Back Linuxsecurity

Fedora 42: Crucial Restic Security Advisory CVE-2025

Linuxsecurity •LinuxSecurity Advisories • December 3, 2025

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: * Local directory * sftp server (via SSH) * HTTP REST server (protocol, rest-server) * Amazon S3 (either from Amazon or using the Minio server) * OpenStack Swift * BackBlaze B2 * Microsoft Azure Blob Storage * Google Cloud Storage * And many other services via the rclone Backend Update Information : Update to 0.18.1

Fast, secure, efficient backup program.

restic supports the following backends for storing backups natively:

* sftp server (via SSH)

* HTTP REST server (protocol, rest-server)

* Amazon S3 (either from Amazon or using the Minio server)

* Microsoft Azure Blob Storage

* Google Cloud Storage

* And many other services via the rclone Backend

* Mon Nov 24 2025 Mikel Olasagasti Uranga - 0.18.1-1 - Update to 0.18.1 - Closes rhbz#2397204 rhbz2416773 * Fri Oct 10 2025 Alejandro Sez - 0.18.0-5 - rebuild * Fri Aug 15 2025 Maxwell G - 0.18.0-4 - Rebuild for golang-1.25.0 * Fri Jul 25 2025 Fedora Release Engineering - 0.18.0-2 - Rebuilt for

[ 1 ] Bug #2398882 - CVE-2025-47910 restic: CrossOriginProtection bypass in net/http [fedora-42] [ 2 ] Bug #2399561 - CVE-2025-47906 restic: Unexpected paths returned from LookPath in os/exec [fedora-42] [ 3 ] Bug #2408090 - CVE-2025-58189 restic: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42] [ 4 ] Bug #2408687 - CVE-2025-61725 restic: Excessive CPU consumption in ParseAddress in net/mail [fedora-42] [ 5 ] Bug #2409560 - CVE-2025-61723 restic: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42] [ 6 ] Bug #2410511 - CVE-2025-58185 restic: Parsing DER payload can cause memory exhaustion in encoding/asn1 [f... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-65fc438cba' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 42 Restic Security Advisory CVE-2025 Fedora has issued a security advisory for Restic version 0.18.1, addressing vulnerabilities that could affect users of the backup program. The advisory highlights the various backends supported by Restic for storing backups, including cloud services and local directories. 2 sources 22

Extracted Entities

CVEs (6)

CVE-2025-47906 CVE-2025-47910 CVE-2025-58185 CVE-2025-58189 CVE-2025-61723 CVE-2025-61725

Platforms (1)

Fedora 42