Aggregator

libmongocrypt-1.20.3-1.el10_3

Fedora Security Advisories
3 days 19 hours ago
FEDORA-EPEL-2026-2210b463dc Packages in this update:
  • libmongocrypt-1.20.3-1.el10_3
Update description: Version 1.20.3

Fixed

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

libmongocrypt-1.20.3-1.fc45

Fedora Security Advisories
3 days 19 hours ago
FEDORA-2026-276ef95c83 Packages in this update:
  • libmongocrypt-1.20.3-1.fc45
Update description: Version 1.20.3

Fixed

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

libmongocrypt-1.20.3-1.el10_4

Fedora Security Advisories
3 days 19 hours ago
FEDORA-EPEL-2026-eac81454b1 Packages in this update:
  • libmongocrypt-1.20.3-1.el10_4
Update description: Version 1.20.3

Fixed

  • Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

valkey-8.0.11-1.el8

Fedora Security Advisories
3 days 20 hours ago
FEDORA-EPEL-2026-d90913b1f1 Packages in this update:
  • valkey-8.0.11-1.el8
Update description: Valkey 8.0.11 - Released Mon 31 August 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
Bug Fixes
  • Fix a double-free crash when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
  • Fix AOF truncation after a partially persisted MULTI/EXEC block so writes made after recovery are not lost on a later restart by @chzhoo (#4342)
  • Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands let users write keys outside their permitted patterns by @tjade273 (#3971)
  • Fix a use-after-free crash when a cluster message for a module-registered type arrives after the module is unloaded by @enjoy-binbin (#4360)
  • Fix out-of-bounds access on cluster module messages of type 255, which is now a valid message type by @enjoy-binbin (#4410)
  • Fix silent data loss where ACL checks were wrongly applied to commands replayed from the AOF file by @lukepalmer (#3984)
  • Fix a client memory accounting leak that inflated the mem_clients_normal INFO field on replicas by @enjoy-binbin (#4395)
  • Always deep-validate listpack payloads on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload is deprecated and now a no-op by @jjuleslasarte (#3721)
  • Fix module VM_Yield timing so repeated yields honor busy-reply-threshold instead of the server hz interval by @PingXie (#2131)
  • Fix a stack overflow crash when a large TLS write is retried after an OpenSSL write error by @murphyjacob4 (#4307)
  • Fix a crash caused by forged cluster bus PUBLISH or MODULE packets carrying oversized payload length fields by @tjade273 (#3972)
  • Reject crafted stream payloads in RDB load and RESTORE whose length or field-count metadata is inconsistent, preventing later server panics by @madolson (#3922)
  • Fix a cluster link disconnect loop after network failures that caused pub/sub messages between nodes to be lost by @dvkashapov (#2817)
  • Fix a use-after-free crash when a client blocked on a key is freed while other clients blocked on the same key are being served by @quanyeyang (#4212)
  • Reject crafted stream payloads that misstate live and deleted record counts, preventing data loss on XDEL by @roshkhatri (#4381)
  • Fix incorrect CLUSTER SLOT-STATS ORDERBY ordering when slot statistics differ by more than 2^31 by @jzy1688 (#4459)

