Fedora Security Advisories

coturn-4.11.0-1.el10_1

Fedora Security Advisories
3 hours 15 minutes ago
FEDORA-EPEL-2026-8d74a3f689 Packages in this update:
  • coturn-4.11.0-1.el10_1
Update description: Coturn 4.11.0
  • Fix prometheus response memory leak introduced in 4.10.0
  • Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC
  • Fix format-string injection in Redis DB driver
  • Abort on malformed allowed/denied-peer-ip at startup
  • Pin session origin only after MESSAGE-INTEGRITY validates
  • Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux
  • Drop udp_relay_servers_number config and clean up dead UDP id-space
  • Add Unity-based unit test scaffolding
  • Delete log line per relay thread on start
  • Out of bound HTTP detection in parser
  • Extend STUN client fuzz builder coverage
  • Extend fuzzing coverage and enable local fuzzing in a container
  • Cover all public stun_buffer.c wrappers in FuzzStunClient
  • HTTP parsing fixes
  • Unblock fuzz coverage for is_http and rare STUN attributes
  • Seed address-mapping table in fuzz initializer
  • Add deterministic challenge-response builder to FuzzStun
  • Add fuzz coverage for integrity helpers
  • Hoist turn_server_get_engine() out of per-packet hot path
  • Inline addr_cpy() in the header
  • Trim two redundant checks from per-packet relay hot path
  • Inline get_ioa_addr_len() in the header
  • Cache hot lookups in TURN data-path handlers
  • Load generator mode in turnutils_uclient
  • Filc harness and pointer typedefs

coturn-4.11.0-1.fc43

Fedora Security Advisories
3 hours 15 minutes ago
FEDORA-2026-f0fbd93125 Packages in this update:
  • coturn-4.11.0-1.fc43
Update description: Coturn 4.11.0
  • Fix prometheus response memory leak introduced in 4.10.0
  • Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC
  • Fix format-string injection in Redis DB driver
  • Abort on malformed allowed/denied-peer-ip at startup
  • Pin session origin only after MESSAGE-INTEGRITY validates
  • Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux
  • Drop udp_relay_servers_number config and clean up dead UDP id-space
  • Add Unity-based unit test scaffolding
  • Delete log line per relay thread on start
  • Out of bound HTTP detection in parser
  • Extend STUN client fuzz builder coverage
  • Extend fuzzing coverage and enable local fuzzing in a container
  • Cover all public stun_buffer.c wrappers in FuzzStunClient
  • HTTP parsing fixes
  • Unblock fuzz coverage for is_http and rare STUN attributes
  • Seed address-mapping table in fuzz initializer
  • Add deterministic challenge-response builder to FuzzStun
  • Add fuzz coverage for integrity helpers
  • Hoist turn_server_get_engine() out of per-packet hot path
  • Inline addr_cpy() in the header
  • Trim two redundant checks from per-packet relay hot path
  • Inline get_ioa_addr_len() in the header
  • Cache hot lookups in TURN data-path handlers
  • Load generator mode in turnutils_uclient
  • Filc harness and pointer typedefs

coturn-4.11.0-1.fc42

Fedora Security Advisories
3 hours 15 minutes ago
FEDORA-2026-dfa8ea5809 Packages in this update:
  • coturn-4.11.0-1.fc42
Update description: Coturn 4.11.0
  • Fix prometheus response memory leak introduced in 4.10.0
  • Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC
  • Fix format-string injection in Redis DB driver
  • Abort on malformed allowed/denied-peer-ip at startup
  • Pin session origin only after MESSAGE-INTEGRITY validates
  • Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux
  • Drop udp_relay_servers_number config and clean up dead UDP id-space
  • Add Unity-based unit test scaffolding
  • Delete log line per relay thread on start
  • Out of bound HTTP detection in parser
  • Extend STUN client fuzz builder coverage
  • Extend fuzzing coverage and enable local fuzzing in a container
  • Cover all public stun_buffer.c wrappers in FuzzStunClient
  • HTTP parsing fixes
  • Unblock fuzz coverage for is_http and rare STUN attributes
  • Seed address-mapping table in fuzz initializer
  • Add deterministic challenge-response builder to FuzzStun
  • Add fuzz coverage for integrity helpers
  • Hoist turn_server_get_engine() out of per-packet hot path
  • Inline addr_cpy() in the header
  • Trim two redundant checks from per-packet relay hot path
  • Inline get_ioa_addr_len() in the header
  • Cache hot lookups in TURN data-path handlers
  • Load generator mode in turnutils_uclient
  • Filc harness and pointer typedefs

