SB2026021367 - Fedora 44 update for asciinema, atuin, bustle, envision, glycin, greetd, helix, keylime-agent-rust, maturin, mirrorlist-server, ntpd-rs, rust-add-determinism, rust-afterburn, rust-app-store-connect, rust-bat, rust-below, rust-btrd, rust-busd, rust-bytes,
Published: February 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Type confusion (CVE-ID: CVE-2026-25537)
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to a type confusion error when parsing standard claims in an incorrect format. If a claim is provided with an incorrect JSON type, the application's internal parsing mechanism marks the claim as "FailedToParse" and the validation logic treats this state identically to "NotPresent". If this check is enabled, e.g. "validate_nbf = true" but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim. A remote attacker can bypass authorization checks and gain unauthorized access to the application.
Remediation
Install update from vendor's website.