valkey-8.1.10-1.fc43

Fedora Security Advisories
3 days 20 hours ago
FEDORA-2026-cda5ad190f Packages in this update:
  • valkey-8.1.10-1.fc43
Update description: Valkey 8.1.10 - Released Mon 31 August 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
Bug Fixes
  • Fix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
  • RESET now clears the CLIENT IMPORT-SOURCE flag so reused pooled connections stop reading logically expired keys by @tjade273 (#3973)
  • Fix AOF recovery of a truncated MULTI/EXEC block that could cause new writes to be lost after a subsequent restart by @chzhoo (#4342)
  • Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands escaped key write permission checks by @tjade273 (#3971)
  • Fix a use-after-free crash when a cluster message of a module-registered type arrives after the module is unloaded by @enjoy-binbin (#4360)
  • Fix out-of-bounds access when registering or receiving cluster module messages of type 255, which is now fully supported by @enjoy-binbin (#4410)
  • Skip ACL permission checks when replaying the AOF, preventing silent data loss when users are restricted or disabled by @lukepalmer (#3984)
  • Fix a client memory accounting leak that inflated mem_clients_normal on replicas after disconnecting from the primary by @enjoy-binbin (#4395)
  • Always validate listpacks on RDB load and RESTORE to prevent deferred crashes; sanitize-dump-payload and the related ACL flags are now deprecated no-ops by @jjuleslasarte (#3721)
  • Fix a stack overflow crash when retrying large TLS writes after an OpenSSL write error by @murphyjacob4 (#4307)
  • Validate PUBLISH and MODULE cluster bus packet lengths, preventing a crash from forged packets with oversized payload lengths by @tjade273 (#3972)
  • Reject crafted stream RESTORE/RDB payloads with inconsistent lengths or negative field counts that could crash the server by @madolson (#3922)
  • Fix a use-after-free crash when serving multiple clients blocked on the same key if one is freed during processing by @quanyeyang (#4212)
  • Fix CLUSTER SLOT-STATS ORDERBY sorting when slot statistics differ by more than 2^31 by @jzy1688 (#4459)

valkey-9.0.6-1.fc44

Fedora Security Advisories
3 days 20 hours ago
FEDORA-2026-f6cb88e85a Packages in this update:
  • valkey-9.0.6-1.fc44
Update description: Valkey 9.0.6 - Released Tue 01 September 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
Bug Fixes
  • Fix crashes, assertion failures, and hangs when using RDMA together with IO threads by @quanyeyang (#3335)
  • Fix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
  • Fix torn RESP3 push frames when a client publishes a large message to a channel it is also subscribed to by @quanyeyang (#4253)
  • RESET now clears CLIENT IMPORT-SOURCE state so reused pooled connections regain normal key expiration semantics by @tjade273 (#3973)
  • Truncated AOF files now discard an incomplete MULTI block entirely, preventing loss of later writes after another restart by @chzhoo (#4342)
  • Fix an ACL bypass in GEORADIUS and GEORADIUSBYMEMBER where duplicate STORE options checked only the first destination key by @tjade273 (#3971)
  • Fix a use-after-free crash when a cluster message arrives for a message type registered by an unloaded module by @enjoy-binbin (#4360)
  • Always deep-validate payloads on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload is now a deprecated no-op by @jjuleslasarte (#3721)
  • Fix out-of-bounds memory access when registering or receiving cluster module messages of type 255, which is now a valid type by @enjoy-binbin (#4410)
  • AOF loading no longer applies ACL checks, preventing silent data loss when replaying commands with a disabled default user by @lukepalmer (#3984)
  • Fix a client memory accounting leak that inflated the mem_clients_normal INFO field on replicas after primary disconnects by @enjoy-binbin (#4395)
  • Fix a permanent client hang when a blocking command such as BLPOP is pipelined with a partially received next command by @foobar (#4531)
  • HGETEX now requires write permission on the key, so read-only ACL users can no longer change field TTLs or delete fields by @ranshid (#4576)
  • Compare the full TLS certificate CN when authenticating, so an embedded NUL cannot impersonate a truncated ACL username by @madolson (#4577)
  • Restore read performance with IO threads on TCP/TLS by applying extra read-completion handling only to RDMA connections by @quanyeyang (#4414)
  • Restore write performance with IO threads on TCP/TLS by limiting post-write safety checks to RDMA connections by @quanyeyang (#4452)
  • Fix atomic slot migration protocol errors with IO threads by not offloading export connection writes while snapshotting by @satheeshaGowda (#4104)
  • Reject invalid slot import ranges when loading an RDB, preventing corrupted files from creating bad migration state by @enjoy-binbin (#4229)
  • Reject RDB slot-import records with an invalid job name length, fixing an out-of-bounds read during startup by @quanyeyang (#4210)
  • Fix a crash when COPY ends with a bare DB token during slot migration, and block cross-DB COPY regardless of option order by @madolson (#4301)
  • HPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a syntax error when the FIELDS keyword is missing by @cjx-zar (#4300)
  • Fix a TLS and IO threads race that could leave slot migration export jobs stuck until timeout by @jjuleslasarte (#4320)
  • Fix a server crash when hash field expirations are set near the maximum timestamp, for example via HPEXPIREAT by @ranshid (#4312)
  • Fix a stack overflow crash on TLS connections when retrying a failed write of large replies by @murphyjacob4 (#4307)
  • Validate cluster bus PUBLISH and MODULE packet payload lengths, preventing a remote crash from forged length fields by @tjade273 (#3972)
  • Fix a use-after-free crash when serving blocked clients if handling one client frees another blocked on the same key by @quanyeyang (#4212)
  • Fix a server panic with IO threads when pipelined commands with a wrong number of arguments reached the key prefetcher by @madolson (#4302)
  • Reject crafted stream RESTORE and RDB payloads with inconsistent lengths or negative field counts that could crash the server by @madolson (#3922)
  • Reject stream payloads with mismatched live and deleted entry counts that could make XDEL destroy live entries by @roshkhatri (#4381)
  • Fix CLUSTER SLOT-STATS ORDERBY returning wrong ordering once cumulative slot counters differ by more than 2^31 by @jzy1688 (#4459)
  • Fix atomic slot migration failures with TLS and IO threads by not offloading export connection reads while snapshotting by @satheeshaGowda (#4559)