coturn-4.11.0-1.el10_2

Fedora Security Advisories
3 hours 15 minutes ago
FEDORA-EPEL-2026-c9267b6791 Packages in this update:
  • coturn-4.11.0-1.el10_2
Update description: Coturn 4.11.0
  • Fix prometheus response memory leak introduced in 4.10.0
  • Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC
  • Fix format-string injection in Redis DB driver
  • Abort on malformed allowed/denied-peer-ip at startup
  • Pin session origin only after MESSAGE-INTEGRITY validates
  • Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux
  • Drop udp_relay_servers_number config and clean up dead UDP id-space
  • Add Unity-based unit test scaffolding
  • Delete log line per relay thread on start
  • Out of bound HTTP detection in parser
  • Extend STUN client fuzz builder coverage
  • Extend fuzzing coverage and enable local fuzzing in a container
  • Cover all public stun_buffer.c wrappers in FuzzStunClient
  • HTTP parsing fixes
  • Unblock fuzz coverage for is_http and rare STUN attributes
  • Seed address-mapping table in fuzz initializer
  • Add deterministic challenge-response builder to FuzzStun
  • Add fuzz coverage for integrity helpers
  • Hoist turn_server_get_engine() out of per-packet hot path
  • Inline addr_cpy() in the header
  • Trim two redundant checks from per-packet relay hot path
  • Inline get_ioa_addr_len() in the header
  • Cache hot lookups in TURN data-path handlers
  • Load generator mode in turnutils_uclient
  • Filc harness and pointer typedefs

coturn-4.11.0-1.el8

Fedora Security Advisories
3 hours 15 minutes ago
FEDORA-EPEL-2026-f90771ac28 Packages in this update:
  • coturn-4.11.0-1.el8
Update description: Coturn 4.11.0
  • Fix prometheus response memory leak introduced in 4.10.0
  • Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC
  • Fix format-string injection in Redis DB driver
  • Abort on malformed allowed/denied-peer-ip at startup
  • Pin session origin only after MESSAGE-INTEGRITY validates
  • Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux
  • Drop udp_relay_servers_number config and clean up dead UDP id-space
  • Add Unity-based unit test scaffolding
  • Delete log line per relay thread on start
  • Out of bound HTTP detection in parser
  • Extend STUN client fuzz builder coverage
  • Extend fuzzing coverage and enable local fuzzing in a container
  • Cover all public stun_buffer.c wrappers in FuzzStunClient
  • HTTP parsing fixes
  • Unblock fuzz coverage for is_http and rare STUN attributes
  • Seed address-mapping table in fuzz initializer
  • Add deterministic challenge-response builder to FuzzStun
  • Add fuzz coverage for integrity helpers
  • Hoist turn_server_get_engine() out of per-packet hot path
  • Inline addr_cpy() in the header
  • Trim two redundant checks from per-packet relay hot path
  • Inline get_ioa_addr_len() in the header
  • Cache hot lookups in TURN data-path handlers
  • Load generator mode in turnutils_uclient
  • Filc harness and pointer typedefs

coturn-4.11.0-1.fc44

Fedora Security Advisories
3 hours 15 minutes ago
FEDORA-2026-3b3139882c Packages in this update:
  • coturn-4.11.0-1.fc44
Update description: Coturn 4.11.0
  • Fix prometheus response memory leak introduced in 4.10.0
  • Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC
  • Fix format-string injection in Redis DB driver
  • Abort on malformed allowed/denied-peer-ip at startup
  • Pin session origin only after MESSAGE-INTEGRITY validates
  • Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux
  • Drop udp_relay_servers_number config and clean up dead UDP id-space
  • Add Unity-based unit test scaffolding
  • Delete log line per relay thread on start
  • Out of bound HTTP detection in parser
  • Extend STUN client fuzz builder coverage
  • Extend fuzzing coverage and enable local fuzzing in a container
  • Cover all public stun_buffer.c wrappers in FuzzStunClient
  • HTTP parsing fixes
  • Unblock fuzz coverage for is_http and rare STUN attributes
  • Seed address-mapping table in fuzz initializer
  • Add deterministic challenge-response builder to FuzzStun
  • Add fuzz coverage for integrity helpers
  • Hoist turn_server_get_engine() out of per-packet hot path
  • Inline addr_cpy() in the header
  • Trim two redundant checks from per-packet relay hot path
  • Inline get_ioa_addr_len() in the header
  • Cache hot lookups in TURN data-path handlers
  • Load generator mode in turnutils_uclient
  • Filc harness and pointer typedefs

coturn-4.11.0-1.el9

Fedora Security Advisories
3 hours 15 minutes ago
FEDORA-EPEL-2026-03f0bea6c6 Packages in this update:
  • coturn-4.11.0-1.el9
Update description: Coturn 4.11.0
  • Fix prometheus response memory leak introduced in 4.10.0
  • Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC
  • Fix format-string injection in Redis DB driver
  • Abort on malformed allowed/denied-peer-ip at startup
  • Pin session origin only after MESSAGE-INTEGRITY validates
  • Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux
  • Drop udp_relay_servers_number config and clean up dead UDP id-space
  • Add Unity-based unit test scaffolding
  • Delete log line per relay thread on start
  • Out of bound HTTP detection in parser
  • Extend STUN client fuzz builder coverage
  • Extend fuzzing coverage and enable local fuzzing in a container
  • Cover all public stun_buffer.c wrappers in FuzzStunClient
  • HTTP parsing fixes
  • Unblock fuzz coverage for is_http and rare STUN attributes
  • Seed address-mapping table in fuzz initializer
  • Add deterministic challenge-response builder to FuzzStun
  • Add fuzz coverage for integrity helpers
  • Hoist turn_server_get_engine() out of per-packet hot path
  • Inline addr_cpy() in the header
  • Trim two redundant checks from per-packet relay hot path
  • Inline get_ioa_addr_len() in the header
  • Cache hot lookups in TURN data-path handlers
  • Load generator mode in turnutils_uclient
  • Filc harness and pointer typedefs

