Fedora Security Advisories

• curl-8.18.0-10.fc44

• Fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536)
• Fix Native CA trust persist (CVE-2026-11564)
• Fix stale proxy password leak (CVE-2026-9079)
• Fix wrong reuse for different services (CVE-2026-8458)

• GitPython-3.1.62-1.el10_4

Update to 3.1.62 (close RHBZ#2529282)

• Fixes GHSA-hmq2-w58f-27jc

• GitPython-3.1.62-1.fc43

Update to 3.1.62 (close RHBZ#2529282)

• Fixes GHSA-hmq2-w58f-27jc

• python-django6-6.1.1-2.fc44

Update python-django6 (providing python3-django) to the latest 6.1.1 release

• python-django6-6.1.1-2.fc45

Update python-django6 (providing python3-django) to the latest 6.1.1 release

• perl-Net-OAuth-0.33-2.el10_2

Fixes CVE-2025-22376 and CVE-2026-75589

• perl-Net-OAuth-0.33-2.el10_3

Fixes CVE-2025-22376 and CVE-2026-75589

• perl-Net-OAuth-0.33-2.el10_4

Fixes CVE-2025-22376 and CVE-2026-75589

• open62541-1.5.8-1.fc45

Update to 1.5.8

• open62541-1.5.8-1.fc44

Update to 1.5.8

• open62541-1.5.8-1.fc43

Update to 1.5.8

• php-pecl-mongodb-1.20.1-3.el9

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in #2059

• php-pecl-mongodb-1.21.9-1.el10_2

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in #2059

• php-pecl-mongodb2-2.1.9-1.fc44

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• php-pecl-mongodb2-2.1.9-2.el10_2

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• php-pecl-mongodb2-2.1.9-1.fc43

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• roundcubemail-1.7.4-1.fc44

• Use X-Content-Type-Options:nosniff for attachment previews and downloads (#10308)
• zipdownload: Fix attachment filename sanitisation of backslash and control characters (#10325)
• Security: Fix CSS declaration smuggling via un-encoded ampersand emission
• Security: Fix CSS property injection via body background attribute
• Security: Fix email header injection via bare CR in the subject field
• Security: Fix email header injection via C-escape \r in the recipient display name
• Security: Fix email header injection via identity's organization field
• Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
• Security: Fix XSS in the HTML editor using text/enriched part content
• Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book
• Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
• Security: Fix remote-content blocker bypass via SVG SMIL src animation
• Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses

• roundcubemail-1.7.4-1.fc45

• Use X-Content-Type-Options:nosniff for attachment previews and downloads (#10308)
• zipdownload: Fix attachment filename sanitisation of backslash and control characters (#10325)
• Security: Fix CSS declaration smuggling via un-encoded ampersand emission
• Security: Fix CSS property injection via body background attribute
• Security: Fix email header injection via bare CR in the subject field
• Security: Fix email header injection via C-escape \r in the recipient display name
• Security: Fix email header injection via identity's organization field
• Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
• Security: Fix XSS in the HTML editor using text/enriched part content
• Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book
• Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
• Security: Fix remote-content blocker bypass via SVG SMIL src animation
• Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses

• roundcubemail-1.6.19-1.el10_2

• Fix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294)
• Security: Fix CSS declaration smuggling via un-encoded ampersand emission
• Security: Fix CSS property injection via body background attribute
• Security: Fix email header injection via bare CR in the subject field
• Security: Fix email header injection via C-escape \r in the recipient display name
• Security: Fix email header injection via identity's organization field
• Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
• Security: Fix XSS in the HTML editor using text/enriched part content
• Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book
• Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
• Security: Fix remote-content blocker bypass via SVG SMIL src animation
• Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses

• roundcubemail-1.6.19-1.fc43

• Fix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294)
• Security: Fix CSS declaration smuggling via un-encoded ampersand emission
• Security: Fix CSS property injection via body background attribute
• Security: Fix email header injection via bare CR in the subject field
• Security: Fix email header injection via C-escape \r in the recipient display name
• Security: Fix email header injection via identity's organization field
• Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
• Security: Fix XSS in the HTML editor using text/enriched part content
• Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book
• Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
• Security: Fix remote-content blocker bypass via SVG SMIL src animation
• Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses