Wednesday 28th October 2026

Fedora Project

• Updated perl-MIME-tools to 5.522 in F-43, F-44, F-45, Rawhide, EPEL-8, EPEL-9, EPEL-10.2, EPEL-10.3 and EPEL-10:

  • parse_params: Flag a parameter list that could not be parsed

    • Detect additional ambiguous parse situations when parameter names contain illegal characters

    • Fixes: CVE-2026-116264 invalid parameter hides boundary/filename

  • parse_params: Check the boundary after RFC 2231 reassembly

    • Another ambiguous-parse case was missed (trailing space after boundary was not detected for RFC-2231-encoded boundaries)

    • Fixes: CVE-2026-116265 RFC 2231 boundary skips ambiguity checks

  • parse_params: Stricter checking for encoded boundaries; earlier versions would miss some cases

    • Fixes: CVE-2026-116266 boundary changed by decoding not flagged

  • Cap the indentation levels in the Results: structure; otherwise, specially-crafted messages could consume large amounts of memory

    • Fixes: CVE-2026-116267 indent stored per message per level

  • parse_params: Stop a comment match at the next parenthesis; otherwise, specially-crafted messages could cause the regex back-tracker to consume large amounts of CPU time

    • Note that MIME::Parser does not correctly parse ((nested comments)) and has never done so

    • Fixes: CVE-2026-116268 unclosed "(" comments backtrack CPU exhaustion

  • parse_params: Re-encode filename* values without charset tricks

    • Specially-crafted messages could trick recommended_filename() into returning an empty string instead of a plausible filename

    • Fixes: CVE-2026-116269 RFC 2231 language tag empties filename

  • decode_mimewords: Do not copy the input into each error; otherwise, specially-crafted messages could consume large amounts of memory

    • Fixes: CVE-2026-116270 each bad "=?" copies the input into $@

  • FileUnder: Do not reuse an existing generated directory; otherwise, attackers might be able to use symbolic links to get files created in unexpected locations

    • Fixes: CVE-2026-116271 FileUnder reuses a pre-created directory

  • parse_params: Flag comments other readers do not skip

    • Specially-crafted messages could create ambiguous messages without setting the ambiguous_parse flag

    • Fixes: CVE-2026-116272 comment hides a duplicate boundary

  • Call whine() rather than error() if max_parts or max_depth is exceeded during a parse; this lets us return undef rather than throwing an exception if ignore_errors() is set to 0

  • Change to defaults: max_parts is now set to 1000 and max_depth to 64 rather than being unlimited; this should not affect most real-world uses of MIME::tools, but you may need to increase these values or set them to -1 (unlimited) if you run into trouble (NOTE INCOMPATIBILITY)

    • Fixes: CVE-2026-116273 max_parts and max_depth unlimited

  • Do not signal an ambiguous parse if we have filename="" or name=""

  • Update author names in META.yml

  • Add git repo to META.yml

• Updated proftpd (1.3.9e) in F-43, F-44, F-45, Rawhide, EPEL-10.2, EPEL-10.3 and EPEL-10 to fix regression in the handling of private keys formatted using the OpenSSH-specific private key format, and which are not passphrase-protected (GH#2411)

Local Packages

• Updated perl-MIME-tools to 5.522 as per the Fedora version

• Updated proftpd (1.3.9e) as per the Fedora version

• Updated proftpd (1.3.10rc5) to fix regression in the handling of private keys formatted using the OpenSSH-specific private key format, and which are not passphrase-protected (GH#2411)

Tuesday 27th October 2026

Fedora Project

• Updated perl-Error to 0.17031 in Rawhide:

  • t/08warndie.t: Update to handle blead's updated line number tracking (GH#6)

• Updated proftpd to 1.3.9e in F-43, F-44, F-45, Rawhide, EPEL-10.2, EPEL-10.3 and EPEL-10:

  • Insufficient validation of FTP RANG, REST parameters could lead to use of negative file offsets (GH#2286)

  • Regression with custom user/group info SQLNamedQuery in 1.3.9d (GH#2293)

  • Unauthenticated SNMP UDP packets kill SNMP agent due to underflow computation (GH#2301)

  • Stale password-less authentication flag in mod_auth could allow wrong passwords to authenticate (GH#2319)

  • Stack overflow possible via long PASS text in mod_radius module (GH#2330)

  • Error out if configured for SSL/TLS Redis usage, but hiredis library lacks SSL/TLS support (GH#2344)

  • Support using Huffman encoding only for SSH channel compression (GH#2366)

  • FTP TLSv1.3 uploads may fail with ECONNRESET if client does not provide session ticket for data transfer (GH#2367)

  • Selection of median delay value leads to out-of-bounds read on first login (GH#2380)

  • mod_radius does not verify that UDP packets are received from the same address to which UDP packets are sent (GH#2384)

  • mod_ban SysV shared memory segment default permissions allow for local unprivileged user read/write access (GH#2388)

Local Packages

• Updated perl-Error to 0.17031 as per the Fedora version

• Updated proftpd to 1.3.9e as per the Fedora version

• Updated proftpd (rc) to 1.3.10rc5:

  • Insufficient validation of FTP RANG, REST parameters could lead to use of negative file offsets (GH#2286)

  • Regression with custom user/group info SQLNamedQuery in 1.3.9d (GH#2293)

  • Reorder the default lists of SFTP cipher and digest algorithms (GH#2298)

  • Unauthenticated SNMP UDP packets kill SNMP agent due to underflow computation (GH#2301)

  • Stale password-less authentication flag in mod_auth could allow wrong passwords to authenticate (GH#2319)

  • Update default TCPBacklog value as build-time test does not work correctly on AIX (GH#2326)

  • Stack overflow possible via long PASS text in mod_radius module (GH#2330)

  • Error out if configured for SSL/TLS Redis usage, but hiredis library lacks SSL/TLS support (GH#2344)

  • ExecOptions could lead to excessive CPU/memory usage in some conditions (GH#2358)

  • Support using Huffman encoding only for SSH channel compression (GH#2366)

  • FTP TLSv1.3 uploads may fail with ECONNRESET if client does not provide session ticket for data transfer (GH#2367)

  • Implement support for SSH client certificates in mod_sftp (GH#2357)

  • <Limit WRITE> configurations are not honoured for symlinks by SITE COPY as they should be (GH#2374)

  • ftpscrub follows symlinks, can corrupt symlink target file when run as root (GH#2377)

  • ftpasswd follows symlinks, can corrupt symlink target file when run as root (GH#2378)

  • mod_sql default group query uses LIKE without escaping wildcard characters (GH#2379)

  • Selection of median delay value leads to out-of-bounds read on first login (GH#2380)

  • AuthOTPTableLock is never assigned, allowing for possible HOTP counter replays (GH#2382)

  • mod_radius does not verify that UDP packets are received from the same address to which UDP packets are sent (GH#2384)

  • SSH client keepalive GLOBAL_REQUESTs fill the SFTPLog; use trace logging instead for keepalive requests (GH#2386)

  • mod_ban SysV shared memory segment default permissions allow for local unprivileged user read/write access (GH#2388)

  • POSIX ACLs that have group deny permissions are not properly honoured by mod_facl (GH#2389)

  • mod_shaper SysV queue default permissions allow for local unprivileged user read/write access (GH#2391)

  • <Limit WRITE> configurations are not honoured for symlinks by MFMT/MFF as they should be (GH#2401)

• Updated unrar to 7.30 beta 2

Monday 26th October 2026

Fedora Project

• Updated perl-Finance-Quote to 1.72 in F-43, F-44, F-45, Rawhide, EPEL-9, EPEL-10.2, EPEL-10.3 and EPEL-10:

  • Tradegate.pm, Union.pm, XETRA.pm: Added "germany" method to methodinfo hash

  • Sinvestor.pm: Added "germany" method to methodinfo hash

  • OnVista.pm: Added "germany" method to methodinfo hash

  • Comdirect.pm: Added "germany" method, modified parsing for ISIN and WKN values

  • Finanzpartner.pm: Added "germany" method to methodinfo hash

  • Deka.pm: Added user-agent to request, added "germany" method to methodinfo hash

  • Consorsbank.pm: Added "germany" label, fixed name for "Amundi CAC 40 Daily (-2x) Inv ETF Acc" in t/consorsbank.t

  • TreasuryDirect.pm: Every CUSIP returned "Parse error"; note that bid and ask were inverted and have been swapped, and that price now has six decimal places rather than two

  • Added NPSNAV.pm for India's National Pension Scheme (NPS) funds

Friday 23rd October 2026

Local Packages

• Updated perl-FreezeThaw to 1.00:

  • Would fail in presence of multiple references to the same CODE or GLOB reference

Thursday 22th October 2026

Fedora Project

• Updated perl-MIME-tools to 5.520 in F-43, F-44, F-45, Rawhide, EPEL-8, EPEL-9, EPEL-10.2, EPEL-10.3 and EPEL-10:

  • MIME::Parser used O(N^2) CPU time and memory parsing a MIME message nested N levels deep, and a smallish specially-crafted message could DOS the computer by making it consume enormous amounts of memory and CPU time

    • The parser was modified to use O(N) time and memory in this case

    • Additionally, a new MIME::Parser::max_depth() function was added to limit the nesting depth before declaring a parse failure

  • MIME::Parser would ignore multiple blank lines in a message when parsing it; this could break DKIM

  • If a MIME boundary includes trailing whitespace, we mark the parse as ambiguous

Local Packages

• Updated c-ares to 1.34.9:

• Security:

  • Memory corruption when an application cancels its lookups after a connection failure (https://github.com/c-ares/c-ares/security/advisories/GHSA-wpr3-8q3r-4q8c)

  • A DNS reply that arrived from a different server than the one queried could be accepted (https://github.com/c-ares/c-ares/security/advisories/GHSA-fqh5-3x7m-wp44)

  • Use-after-free of a lookup after shutting down a failed connection (https://github.com/c-ares/c-ares/security/advisories/GHSA-97vq-4mxv-7vhm)

  • Use-after-free when an application cancels lookups from a callback, or shuts a channel down (https://github.com/c-ares/c-ares/security/advisories/GHSA-rf6g-ww74-97qh)

  • Use-after-free of a connection after the socket-state callback returns (https://github.com/c-ares/c-ares/security/advisories/GHSA-mw23-pfg6-2x9r)

  • Use-after-free when an application cancels lookups from a server-state callback (https://github.com/c-ares/c-ares/security/advisories/GHSA-v33j-65h4-4ch8)

  • Use-after-free of a server record when an application changes its DNS servers from a callback (https://github.com/c-ares/c-ares/security/advisories/GHSA-pj7p-v3cw-hq66)

  • Use-after-free of a cached DNS answer while the application is still reading it (https://github.com/c-ares/c-ares/security/advisories/GHSA-grv7-fq5q-9vfc)

  • Buffer overflow when 'ares_dup()' or 'ares_save_options()' runs while another thread changes the servers (https://github.com/c-ares/c-ares/security/advisories/GHSA-ph6c-3cvx-mq6v)

  • Uninitialized memory returned for a numeric IPv6 name with a prefix length (https://github.com/c-ares/c-ares/security/advisories/GHSA-cfcv-8v2j-qj6r)

  • The query cache could return an answer obtained using different EDNS options (https://github.com/c-ares/c-ares/security/advisories/GHSA-wrgc-prmw-27xh)

• Changes:
  • Answers served from the query cache now report their remaining TTL rather than the TTL originally received

  • 'ares_inet_pton()' rejects a "/bits" prefix length and returns 0, rather than -1, for any input it cannot parse

  • UDP replies must now come from the server's port as well as its address; custom 'arecvfrom' socket functions ('ares_set_socket_functions_ex()' or 'ares_set_socket_functions()') must fill in the full source address, including the port (for compatibility, a reported port of 0 checks only the address, but such implementations are insecure and should be fixed) (GH#1370)

  • Document that socket functions and socket, configure and pending-write callbacks must not call c-ares functions on the same channel (GH#1360)

• Bugfixes:

  • 'ares_dup()': Don't leave the new channel bound to the source channel (GH#1333)

  • 'ares_init_options()': Don't report the default query cache as a caller-set option (GH#1354)

  • Clamp DNS record TTLs to the signed int range used by public APIs (GH#1313)

  • 'ares_dns_write()': Reject messages larger than 64KB (GH#1314)

  • 'ares_dns_parse()': Accept legacy compressed RDATA names (GH#1326)

  • 'ares_parse_a_reply()'/'ares_parse_aaaa_reply()': Ignore a negative '*naddrttls' (GH#1302)

  • Select event backend: Refuse descriptors >= 'FD_SETSIZE' instead of overflowing 'fd_set' (GH#1312)

  • Strip inline comments from resolv.conf values (GH#1276)

  • Ignore absurd resolv.conf retry/attempts values (GH#1315)

  • Zero-initialize the server config when parsing nameserver URIs (GH#1325)

  • URI parsing: Roll back the ':' probe when it lands past the '@' (GH#1265)

  • Do not assume 'gethostname()' NUL-terminates its buffer (GH#1269)

  • Combine the hash table seed with XOR instead of OR (GH#1330)

  • Turn off stdio buffering when loading a file (GH#939)

  • Guard 'pipe2()' on Apple platforms to prevent unguarded availability warnings (GH#1328)

• Updated java-1.8.0-oracle to Java SE 8 update 511

• Updated perl-MIME-tools to 5.520 as per the Fedora version

• Updated perl-Module-CoreList to 5.20261022:

  • Updated for v5.45.4