valkey-9.1.2-1.fc45

Fedora Security Advisories
3 days 20 hours ago
FEDORA-2026-3e6f9d599a Packages in this update:
  • valkey-9.1.2-1.fc45
Update description: Valkey 9.1.2 - Released Mon 31 August 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
  • GHSA-fq2f-crmw-q97r: Fix an unauthenticated use-after-free of the Lua interpreter state, caused by a process-global script debugger command table that cached a raw pointer to a freed interpreter and was never invalidated (#4574)
Bug Fixes
  • Fix a double-free crash when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
  • Fix torn RESP3 push frames when a client publishes to a channel it is also subscribed to, which could desync client libraries by @quanyeyang (#4253)
  • Listpacks are now always validated on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload and its ACL flags become no-ops by @jjuleslasarte (#3721)
  • Fix crashes, hangs, and CPU spinning when the RDMA transport is used together with I/O threads by @quanyeyang (#3611)
  • RESET now clears the CLIENT IMPORT-SOURCE flag, so reused pooled connections return to normal expiration semantics by @tjade273 (#3973)
  • Truncate a partially written MULTI block from the AOF on short read, preventing loss of newer writes after a later restart by @chzhoo (#4342)
  • Fix an ACL bypass where duplicate STORE/STOREDIST options let GEORADIUS write or delete keys outside the user's permitted patterns by @tjade273 (#3971)
  • Fix command log redaction leaking between commands in a MULTI transaction and missing for commands executed from scripts by @madolson (#4323)
  • Fix a use-after-free crash when a module's cluster message type is received after the module is unloaded by @enjoy-binbin (#4360)
  • Fix out-of-bounds access for cluster module message type 255, which is now a valid, dispatchable message type by @enjoy-binbin (#4410)
  • AOF loading no longer performs ACL checks on replayed commands, preventing silent data loss when the default user is disabled by @lukepalmer (#3984)
  • Fix a client memory accounting leak on replicas that inflated the mem_clients_normal INFO field after primary disconnections by @enjoy-binbin (#4395)
  • Fix a permanent client deadlock when a blocking command like BLPOP is followed by a partially delivered pipelined command by @foobar (#4531)
  • HGETEX now requires write permission on the key, closing an ACL gap that let read-only users change field TTLs or delete fields by @ranshid (#4576)
  • Compare the whole TLS certificate CN during authentication, so an embedded NUL can no longer impersonate another ACL user by @madolson (#4577)
  • Fix atomic slot migration failures with I/O threads by not offloading the export job's writes while snapshotting by @satheeshaGowda (#4104)
  • Reject invalid slot import ranges when loading an RDB, so corrupted files can no longer create bad migration jobs by @enjoy-binbin (#4229)
  • Reject RDB slot import records with an invalid job name length, preventing an out-of-bounds read at startup by @quanyeyang (#4210)
  • MOVE and COPY now check ACL access to the current database, so users can no longer exfiltrate keys from an unauthorized DB by @cjx-zar (#4155)
  • Fix a crash on COPY with a trailing DB option during slot migration, and block cross-DB COPY regardless of option order by @madolson (#4301)
  • Fix a server panic when pipelined commands with invalid arity reach the key prefetcher with I/O threads enabled by @madolson (#4302)
  • HPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a syntax error when the FIELDS keyword is missing by @cjx-zar (#4300)
  • Fix a race between TLS I/O-thread writes and reads that could leave slot migration export jobs stuck until timeout by @jjuleslasarte (#4320)
  • Fix a signed overflow that let very large hash field expiration times (e.g. via HPEXPIREAT) crash the server by @ranshid (#4312)
  • Fix a frozen monotonic clock on hosts with unsynchronized TSC that stopped background tasks and key expiration by @quanyeyang (#4346)
  • Fix a stack overflow crash when retrying a failed TLS write with a large reply by @murphyjacob4 (#4307)
  • Fix the --check-system clocksource check to skip hosts using a hardware clock and suggest only actually available clocksources by @quanyeyang (#4272)
  • Fix an assertion failure with I/O threads when a blocked client's pending command was processed again before unblocking by @quanyeyang (#4376)
  • Sentinel no longer loads the built-in Lua scripting engine, removing a spurious warning at startup by @enjoy-binbin (#4327)
  • Validate channel, message, and module payload lengths in cluster bus packets, preventing forged packets from crashing nodes by @tjade273 (#3972)
  • Harden stream validation on RDB load and RESTORE so crafted payloads can no longer crash the server on later commands by @madolson (#3922)
  • Reject stream payloads with mismatched live/deleted record counts, preventing XDEL from destroying unaccounted entries by @roshkhatri (#4381)
  • Skip unnecessary post-read processing with I/O threads on socket and TLS connections, restoring small-payload throughput by @quanyeyang (#4401)
  • Fix a use-after-free crash when serving clients blocked on the same key if one client is freed during processing by @quanyeyang (#4212)
  • Avoid an unneeded client lookup per write completion with I/O threads on socket and TLS connections, improving pipelined throughput by @dgershko (#4440)
  • Fix CLUSTER SLOT-STATS ORDERBY returning wrong ordering when slot counters differ by more than 2^31 by @jzy1688 (#4459)
  • Fix slot migration failures with I/O threads and TLS by keeping the export job's ACK reads on the main thread while snapshotting by @satheeshaGowda (#4559)

USN-8705-2: OpenZFS vulnerability

Ubuntu Security Advisories
4 days 4 hours ago
USN-8705-1 fixed vulnerabilities in OpenZFS. This update provides the corresponding fix for OpenZFS on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker could possibly use this issue to perform pool-administrative operations or access privileged information, resulting in an authorization bypass.

USN-8707-1: openCryptoki vulnerabilities

Ubuntu Security Advisories
4 days 10 hours ago
It was discovered that primitive decoders in openCryptoki produced integer underflows when the encoded length was zero. An attacker could possibly use this issue to trigger out-of-bounds reads. (CVE-2026-40253) It was discovered that openCryptoki incorrectly handled symlinks. An attacker in the token-group could possibly use this issue to achieve privilege escalation or access sensitive information. (CVE-2026-23893) It was discovered that the CKM_ECDH_AES_KEY_WRAP implementation had a heap buffer overflow vulnerability. An attacker could possibly use this issue to trigger heap corruption, or denial-of-service. (CVE-2026-22791)