Fedora Security Advisories

FEDORA-2026-ccd3011907 Packages in this update:

• selenium-manager-4.45.0-3.fc45

Update description:

Rebuilt with latest rustls/rustls-webpki

• rustls 0.23.46 addresses RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349
• rustls-webpki 0.103.16 addresses RUSTSEC-2026-0382

FEDORA-2026-9142230324 Packages in this update:

• unbound-1.26.2-1.fc44

Update description: Update to 1.26.2 (rhbz#2558169)

Security fixes from the upstream changelog:

• Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
• Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
• Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
• Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen (Tsinghua University) for the report.
• Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

FEDORA-2026-7b16c1d7fc Packages in this update:

• unbound-1.26.2-2.fc45

Update description: Update to 1.26.2 (rhbz#2558169)

Security fixes from the upstream changelog:

• Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
• Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
• Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
• Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen (Tsinghua University) for the report.
• Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

FEDORA-2026-37bcaf6ef8 Packages in this update:

• python3.9-3.9.25-15.fc43

Update description:

• Security fix for CVE-2026-11940
• Security fix for CVE-2026-15308

FEDORA-2026-2758f89ce1 Packages in this update:

• python3.9-3.9.25-15.fc44

Update description:

• Security fix for CVE-2026-11940
• Security fix for CVE-2026-15308

FEDORA-2026-7d4610faad Packages in this update:

• python3.9-3.9.25-15.fc45

Update description:

• Security fix for CVE-2026-11940
• Security fix for CVE-2026-15308

FEDORA-2026-92436bef9c Packages in this update:

• brotli-1.2.1-1.fc44
• perl-Alien-Brotli-0.2.2-14.fc44

Update description:

Brotli 1.2.1 update which is security fix for CVE-2026-111497

FEDORA-2026-4aade61415 Packages in this update:

• brotli-1.2.1-1.fc43
• perl-Alien-Brotli-0.2.2-12.fc43

Update description:

Brotli 1.2.1 update which is security fix for CVE-2026-111497

FEDORA-2026-2d80410324 Packages in this update:

• python3.9-3.9.25-15.fc46

Update description:

Automatic update for python3.9-3.9.25-15.fc46.

Changelog * Wed Sep 23 2026 Miro Hrončok <mhroncok@redhat.com> - 3.9.25-15 - Security fix for CVE-2026-11940 * Wed Sep 23 2026 Lukáš Zachar <lzachar@redhat.com> - 3.9.25-14 - Security fix for CVE-2026-15308 Resolves: rhbz#2498693

FEDORA-EPEL-2026-93806300a6 Packages in this update:

• uv-0.10.2-14.el10_2

Update description:

The uv package has been rebuilt with updated rustls and webpki dependencies, fixing RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. This includes fixes for the eMudhra intermediate CA compromise. Futhermore, we have backported the latest managed CPython builds for 3.11 and newer from uv 0.13.5; these builds distrust the eMudhra certificates. For more details and caveats, read the 0.13.5 changelogs. Finally, the system-wide configuration file (uv.toml) now sets system-certs = true, which means that, by default, the system-wide trust store is used instead of the root certificates bundled with uv. This better integrates with system-wide trust settings, and uv users can benefit from prompt security updates to the system-wide CA list.

FEDORA-2026-46fb337f11 Packages in this update:

• rubygem-gist-6.1.0-1.fc43

Update description:

Verify TLS server certificate (fixes fedora#2546280)

FEDORA-2026-403284c759 Packages in this update:

• rubygem-gist-6.1.0-1.fc44

Update description:

Verify TLS server certificate (fixes fedora#2546280)

FEDORA-2026-26f9e93952 Packages in this update:

• rubygem-gist-6.1.0-1.fc45

Update description:

Verify TLS server certificate (fixes fedora#2546280)

FEDORA-2026-cad2480b8a Packages in this update:

• live555-2026.10.24-1.fc46
• vlc-3.0.24-4.fc46

Update description:

Latest upstream release of live555. Multiple security-relevant bug fixes, see: https://download.live555.com/changelog.txt .

FEDORA-2026-203a947c26 Packages in this update:

• rubygem-gist-6.1.0-1.fc46

Update description:

Automatic update for rubygem-gist-6.1.0-1.fc46.

Changelog * Mon Oct 26 2026 Georg Sauthoff <mail@gms.tf> - 6.1.0-1 - Verify TLS server certificate (fixes fedora#2546280)

FEDORA-2026-dd82a0810d Packages in this update:

• freetype-2.13.3-4.fc43

Update description:

This update fixes an integer overflow in FreeType tracked as CVE-2026-49919.

FEDORA-EPEL-2026-2004bc76b4 Packages in this update:

• uv-0.12.7-11.el10_3

Update description:

The uv package has been rebuilt with updated rustls and webpki dependencies, fixing RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. This includes fixes for the eMudhra intermediate CA compromise. Futhermore, we have backported the latest managed CPython builds for 3.11 and newer from uv 0.13.5; these builds distrust the eMudhra certificates. For more details and caveats, read the 0.13.5 changelogs. Finally, the system-wide configuration file (uv.toml) now sets system-certs = true, which means that, by default, the system-wide trust store is used instead of the root certificates bundled with uv. This better integrates with system-wide trust settings, and uv users can benefit from prompt security updates to the system-wide CA list.

FEDORA-EPEL-2026-220493a907 Packages in this update:

• libsidplayfp-2.15.0-2.el10_4

Update description:

Fix CVE-2026-111148 - possible OOB read (rhbz#2554228)

FEDORA-2026-6ebd8db1af Packages in this update:

• libsidplayfp-3.1.2-1.fc46

Update description:

Automatic update for libsidplayfp-3.1.2-1.fc46.

Changelog * Mon Oct 26 2026 Karel Volný <kvolny@redhat.com> - 3.1.2-1 - Update to 3.1.2 (rhbz#2560385) - Fixes CVE-2026-111148 - possible OOB read (rhbz#2554229)

FEDORA-2026-5b98dd6d78 Packages in this update:

• mingw-qt5-qtwebkit-5.212.0-0.46.alpha4.fc45

Update description:

Backport fix for CVE-2026-111497.