coturn-4.11.0-1.el10_3

Fedora Security Advisories
3 hours 15 minutes ago
FEDORA-EPEL-2026-1f569c1659 Packages in this update:
  • coturn-4.11.0-1.el10_3
Update description: Coturn 4.11.0
  • Fix prometheus response memory leak introduced in 4.10.0
  • Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC
  • Fix format-string injection in Redis DB driver
  • Abort on malformed allowed/denied-peer-ip at startup
  • Pin session origin only after MESSAGE-INTEGRITY validates
  • Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux
  • Drop udp_relay_servers_number config and clean up dead UDP id-space
  • Add Unity-based unit test scaffolding
  • Delete log line per relay thread on start
  • Out of bound HTTP detection in parser
  • Extend STUN client fuzz builder coverage
  • Extend fuzzing coverage and enable local fuzzing in a container
  • Cover all public stun_buffer.c wrappers in FuzzStunClient
  • HTTP parsing fixes
  • Unblock fuzz coverage for is_http and rare STUN attributes
  • Seed address-mapping table in fuzz initializer
  • Add deterministic challenge-response builder to FuzzStun
  • Add fuzz coverage for integrity helpers
  • Hoist turn_server_get_engine() out of per-packet hot path
  • Inline addr_cpy() in the header
  • Trim two redundant checks from per-packet relay hot path
  • Inline get_ioa_addr_len() in the header
  • Cache hot lookups in TURN data-path handlers
  • Load generator mode in turnutils_uclient
  • Filc harness and pointer typedefs

chromium-148.0.7778.96-1.fc44

Fedora Security Advisories
6 hours 55 minutes ago
FEDORA-2026-1aa7b8b515 Packages in this update:
  • chromium-148.0.7778.96-1.fc44
Update description:

