Linuxsecurity Critical RPKI Update Addresses DoS Risks in Fedora 42 and 43
Article Content
- •rpki-client 9.8 addresses critical vulnerabilities in Fedora 42 and 43.
- •Malicious servers can exploit vulnerabilities to cause Denial of Service conditions.
- •Users must upgrade from rpki-client 9.7 to avoid parsing issues and security risks.
On April 24, 2026, two articles reported on the critical update for the rpki-client version 9.8 in Fedora 42 and 43. This update addresses vulnerabilities that could allow a malicious RRDP or RPKI Publication Server to cause a NULL dereference or an incorrect error exit, potentially leading to Denial of Service (DoS) conditions. The update includes various refactoring for improved compatibility with libcrypto implementations and fixes for HTTP gzip compression detection. Notably, rpki-client 9.8 cannot parse .ccr files from version 9.7, which may affect users transitioning between these versions. The vulnerabilities are significant as they impact the validation of Route Origin Authorisations (ROAs) crucial for BGP announcements. Users of the OpenBSD rpki-client should upgrade to version 9.8 to mitigate these risks. The update was released on April 16, 2026, by Robert Scheck and Fedora Release Engineering.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Fedora in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Exploited Arista Networks has patched a critical zero-day vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users, even those with basic privileges, to escalate their access to superuser status via a low-complexity SQL injection attack. This…