload and the related ACL flags are now deprecated no-ops by @jjuleslasarte (#3721)
  • Fix a stack overflow crash when retrying large TLS writes after an OpenSSL write error by @murphyjacob4 (#4307)
  • Validate PUBLISH and MODULE cluster bus packet lengths, preventing a crash from forged packets with oversized payload lengths by @tjade273 (#3972)
  • Reject crafted stream RESTORE/RDB payloads with inconsistent lengths or negative field counts that could crash the server by @madolson (#3922)
  • Fix a use-after-free crash when serving multiple clients blocked on the same key if one is freed during processing by @quanyeyang (#4212)
  • Fix CLUSTER SLOT-STATS ORDERBY sorting when slot statistics differ by more than 2^31 by @jzy1688 (#4459)