Update to 148.0.7778.96

  • CVE-2026-7896: Integer overflow in Blink
  • CVE-2026-7897: Use after free in Mobile
  • CVE-2026-7898: Use after free in Chromoting
  • CVE-2026-7899: Out of bounds read and write in V8
  • CVE-2026-7900: Heap buffer overflow in ANGLE
  • CVE-2026-7901: Use after free in ANGLE
  • CVE-2026-7902: Out of bounds memory access in V8
  • CVE-2026-7903: Integer overflow in ANGLE
  • CVE-2026-7904: Out of bounds read in Fonts
  • CVE-2026-7905: Insufficient validation of untrusted input in Media
  • CVE-2026-7906: Use after free in SVG
  • CVE-2026-7907: Use after free in DOM
  • CVE-2026-7908: Use after free in Fullscreen
  • CVE-2026-7909: Inappropriate implementation in ServiceWorker
  • CVE-2026-7910: Use after free in Views
  • CVE-2026-7911: Use after free in Aura
  • CVE-2026-7912: Integer overflow in GPU
  • CVE-2026-7913: Insufficient policy enforcement in DevTools
  • CVE-2026-7914: Type Confusion in Accessibility
  • CVE-2026-7915: Insufficient data validation in DevTools
  • CVE-2026-7916: Insufficient data validation in InterestGroups
  • CVE-2026-7917: Use after free in Fullscreen
  • CVE-2026-7918: Use after free in GPU
  • CVE-2026-7919: Use after free in Aura
  • CVE-2026-7920: Use after free in Skia
  • CVE-2026-7921: Use after free in Passwords
  • CVE-2026-7922: Use after free in ServiceWorker
  • CVE-2026-7923: Out of bounds write in Skia
  • CVE-2026-7924: Uninitialized Use in Dawn
  • CVE-2026-7925: Use after free in Chromoting
  • CVE-2026-7926: Use after free in PresentationAPI
  • CVE-2026-7927: Type Confusion in Runtime
  • CVE-2026-7928: Use after free in WebRTC
  • CVE-2026-7929: Use after free in MediaRecording
  • CVE-2026-7930: Insufficient validation of untrusted input in Cookies
  • CVE-2026-7931: Insufficient validation of untrusted input in iOS
  • CVE-2026-7932: Insufficient policy enforcement in Downloads
  • CVE-2026-7933: Out of bounds read in WebCodecs
  • CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker
  • CVE-2026-7935: Inappropriate implementation in Speech
  • CVE-2026-7936: Object lifecycle issue in V8
  • CVE-2026-7937: Insufficient policy enforcement in DevTools
  • CVE-2026-7938: Use after free in CSS
  • CVE-2026-7939: Inappropriate implementation in SanitizerAPI
  • CVE-2026-7940: Use after free in V8
  • CVE-2026-7941: Insufficient validation of untrusted input in Mobile
  • CVE-2026-7942: Integer overflow in ANGLE
  • CVE-2026-7943: Insufficient validation of untrusted input in ANGLE
  • CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache
  • CVE-2026-7945: Insufficient validation of untrusted input in COOP
  • CVE-2026-7946: Insufficient policy enforcement in WebUI
  • CVE-2026-7947: Insufficient validation of untrusted input in Network
  • CVE-2026-7948: Race in Chromoting
  • CVE-2026-7949: Out of bounds read in Skia
  • CVE-2026-7950: Out of bounds read and write in GFX
  • CVE-2026-7951: Out of bounds write in WebRTC
  • CVE-2026-7952: Insufficient policy enforcement in Extensions
  • CVE-2026-7953: Insufficient validation of untrusted input in Omnibox
  • CVE-2026-7954: Race in Shared Storage
  • CVE-2026-7955: Uninitialized Use in GPU
  • CVE-2026-7956: Use after free in Navigation
  • CVE-2026-7957: Out of bounds write in Media
  • CVE-2026-7958: Inappropriate implementation in ServiceWorker
  • CVE-2026-7959: Inappropriate implementation in Navigation
  • CVE-2026-7960: Race in Speech
  • CVE-2026-7961: Insufficient validation of untrusted input in Permissions
  • CVE-2026-7962: Insufficient policy enforcement in DirectSockets
  • CVE-2026-7963: Inappropriate implementation in ServiceWorker
  • CVE-2026-7964: Insufficient validation of untrusted input in FileSystem
  • CVE-2026-7965: Insufficient validation of untrusted input in DevTools
  • CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation
  • CVE-2026-7967: Insufficient validation of untrusted input in Navigation
  • CVE-2026-7968: Insufficient validation of untrusted input in CORS
  • CVE-2026-7969: Integer overflow in Network
  • CVE-2026-7970: Use after free in TopChrome
  • CVE-2026-7971: Inappropriate implementation in ORB
  • CVE-2026-7972: Uninitialized Use in GPU
  • CVE-2026-7973: Integer overflow in Dawn
  • CVE-2026-7974: Use after free in Blink
  • CVE-2026-7975: Use after free in DevTools
  • CVE-2026-7976: Use after free in Views
  • CVE-2026-7977: Inappropriate implementation in Canvas
  • CVE-2026-7978: Inappropriate implementation in Companion
  • CVE-2026-7979: Inappropriate implementation in Media
  • CVE-2026-7980: Use after free in WebAudio
  • CVE-2026-7981: Out of bounds read in Codecs
  • CVE-2026-7982: Uninitialized Use in WebCodecs
  • CVE-2026-7983: Out of bounds read in Dawn
  • CVE-2026-7984: Use after free in ReadingMode
  • CVE-2026-7985: Use after free in GPU
  • CVE-2026-7986: Insufficient policy enforcement in Autofill
  • CVE-2026-7987: Use after free in WebRTC
  • CVE-2026-7988: Type Confusion in WebRTC
  • CVE-2026-7989: Insufficient data validation in DataTransfer
  • CVE-2026-7990: Insufficient validation of untrusted input in Updater
  • CVE-2026-7991: Use after free in UI
  • CVE-2026-7992: Insufficient validation of untrusted input in UI
  • CVE-2026-7993: Insufficient validation of untrusted input in Payments
  • CVE-2026-7994: Inappropriate implementation in Chromoting
  • CVE-2026-7995: Out of bounds read in AdFilter
  • CVE-2026-7996: Insufficient validation of untrusted input in SSL
  • CVE-2026-7997: Insufficient validation of untrusted input in Updater
  • CVE-2026-7998: Insufficient validation of untrusted input in Dialog
  • CVE-2026-7999: Inappropriate implementation in V8
  • CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver
  • CVE-2026-8001: Use after free in Printing
  • CVE-2026-8002: Use after free in Audio
  • CVE-2026-8003: Insufficient validation of untrusted input in TabGroups
  • CVE-2026-8004: Insufficient policy enforcement in DevTools
  • CVE-2026-8005: Insufficient validation of untrusted input in Cast
  • CVE-2026-8006: Insufficient policy enforcement in DevTools
  • CVE-2026-8007: Insufficient validation of untrusted input in Cast
  • CVE-2026-8008: Inappropriate implementation in DevTools
  • CVE-2026-8009: Inappropriate implementation in Cast
  • CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation
  • CVE-2026-8011: Insufficient policy enforcement in Search
  • CVE-2026-8012: Inappropriate implementation in MHTML
  • CVE-2026-8013: Insufficient validation of untrusted input in FedCM
  • CVE-2026-8014: Inappropriate implementation in Preload
  • CVE-2026-8015: Inappropriate implementation in Media
  • CVE-2026-8016: Use after free in WebRTC
  • CVE-2026-8017: Side-channel information leakage in Media
  • CVE-2026-8018: Insufficient policy enforcement in DevTools
  • CVE-2026-8019: Insufficient policy enforcement in WebApp
  • CVE-2026-8020: Uninitialized Use in GPU
  • CVE-2026-8021: Script injection in UI
  • CVE-2026-8022: Inappropriate implementation in MHTML

chromium-148.0.7778.96-1.fc42

Fedora Security Advisories
6 hours 55 minutes ago
FEDORA-2026-67a2a7275d Packages in this update:
  • chromium-148.0.7778.96-1.fc42
Update description:

