Fedora alert FEDORA-2026-ddaabe38ab (trafficserver)

From:
             
 
updates--- via package-announce <package-announce@lists.fedoraproject.org>
To:
             
 
package-announce@lists.fedoraproject.org
Subject:
             
 
[SECURITY] Fedora 43 Update: trafficserver-10.1.3-1.fc43
Date:
             
 
Mon, 27 Jul 2026 01:12:30 +0000
Message-ID:
             
 
<20260727011230.711267629F@bastion01.rdu3.fedoraproject.org>
Archive-link:
             
 
Article
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-ddaabe38ab
2026-07-27 01:12:03.303800+00:00
--------------------------------------------------------------------------------

Name        : trafficserver
Product     : Fedora 43
Version     : 10.1.3
Release     : 1.fc43
URL         : https://trafficserver.apache.org/
Summary     : Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy server
Description :
Traffic Server is a high-performance building block for cloud services.
It's more than just a caching proxy server; it also has support for
plugins to build large scale web applications.  Key features:

Caching - Improve your response time, while reducing server load and
bandwidth needs by caching and reusing frequently-requested web pages,
images, and web service calls.

Proxying - Easily add keep-alive, filter or anonymize content
requests, or add load balancing by adding a proxy layer.

Fast - Scales well on modern SMP hardware, handling 10s of thousands
of requests per second.

Extensible - APIs to write your own plug-ins to do anything from
modifying HTTP headers to handling ESI requests to writing your own
cache algorithm.

Proven - Handling over 400TB a day at Yahoo! both as forward and
reverse proxies, Apache Traffic Server is battle hardened.

--------------------------------------------------------------------------------
Update Information:

Resolves CVE-2026-59173 - DoS vulnerability in HTTP/2 via stalled flow-control
Additional Changes with Apache Traffic Server 9.2.14
  #12910 - Fix connection-level window mismatch causing 408/504 timeouts
  #13266 - Add Claude Code project guide for the 9.2.x branch
  #13267 - [9.2.x] Backport format scripts fixes
  #13377 - 9.2.x: http2: Track scheduled events
Additional Changes with Apache Traffic Server 10.1.3
  #12192 - Return a 400 on chunk parse errors
  #12733 - Fix retry logic for TSHttpTxnServerAddrSet (issue #12611)
  #12854 - Fix LoadedPlugins::remove crash during static destruction
  #12855 - Fix header_rewrite run-plugin relative path resolution
  #12857 - Fix autest compatibility with Fedora 43 / Python 3.14
  #12943 - Address incompatibility with BoringSSL
  #12959 - Fix crash in HttpSM::tunnel_handler on unhandled VC events
  #12972 - Fix cache retry assert on ServerAddrSet
  #12990 - Update to Proxy Verifier v3.0.0
  #13008 - cmake: limit GENERAL_NAME bssl probe
  #13020 - Align AuTests with latest proxy-verifier checks (#12986)
  #13025 - hrw: Refix loading geodb files
  #13033 - tests/gold_tests/headers tests: use ATSReplayTest
  #13113 - slice: Fix crash caused by use-after-free
  #13114 - Fix bg fill teardown crash in update_size_and_time_stats
  #13138 - Remove cache alternate vector detach
  #13144 - Fix XPACK relative index underflow
  #13162 - hrw: Fix an index bug in run plugin operator
  #13177 - Correct records.yaml record drift
  #13178 - 10.1.x: proxy.config.dns.search_default_domains: allow 2
  #13182 - Stabilize parallel AuTest helpers
  #13192 - yaml-cpp-0.9.0
  #13193 - GCC 16: Regex header integer includes
  #13198 - Fedora 44 test fixes
  #13200 - Single source of truth for Proxy Verifier metadata
  #13217 - Proxy Verifier v3.1.3
  #13218 - Fix hdrHeap/hdrStrHeap allocator inuse metric underflow
  #13220 - Fix flaky Fedora 44 AuTest helpers
  #13223 - Fix mismatched sINT/dINT log field types
  #13252 - cache: apply per-volume settings on first start after clear
  #13256 - Fix mismatched log field types more
  #13261 - header_rewrite: Improve URL Error messages
  #13263 - Fix bounds check in CacheVC::scanObject
  #13264 - Handle OpenSSL without dynamic ENGINE
  #13280 - Enable probes in Fedora C++20 CI
  #13293 - ProxyProtocol: free pp_info heap on NetVConnection recycle
  #13294 - Fix pending HostDB DNS queue removal race
  #13295 - Fix server entry cleanup after request tunnel setup
  #13297 - 10.1.x: Add sni.yaml session ticket overrides (#13006)
  #13303 - header_rewrite: Fix a leak and truncation in set-body-from
  #13307 - dns: destruct HostEnt on free to fix SRV vector leak
  #13318 - TLS: Fix memory leaks in cert load and OCSP stapling
  #13325 - HttpSM.cc: fix cache read end milestone order
  #13336 - 10.1.x: Fix redirected cache write without write VC
  #13365 - 10.1.x: USDT: normalize names for STATE_ENTER
  #13366 - 10.1.x: Fix set-status crash inside if/endif at remap time
  #13387 - Hard-enforce max_active_streams_in at HTTP/2 stream creation
--------------------------------------------------------------------------------
ChangeLog:

* Wed Jul 15 2026 Jered Floyd <jered@redhat.com> - 10.1.3-1
- Update to upstream 10.1.3
* Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 10.1.2-2
- Rebuilt for openssl 4.0
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2501029 - trafficserver-10.1.3 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=2501029
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-ddaabe38ab' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgr...

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------

-- 
_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond...
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/package-ann...
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new