Back Linuxsecurity

Fedora 42 Glow 2.1.2 Update FEDORA-2026

Linuxsecurity •LinuxSecurity Advisories • May 1, 2026

Glow is a terminal based markdown reader designed from the ground up to bring out the beauty\u2014and power\u2014of the CLI. Use it to discover markdown files, read documentation directly on the command line. Glow will find local markdown files in subdirectories or a local Git repository. Update Information : Update to version 2.1.2. This also updates some of the vendored dependencies to fix CVEs, as well as building with the latest golang to fix even more CVEs.

Glow is a terminal based markdown reader designed from the ground up to bring

out the beauty\u2014and power\u2014of the CLI. Use it to discover markdown files, read

documentation directly on the command line. Glow will find local markdown

files in subdirectories or a local Git repository.

Update to version 2.1.2. This also updates some of the vendored dependencies to fix CVEs, as well as building with the latest golang to fix even more CVEs.

* Wed Apr 22 2026 Carl George - 2.1.2-1 - Update to version 2.1.2 rhbz#2457076 - Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160 * Sun Mar 22 2026 Carl George - 2.1.1-10 - Adopt go-vendor-tools * Mon Feb 2 2026 Maxwell G - 2.1.1-9 - Rebuild for * Fri Jan 16 2026 Fedora Release Engineering - 2.1.1-8 - Rebuilt for * Fri Oct 10 2025 Alejandro Sez - 2.1.1-7 - rebuild * Fri Aug 15 2025 Maxwell G - 2.1.1-6 - Rebuild for golang-1.25.0 * Fri Aug 15 2025 Maxwell G - 2.1.1-5 - Revert "Rebuild for golang-1.25.0" * Fri Aug 15 2025 Maxwell G - 2.1.1-4 - Rebuild for golang-1.25.0 * Thu Jul 24 2025 Mikel Olasagasti Uranga - 2.1.1-3 - Set the correct goipath * Wed Jul 23 2025 Fedora Release Engineering - 2.1.1-2 - Rebuilt for

[ 1 ] Bug #2375621 - glow: mapstructure May Leak Sensitive Information [fedora-42] [ 2 ] Bug #2398694 - CVE-2025-47910 glow: CrossOriginProtection bypass in net/http [fedora-42] [ 3 ] Bug #2399375 - CVE-2025-47906 glow: Unexpected paths returned from LookPath in os/exec [fedora-42] [ 4 ] Bug #2399713 - CVE-2025-11065 glow: Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure [fedora-42] [ 5 ] Bug #2407898 - CVE-2025-58189 glow: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42] [ 6 ] Bug #2409367 - CVE-2025-61723 glow: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedo... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-9d0e7df23a' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Glow 2.1.2 Update Addresses Multiple CVEs On May 1, 2026, Fedora released an update for Glow, a terminal-based markdown reader, to version 2.1.2. This update addresses several critical vulnerabilities, including CVE-2026-5160, which was published on April 15, 2026, and involves an update to the vendored goldmark dependency. Other vulnerabilities fixed include CVE-2025-61723 and CVE-2025-58189, both published on October 29, 2025, and CVE-2025-47910 and CVE-2025-47906, published on September 22 and 18, 2025, respectively. The update also includes improvements from the latest golang version to mitigate additional CVEs. Users are advised to upgrade using the 'dnf' update program to ensure their systems are secure. The update is crucial for maintaining the integrity and security of systems using Glow. The vulnerabilities could potentially expose sensitive information or allow unauthorized access if left unpatched. 2 sources 58

Extracted Entities

Fedora 42 Glow 2.1.2 Update FEDORA-2026

The full story

Extracted Entities

Companies (1)

CVEs (6)

CWE Weaknesses (1)