Update to 148.0.7778.96

  • CVE-2026-7896: Integer overflow in Blink
  • CVE-2026-7897: Use after free in Mobile
  • CVE-2026-7898: Use after free in Chromoting
  • CVE-2026-7899: Out of bounds read and write in V8
  • CVE-2026-7900: Heap buffer overflow in ANGLE
  • CVE-2026-7901: Use after free in ANGLE
  • CVE-2026-7902: Out of bounds memory access in V8
  • CVE-2026-7903: Integer overflow in ANGLE
  • CVE-2026-7904: Out of bounds read in Fonts
  • CVE-2026-7905: Insufficient validation of untrusted input in Media
  • CVE-2026-7906: Use after free in SVG
  • CVE-2026-7907: Use after free in DOM
  • CVE-2026-7908: Use after free in Fullscreen
  • CVE-2026-7909: Inappropriate implementation in ServiceWorker
  • CVE-2026-7910: Use after free in Views
  • CVE-2026-7911: Use after free in Aura
  • CVE-2026-7912: Integer overflow in GPU
  • CVE-2026-7913: Insufficient policy enforcement in DevTools
  • CVE-2026-7914: Type Confusion in Accessibility
  • CVE-2026-7915: Insufficient data validation in DevTools
  • CVE-2026-7916: Insufficient data validation in InterestGroups
  • CVE-2026-7917: Use after free in Fullscreen
  • CVE-2026-7918: Use after free in GPU
  • CVE-2026-7919: Use after free in Aura
  • CVE-2026-7920: Use after free in Skia
  • CVE-2026-7921: Use after free in Passwords
  • CVE-2026-7922: Use after free in ServiceWorker
  • CVE-2026-7923: Out of bounds write in Skia
  • CVE-2026-7924: Uninitialized Use in Dawn
  • CVE-2026-7925: Use after free in Chromoting
  • CVE-2026-7926: Use after free in PresentationAPI
  • CVE-2026-7927: Type Confusion in Runtime
  • CVE-2026-7928: Use after free in WebRTC
  • CVE-2026-7929: Use after free in MediaRecording
  • CVE-2026-7930: Insufficient validation of untrusted input in Cookies
  • CVE-2026-7931: Insufficient validation of untrusted input in iOS
  • CVE-2026-7932: Insufficient policy enforcement in Downloads
  • CVE-2026-7933: Out of bounds read in WebCodecs
  • CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker
  • CVE-2026-7935: Inappropriate implementation in Speech
  • CVE-2026-7936: Object lifecycle issue in V8
  • CVE-2026-7937: Insufficient policy enforcement in DevTools
  • CVE-2026-7938: Use after free in CSS
  • CVE-2026-7939: Inappropriate implementation in SanitizerAPI
  • CVE-2026-7940: Use after free in V8
  • CVE-2026-7941: Insufficient validation of untrusted input in Mobile
  • CVE-2026-7942: Integer overflow in ANGLE
  • CVE-2026-7943: Insufficient validation of untrusted input in ANGLE
  • CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache
  • CVE-2026-7945: Insufficient validation of untrusted input in COOP
  • CVE-2026-7946: Insufficient policy enforcement in WebUI
  • CVE-2026-7947: Insufficient validation of untrusted input in Network
  • CVE-2026-7948: Race in Chromoting
  • CVE-2026-7949: Out of bounds read in Skia
  • CVE-2026-7950: Out of bounds read and write in GFX
  • CVE-2026-7951: Out of bounds write in WebRTC
  • CVE-2026-7952: Insufficient policy enforcement in Extensions
  • CVE-2026-7953: Insufficient validation of untrusted input in Omnibox
  • CVE-2026-7954: Race in Shared Storage
  • CVE-2026-7955: Uninitialized Use in GPU
  • CVE-2026-7956: Use after free in Navigation
  • CVE-2026-7957: Out of bounds write in Media
  • CVE-2026-7958: Inappropriate implementation in ServiceWorker
  • CVE-2026-7959: Inappropriate implementation in Navigation
  • CVE-2026-7960: Race in Speech
  • CVE-2026-7961: Insufficient validation of untrusted input in Permissions
  • CVE-2026-7962: Insufficient policy enforcement in DirectSockets
  • CVE-2026-7963: Inappropriate implementation in ServiceWorker
  • CVE-2026-7964: Insufficient validation of untrusted input in FileSystem
  • CVE-2026-7965: Insufficient validation of untrusted input in DevTools
  • CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation
  • CVE-2026-7967: Insufficient validation of untrusted input in Navigation
  • CVE-2026-7968: Insufficient validation of untrusted input in CORS
  • CVE-2026-7969: Integer overflow in Network
  • CVE-2026-7970: Use after free in TopChrome
  • CVE-2026-7971: Inappropriate implementation in ORB
  • CVE-2026-7972: Uninitialized Use in GPU
  • CVE-2026-7973: Integer overflow in Dawn
  • CVE-2026-7974: Use after free in Blink
  • CVE-2026-7975: Use after free in DevTools
  • CVE-2026-7976: Use after free in Views
  • CVE-2026-7977: Inappropriate implementation in Canvas
  • CVE-2026-7978: Inappropriate implementation in Companion
  • CVE-2026-7979: Inappropriate implementation in Media
  • CVE-2026-7980: Use after free in WebAudio
  • CVE-2026-7981: Out of bounds read in Codecs
  • CVE-2026-7982: Uninitialized Use in WebCodecs
  • CVE-2026-7983: Out of bounds read in Dawn
  • CVE-2026-7984: Use after free in ReadingMode
  • CVE-2026-7985: Use after free in GPU
  • CVE-2026-7986: Insufficient policy enforcement in Autofill
  • CVE-2026-7987: Use after free in WebRTC
  • CVE-2026-7988: Type Confusion in WebRTC
  • CVE-2026-7989: Insufficient data validation in DataTransfer
  • CVE-2026-7990: Insufficient validation of untrusted input in Updater
  • CVE-2026-7991: Use after free in UI
  • CVE-2026-7992: Insufficient validation of untrusted input in UI
  • CVE-2026-7993: Insufficient validation of untrusted input in Payments
  • CVE-2026-7994: Inappropriate implementation in Chromoting
  • CVE-2026-7995: Out of bounds read in AdFilter
  • CVE-2026-7996: Insufficient validation of untrusted input in SSL
  • CVE-2026-7997: Insufficient validation of untrusted input in Updater
  • CVE-2026-7998: Insufficient validation of untrusted input in Dialog
  • CVE-2026-7999: Inappropriate implementation in V8
  • CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver
  • CVE-2026-8001: Use after free in Printing
  • CVE-2026-8002: Use after free in Audio
  • CVE-2026-8003: Insufficient validation of untrusted input in TabGroups
  • CVE-2026-8004: Insufficient policy enforcement in DevTools
  • CVE-2026-8005: Insufficient validation of untrusted input in Cast
  • CVE-2026-8006: Insufficient policy enforcement in DevTools
  • CVE-2026-8007: Insufficient validation of untrusted input in Cast
  • CVE-2026-8008: Inappropriate implementation in DevTools
  • CVE-2026-8009: Inappropriate implementation in Cast
  • CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation
  • CVE-2026-8011: Insufficient policy enforcement in Search
  • CVE-2026-8012: Inappropriate implementation in MHTML
  • CVE-2026-8013: Insufficient validation of untrusted input in FedCM
  • CVE-2026-8014: Inappropriate implementation in Preload
  • CVE-2026-8015: Inappropriate implementation in Media
  • CVE-2026-8016: Use after free in WebRTC
  • CVE-2026-8017: Side-channel information leakage in Media
  • CVE-2026-8018: Insufficient policy enforcement in DevTools
  • CVE-2026-8019: Insufficient policy enforcement in WebApp
  • CVE-2026-8020: Uninitialized Use in GPU
  • CVE-2026-8021: Script injection in UI
  • CVE-2026-8022: Inappropriate implementation in MHTML

