Back Linuxsecurity

Fedora 43: Critical Advisory for Excessive CPU Usage with chezmoi

Linuxsecurity •LinuxSecurity Advisories • December 26, 2025

Manage your dotfiles across multiple diverse machines, securely. Update Information : Update to 2.68.1

Manage your dotfiles across multiple diverse machines, securely.

* Wed Dec 17 2025 Mikel Olasagasti Uranga - 2.68.1-1 - Update to 2.68.1 - Closes rhbz#2394285 * Fri Oct 10 2025 Maxwell G - 2.63.1-2 - Rebuild for golang 1.25.2

[ 1 ] Bug #2408131 - CVE-2025-58189 chezmoi: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43] [ 2 ] Bug #2408695 - CVE-2025-61725 chezmoi: Excessive CPU consumption in ParseAddress in net/mail [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-28e625afa6' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 43: Critical Vulnerabilities in OpenTofu and chezmoi Fedora 43 has issued critical advisories for two vulnerabilities affecting OpenTofu and chezmoi. OpenTofu version 1.11.2 addresses a memory exhaustion issue, while chezmoi version 2.68.1 resolves excessive CPU usage problems. Both vulnerabilities could impact users managing cloud infrastructure and dotfiles across multiple machines. 2 sources 34

Extracted Entities

Companies (1)

Fedora

CVEs (2)

CVE-2025-58189 CVE-2025-61725