Fedora Security Advisories

• kiss-fft-131.2.0-1.fc42

Update to 131.2.0

• kiss-fft-131.2.0-1.fc43

Update to 131.2.0

• kiss-fft-131.2.0-1.fc44

Update to 131.2.0

• cpp-httplib-0.37.0-1.el9

• Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076, rhbz#2445663)

• Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies (CVE-2026-28435, rhbz#2444638)
• Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (CVE-2026-28434, rhbz#2444636)

https://github.com/yhirose/cpp-httplib/compare/v0.32.0...v0.37.0

• cpp-httplib-0.37.0-1.fc44

• Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076, rhbz#2445663)

• Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies (CVE-2026-28435, rhbz#2444638)
• Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (CVE-2026-28434, rhbz#2444636)

https://github.com/yhirose/cpp-httplib/compare/v0.32.0...v0.37.0

• cpp-httplib-0.37.0-1.fc42

• Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076, rhbz#2445663)

• Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies (CVE-2026-28435, rhbz#2444638)
• Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (CVE-2026-28434, rhbz#2444636)

https://github.com/yhirose/cpp-httplib/compare/v0.32.0...v0.37.0

• cpp-httplib-0.37.0-1.fc43

• Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076, rhbz#2445663)

• Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies (CVE-2026-28435, rhbz#2444638)
• Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (CVE-2026-28434, rhbz#2444636)

https://github.com/yhirose/cpp-httplib/compare/v0.32.0...v0.37.0

• cpp-httplib-0.37.0-1.el10_3

• Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076, rhbz#2445663)

• Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies (CVE-2026-28435, rhbz#2444638)
• Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (CVE-2026-28434, rhbz#2444636)

https://github.com/yhirose/cpp-httplib/compare/v0.32.0...v0.37.0

• forgejo-14.0.3-1.fc44

This is an upstream bug and security fix release. Please view the upstream release notes for more details.

• mingw-openexr-3.3.8-1.fc43

Update to openexr-3.4.6 resp 3.3.8.

• mingw-openexr-3.4.6-1.fc44

Update to openexr-3.4.6 resp 3.3.8.

• mingw-openexr-3.3.8-1.fc42

Update to openexr-3.4.6 resp 3.3.8.

• yarnpkg-1.22.22-17.el10_3

Update vendor bundle.

• yarnpkg-1.22.22-17.fc44

Update vendor bundle.

• yarnpkg-1.22.22-17.fc43

Update vendor bundle.

• yarnpkg-1.22.22-17.fc42

Update vendor bundle.

• chromium-145.0.7632.159-1.el10_3

Update to 145.0.7632.159

• CVE-2026-3536: Integer overflow in ANGLE
• CVE-2026-3537: Object lifecycle issue in PowerVR
• CVE-2026-3538: Integer overflow in Skia
• CVE-2026-3539: Object lifecycle issue in DevTools
• CVE-2026-3540: Inappropriate implementation in WebAudio
• CVE-2026-3541: Inappropriate implementation in CSS
• CVE-2026-3542: Inappropriate implementation in WebAssembly
• CVE-2026-3543: Inappropriate implementation in V8
• CVE-2026-3544: Heap buffer overflow in WebCodecs
• CVE-2026-3545: Insufficient data validation in Navigation

• chromium-145.0.7632.159-1.fc43

Update to 145.0.7632.159

• CVE-2026-3536: Integer overflow in ANGLE
• CVE-2026-3537: Object lifecycle issue in PowerVR
• CVE-2026-3538: Integer overflow in Skia
• CVE-2026-3539: Object lifecycle issue in DevTools
• CVE-2026-3540: Inappropriate implementation in WebAudio
• CVE-2026-3541: Inappropriate implementation in CSS
• CVE-2026-3542: Inappropriate implementation in WebAssembly
• CVE-2026-3543: Inappropriate implementation in V8
• CVE-2026-3544: Heap buffer overflow in WebCodecs
• CVE-2026-3545: Insufficient data validation in Navigation

• chromium-145.0.7632.159-1.el10_1

Update to 145.0.7632.159

• CVE-2026-3536: Integer overflow in ANGLE
• CVE-2026-3537: Object lifecycle issue in PowerVR
• CVE-2026-3538: Integer overflow in Skia
• CVE-2026-3539: Object lifecycle issue in DevTools
• CVE-2026-3540: Inappropriate implementation in WebAudio
• CVE-2026-3541: Inappropriate implementation in CSS
• CVE-2026-3542: Inappropriate implementation in WebAssembly
• CVE-2026-3543: Inappropriate implementation in V8
• CVE-2026-3544: Heap buffer overflow in WebCodecs
• CVE-2026-3545: Insufficient data validation in Navigation

• chromium-145.0.7632.159-1.fc44

Update to 145.0.7632.159

• CVE-2026-3536: Integer overflow in ANGLE
• CVE-2026-3537: Object lifecycle issue in PowerVR
• CVE-2026-3538: Integer overflow in Skia
• CVE-2026-3539: Object lifecycle issue in DevTools
• CVE-2026-3540: Inappropriate implementation in WebAudio
• CVE-2026-3541: Inappropriate implementation in CSS
• CVE-2026-3542: Inappropriate implementation in WebAssembly
• CVE-2026-3543: Inappropriate implementation in V8
• CVE-2026-3544: Heap buffer overflow in WebCodecs
• CVE-2026-3545: Insufficient data validation in Navigation