chromium-148.0.7778.96-1.fc43

Fedora Security Advisories
6 hours 55 minutes ago
FEDORA-2026-f4e92d8d66 Packages in this update:
  • chromium-148.0.7778.96-1.fc43
Update description:

Update to 148.0.7778.96

  • CVE-2026-7896: Integer overflow in Blink
  • CVE-2026-7897: Use after free in Mobile
  • CVE-2026-7898: Use after free in Chromoting
  • CVE-2026-7899: Out of bounds read and write in V8
  • CVE-2026-7900: Heap buffer overflow in ANGLE
  • CVE-2026-7901: Use after free in ANGLE
  • CVE-2026-7902: Out of bounds memory access in V8
  • CVE-2026-7903: Integer overflow in ANGLE
  • CVE-2026-7904: Out of bounds read in Fonts
  • CVE-2026-7905: Insufficient validation of untrusted input in Media
  • CVE-2026-7906: Use after free in SVG
  • CVE-2026-7907: Use after free in DOM
  • CVE-2026-7908: Use after free in Fullscreen
  • CVE-2026-7909: Inappropriate implementation in ServiceWorker
  • CVE-2026-7910: Use after free in Views
  • CVE-2026-7911: Use after free in Aura
  • CVE-2026-7912: Integer overflow in GPU
  • CVE-2026-7913: Insufficient policy enforcement in DevTools
  • CVE-2026-7914: Type Confusion in Accessibility
  • CVE-2026-7915: Insufficient data validation in DevTools
  • CVE-2026-7916: Insufficient data validation in InterestGroups
  • CVE-2026-7917: Use after free in Fullscreen
  • CVE-2026-7918: Use after free in GPU
  • CVE-2026-7919: Use after free in Aura
  • CVE-2026-7920: Use after free in Skia
  • CVE-2026-7921: Use after free in Passwords
  • CVE-2026-7922: Use after free in ServiceWorker
  • CVE-2026-7923: Out of bounds write in Skia
  • CVE-2026-7924: Uninitialized Use in Dawn
  • CVE-2026-7925: Use after free in Chromoting
  • CVE-2026-7926: Use after free in PresentationAPI
  • CVE-2026-7927: Type Confusion in Runtime
  • CVE-2026-7928: Use after free in WebRTC
  • CVE-2026-7929: Use after free in MediaRecording
  • CVE-2026-7930: Insufficient validation of untrusted input in Cookies
  • CVE-2026-7931: Insufficient validation of untrusted input in iOS
  • CVE-2026-7932: Insufficient policy enforcement in Downloads
  • CVE-2026-7933: Out of bounds read in WebCodecs
  • CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker
  • CVE-2026-7935: Inappropriate implementation in Speech
  • CVE-2026-7936: Object lifecycle issue in V8
  • CVE-2026-7937: Insufficient policy enforcement in DevTools
  • CVE-2026-7938: Use after free in CSS
  • CVE-2026-7939: Inappropriate implementation in SanitizerAPI
  • CVE-2026-7940: Use after free in V8
  • CVE-2026-7941: Insufficient validation of untrusted input in Mobile
  • CVE-2026-7942: Integer overflow in ANGLE
  • CVE-2026-7943: Insufficient validation of untrusted input in ANGLE
  • CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache
  • CVE-2026-7945: Insufficient validation of untrusted input in COOP
  • CVE-2026-7946: Insufficient policy enforcement in WebUI
  • CVE-2026-7947: Insufficient validation of untrusted input in Network
  • CVE-2026-7948: Race in Chromoting
  • CVE-2026-7949: Out of bounds read in Skia
  • CVE-2026-7950: Out of bounds read and write in GFX
  • CVE-2026-7951: Out of bounds write in WebRTC
  • CVE-2026-7952: Insufficient policy enforcement in Extensions
  • CVE-2026-7953: Insufficient validation of untrusted input in Omnibox
  • CVE-2026-7954: Race in Shared Storage
  • CVE-2026-7955: Uninitialized Use in GPU
  • CVE-2026-7956: Use after free in Navigation
  • CVE-2026-7957: Out of bounds write in Media
  • CVE-2026-7958: Inappropriate implementation in ServiceWorker
  • CVE-2026-7959: Inappropriate implementation in Navigation
