Fedora Security Updates

FEDORA-EPEL-2026-d8f2957095 Packages in this update: GitPython-3.1.62-1.el9 Update description: Update to 3.1.62 (close RHBZ#2529282) Fixes GHSA-hmq2-w58f-27jc

FEDORA-2026-301e6e2983 Packages in this update: python-django5-5.2.17-2.fc44 Update description: Update python-django5 to the latest 5.x release (5.2.17) Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery via spatial lookups Fixes CVE-2026-15337 [low]: Potential denial-of-service vulnerability in check_for_language() Fixes CVE-2026-15830 [moderate]: Potential denial-of-service vulnerability via nested geometry collections Fixes CVE-2026-15920 [moderate]: Potential cross-site scripting via URLField values in the admin

FEDORA-2026-6b28b4e483 Packages in this update: python-django5-5.2.17-2.fc43 Update description: Update python-django5 to the latest 5.x release (5.2.17) Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery via spatial lookups Fixes CVE-2026-15337 [low]: Potential denial-of-service vulnerability in check_for_language() Fixes CVE-2026-15830 [moderate]: Potential denial-of-service vulnerability via nested geometry collections Fixes CVE-2026-15920 [moderate]: Potential cross-site scripting via URLField values in the admin

FEDORA-2026-950089270f Packages in this update: python-django5-5.2.17-2.fc45 Update description: Update python-django5 to the latest 5.x release (5.2.17) Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery via spatial lookups Fixes CVE-2026-15337 [low]: Potential denial-of-service vulnerability in check_for_language() Fixes CVE-2026-15830 [moderate]: Potential denial-of-service vulnerability via nested geometry collections Fixes CVE-2026-15920 [moderate]: Potential cross-site scripting via URLField values in the admin

FEDORA-2026-ee1eb89e7b Packages in this update: tar-1.35-10.fc45 Update description: Fix CVE-2026-5704, CVE-2026-18508, CVE-2026-18477, and a regression in the fix for CVE-2025-45582.

FEDORA-2026-c8b1bb0c97 Packages in this update: gnatcoll-26.0.0-5.fc45 Update description: Patched the vulnerabilities GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164 in a way that avoids interface changes.

FEDORA-2026-6ed52ea50e Packages in this update: bluez-5.87+1.git8750129efca8-1.fc43 Update description: This update fixes a number of security issues.

FEDORA-2026-d4156b5fc5 Packages in this update: bluez-5.87+1.git8750129efca8-1.fc44 Update description: This update fixes a number of security issues.

FEDORA-2026-9e011ac6ed Packages in this update: bluez-5.87+1.git8750129efca8-1.fc45 Update description: This update fixes a number of security issues.

FEDORA-2026-11f44e3c2c Packages in this update: gnatcoll-26.0.0-4.fc44 Update description: Patched the vulnerabilities GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164 in a way that avoids interface changes.

FEDORA-2026-d5c7f91202 Packages in this update: gnatcoll-25.0.0-6.fc43 Update description: Patched the vulnerabilities GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164 in a way that avoids interface changes.

FEDORA-2026-fe1549bec3 Packages in this update: sblim-cmpi-base-1.6.4-31.fc43 Update description: Use mktemp for temporary files in provider registration script (CVE-2026-73585)

FEDORA-2026-67f78e732b Packages in this update: nodejs-undici-7.29.0-3.fc43 Update description: Update to version 7.29.0. Contains fix for CVE-2026-18149.

FEDORA-2026-90bb0fcd50 Packages in this update: nodejs-undici-7.29.0-3.fc44 Update description: Update to version 7.29.0. Contains fix for CVE-2026-18149.

FEDORA-2026-25a6102ac6 Packages in this update: nodejs-undici-7.29.0-3.fc45 Update description: Update to version 7.29.0. Contains fix for CVE-2026-18149.

FEDORA-2026-313e66c007 Packages in this update: bcm283x-firmware-20260907-1.b76effd.fc45 uboot-tools-2026.10-0.4.rc4.fc45 Update description: Update to the latest U-Boot 2026.10 RC4 fixes Display fixes from sleep for some generations of Raspberry Pi

FEDORA-2026-6841033933 Packages in this update: curl-8.15.0-10.fc43 Update description: fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536) fix stale proxy password leak (CVE-2026-9079) fix wrong reuse for different services (CVE-2026-8458)

FEDORA-2026-7510dd645d Packages in this update: sblim-cmpi-base-1.6.4-33.fc44 Update description: Use mktemp for temporary files in provider registration script (CVE-2026-73585)

FEDORA-2026-700fe12346 Packages in this update: sblim-cmpi-base-1.6.4-34.fc45 Update description: Use mktemp for temporary files in provider registration script (CVE-2026-73585)

FEDORA-EPEL-2026-9b91575037 Packages in this update: GitPython-3.1.62-1.el10_3 Update description: Update to 3.1.62 (close RHBZ#2529282) Fixes GHSA-hmq2-w58f-27jc