  • CVE-2026-7960: Race in Speech
  • CVE-2026-7961: Insufficient validation of untrusted input in Permissions
  • CVE-2026-7962: Insufficient policy enforcement in DirectSockets
  • CVE-2026-7963: Inappropriate implementation in ServiceWorker
  • CVE-2026-7964: Insufficient validation of untrusted input in FileSystem
  • CVE-2026-7965: Insufficient validation of untrusted input in DevTools
  • CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation
  • CVE-2026-7967: Insufficient validation of untrusted input in Navigation
  • CVE-2026-7968: Insufficient validation of untrusted input in CORS
  • CVE-2026-7969: Integer overflow in Network
  • CVE-2026-7970: Use after free in TopChrome
  • CVE-2026-7971: Inappropriate implementation in ORB
  • CVE-2026-7972: Uninitialized Use in GPU
  • CVE-2026-7973: Integer overflow in Dawn
  • CVE-2026-7974: Use after free in Blink
  • CVE-2026-7975: Use after free in DevTools
  • CVE-2026-7976: Use after free in Views
  • CVE-2026-7977: Inappropriate implementation in Canvas
  • CVE-2026-7978: Inappropriate implementation in Companion
  • CVE-2026-7979: Inappropriate implementation in Media
  • CVE-2026-7980: Use after free in WebAudio
  • CVE-2026-7981: Out of bounds read in Codecs
  • CVE-2026-7982: Uninitialized Use in WebCodecs
  • CVE-2026-7983: Out of bounds read in Dawn
  • CVE-2026-7984: Use after free in ReadingMode
  • CVE-2026-7985: Use after free in GPU
  • CVE-2026-7986: Insufficient policy enforcement in Autofill
  • CVE-2026-7987: Use after free in WebRTC
  • CVE-2026-7988: Type Confusion in WebRTC
  • CVE-2026-7989: Insufficient data validation in DataTransfer
  • CVE-2026-7990: Insufficient validation of untrusted input in Updater
  • CVE-2026-7991: Use after free in UI
  • CVE-2026-7992: Insufficient validation of untrusted input in UI
  • CVE-2026-7993: Insufficient validation of untrusted input in Payments
  • CVE-2026-7994: Inappropriate implementation in Chromoting
  • CVE-2026-7995: Out of bounds read in AdFilter
  • CVE-2026-7996: Insufficient validation of untrusted input in SSL
  • CVE-2026-7997: Insufficient validation of untrusted input in Updater
  • CVE-2026-7998: Insufficient validation of untrusted input in Dialog
  • CVE-2026-7999: Inappropriate implementation in V8
  • CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver
  • CVE-2026-8001: Use after free in Printing
  • CVE-2026-8002: Use after free in Audio
  • CVE-2026-8003: Insufficient validation of untrusted input in TabGroups
  • CVE-2026-8004: Insufficient policy enforcement in DevTools
  • CVE-2026-8005: Insufficient validation of untrusted input in Cast
  • CVE-2026-8006: Insufficient policy enforcement in DevTools
  • CVE-2026-8007: Insufficient validation of untrusted input in Cast
  • CVE-2026-8008: Inappropriate implementation in DevTools
  • CVE-2026-8009: Inappropriate implementation in Cast
  • CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation
  • CVE-2026-8011: Insufficient policy enforcement in Search
  • CVE-2026-8012: Inappropriate implementation in MHTML
  • CVE-2026-8013: Insufficient validation of untrusted input in FedCM
  • CVE-2026-8014: Inappropriate implementation in Preload
  • CVE-2026-8015: Inappropriate implementation in Media
  • CVE-2026-8016: Use after free in WebRTC
  • CVE-2026-8017: Side-channel information leakage in Media
  • CVE-2026-8018: Insufficient policy enforcement in DevTools
  • CVE-2026-8019: Insufficient policy enforcement in WebApp
  • CVE-2026-8020: Uninitialized Use in GPU
  • CVE-2026-8021: Script injection in UI
  • CVE-2026-8022: Inappropriate implementation in MHTML

valkey-8.0.9-1.el8

Fedora Security Advisories
10 hours 1 minute ago
FEDORA-EPEL-2026-4394a54d4e Packages in this update:
  • valkey-8.0.9-1.el8
Update description: Version 8.0.9

Security fixes

  • (CVE-2026-23479) Use-After-Free in unblock client flow
  • (CVE-2026-25243) Invalid Memory Access in RESTORE command
  • (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

valkey-8.0.9-1.fc42

Fedora Security Advisories
10 hours 1 minute ago
FEDORA-2026-114b1e5d3a Packages in this update:
  • valkey-8.0.9-1.fc42
Update description: Version 8.0.9

Security fixes

  • (CVE-2026-23479) Use-After-Free in unblock client flow
  • (CVE-2026-25243) Invalid Memory Access in RESTORE command
  • (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

valkey-8.1.7-1.fc43

Fedora Security Advisories
10 hours 1 minute ago
FEDORA-2026-76cf27ea56 Packages in this update:
  • valkey-8.1.7-1.fc43
Update description: Version 8.1.7

Security fixes

  • (CVE-2026-23479) Use-After-Free in unblock client flow
  • (CVE-2026-25243) Invalid Memory Access in RESTORE command
  • (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

valkey-9.0.4-1.fc44

Fedora Security Advisories
10 hours 2 minutes ago
FEDORA-2026-3e31dafe5c Packages in this update:
  • valkey-9.0.4-1.fc44
Update description: Version 9.0.4

Security fixes

  • (CVE-2026-23479) Use-After-Free in unblock client flow
  • (CVE-2026-25243) Invalid Memory Access in RESTORE command
  • (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

apptainer-1.5.0-1.fc44

Fedora Security Advisories
11 hours 33 minutes ago
FEDORA-2026-d516d12934 Packages in this update:
  • apptainer-1.5.0-1.fc44
Update description:

Update to upstream 1.5.0, fix CVE-2026-32285 and CVE-2026-34986

Update to upstream 1.5.0-rc.2

Update to upstream 1.5.0-rc.1

apptainer-1.5.0-1.el9

Fedora Security Advisories
11 hours 33 minutes ago
FEDORA-EPEL-2026-0d0ae895c6 Packages in this update:
  • apptainer-1.5.0-1.el9
Update description:

Update to upstream 1.5.0, fix CVE-2026-34986

Update to upstream 1.5.0-rc.2

Update to upstream 1.5.0-rc.1

apptainer-1.5.0-1.fc42

Fedora Security Advisories
11 hours 33 minutes ago
FEDORA-2026-db5621b65e Packages in this update:
  • apptainer-1.5.0-1.fc42
Update description:

Update to upstream 1.5.0, fix CVE-2026-32285 and CVE-2026-34986

Update to upstream 1.5.0-rc.2

Update to upstream 1.5.0-rc.1

apptainer-1.5.0-1.fc43

Fedora Security Advisories
11 hours 33 minutes ago
FEDORA-2026-6c547e9f64 Packages in this update:
  • apptainer-1.5.0-1.fc43
Update description:

Update to upstream 1.5.0, fix CVE-2026-32285 and CVE-2026-34986

Update to upstream 1.5.0-rc.2

Update to upstream 1.5.0-rc.1

apptainer-1.5.0-1.el10_3

Fedora Security Advisories
11 hours 33 minutes ago
FEDORA-EPEL-2026-2f250c3cfd Packages in this update:
  • apptainer-1.5.0-1.el10_3
Update description:

Update to upstream 1.5.0, fix CVE-2026-34986

Update to upstream 1.5.0-rc.2

Update to upstream 1.5.0-rc.1

Checked
26 minutes 29 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security