Fedora 34.x — End of Life
EOL Actively exploited EOL: Jun 7, 20221 release in this series89 CVEs
Fedora 34.x reached end of life on Jun 7, 2022, 1599 days ago, and no longer receives security fixes. The most recent release in this series is 34. 89 CVEs are tracked for this series, including 3 critical and 2 actively exploited according to CISA KEV. The next major version is Fedora 35. See Fedora 35 →
Fedora 34.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 34 | Apr 27, 2021 | — | Jun 7, 2022 | 34 | EOL |
CVEs affecting Fedora 34.x (89)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-1674 | MEDIUM | 5.5 | 1.54% | — | 34 | NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938.… | May 12, 2022 |
| CVE-2022-29145 | HIGH | 7.5 | 5.43% | — | 34 | .NET and Visual Studio Denial of Service Vulnerability | May 10, 2022 |
| CVE-2022-29117 | HIGH | 7.5 | 5.68% | — | 34 | .NET and Visual Studio Denial of Service Vulnerability | May 10, 2022 |
| CVE-2022-1620 | HIGH | 7.5 | 1.59% | — | 34 | NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901.… | May 8, 2022 |
| CVE-2022-1619 | HIGH | 7.8 | 2.54% | — | 34 | Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerab… | May 8, 2022 |
| CVE-2022-1616 | HIGH | 7.8 | 2.71% | — | 34 | Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashi… | May 7, 2022 |
| CVE-2022-29968 | HIGH | 7.8 | 1.05% | — | 34 | An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kio… | May 2, 2022 |
| CVE-2022-27406 | HIGH | 7.5 | 3.32% | — | 34 | FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the func… | Apr 22, 2022 |
| CVE-2022-27405 | HIGH | 7.5 | 2.82% | — | 34 | FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the func… | Apr 22, 2022 |
| CVE-2022-0500 | HIGH | 7.8 | 0.35% | — | 34 | A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the… | Mar 25, 2022 |
| CVE-2022-0330 | HIGH | 7.8 | 0.38% | — | 34 | A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may r… | Mar 25, 2022 |
| CVE-2018-25032 | HIGH | 7.5 | 51.73% | — | 34 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matche… | Mar 25, 2022 |
| CVE-2022-27666 | HIGH | 7.8 | 5.52% | — | 34 | A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw… | Mar 23, 2022 |
| CVE-2022-1011 | HIGH | 7.8 | 1.16% | — | 34 | A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allo… | Mar 18, 2022 |
| CVE-2022-0778 | HIGH | 7.5 | 73.18% | — | 34 | The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n… | Mar 15, 2022 |
| CVE-2021-3739 | HIGH | 7.1 | 0.61% | — | 34 | A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, whe… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 34 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2022-24512 | MEDIUM | 6.3 | 1.60% | — | 34 | .NET and Visual Studio Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24464 | HIGH | 7.5 | 3.55% | — | 34 | .NET and Visual Studio Denial of Service Vulnerability | Mar 9, 2022 |
| CVE-2022-26490 | HIGH | 7.8 | 0.43% | — | 34 | st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTIO… | Mar 6, 2022 |
| CVE-2021-20322 | HIGH | 7.4 | 6.90% | — | 34 | A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functional… | Feb 18, 2022 |
| CVE-2021-20320 | MEDIUM | 5.5 | 0.26% | — | 34 | A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a l… | Feb 18, 2022 |
| CVE-2022-21986 | HIGH | 7.5 | 3.73% | — | 34 | .NET Denial of Service Vulnerability | Feb 9, 2022 |
| CVE-2022-21293 | MEDIUM | 5.3 | 8.34% | — | 34 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).… | Jan 19, 2022 |
| CVE-2022-21291 | MEDIUM | 5.3 | 2.89% | — | 34 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). S… | Jan 19, 2022 |
| CVE-2022-21283 | MEDIUM | 5.3 | 3.78% | — | 34 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).… | Jan 19, 2022 |
| CVE-2021-44832 | MEDIUM | 6.6 | 97.90% | — | 34 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a r… | Dec 28, 2021 |
| CVE-2021-4166 | HIGH | 7.1 | 1.57% | — | 34 | vim is vulnerable to Out-of-bounds Read | Dec 25, 2021 |
| CVE-2021-4136 | HIGH | 7.8 | 1.96% | — | 34 | vim is vulnerable to Heap-based Buffer Overflow | Dec 19, 2021 |
| CVE-2021-44228 | CRITICAL | 10.0 | 99.99% | KEV | 34 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in con… | Dec 10, 2021 |
| CVE-2021-4019 | HIGH | 7.8 | 1.92% | — | 34 | vim is vulnerable to Heap-based Buffer Overflow | Dec 1, 2021 |
| CVE-2021-3973 | HIGH | 7.8 | 1.78% | — | 34 | vim is vulnerable to Heap-based Buffer Overflow | Nov 19, 2021 |
| CVE-2021-3968 | HIGH | 8.0 | 2.23% | — | 34 | vim is vulnerable to Heap-based Buffer Overflow | Nov 19, 2021 |
| CVE-2021-3974 | HIGH | 7.8 | 1.36% | — | 34 | vim is vulnerable to Use After Free | Nov 19, 2021 |
| CVE-2021-43975 | MEDIUM | 6.7 | 0.55% | — | 34 | In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_uti… | Nov 17, 2021 |
| CVE-2021-3928 | HIGH | 7.8 | 0.63% | — | 34 | vim is vulnerable to Use of Uninitialized Variable | Nov 5, 2021 |
| CVE-2021-3927 | HIGH | 7.8 | 1.70% | — | 34 | vim is vulnerable to Heap-based Buffer Overflow | Nov 5, 2021 |
| CVE-2021-41184 | MEDIUM | 6.5 | 40.76% | — | 34 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option… | Oct 26, 2021 |
| CVE-2021-41183 | MEDIUM | 6.5 | 8.53% | — | 34 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text`… | Oct 26, 2021 |
| CVE-2021-41182 | MEDIUM | 6.5 | 39.36% | — | 34 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` … | Oct 26, 2021 |
| CVE-2021-35556 | MEDIUM | 5.3 | 8.46% | — | 34 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported … | Oct 20, 2021 |
| CVE-2021-41864 | HIGH | 7.8 | 0.41% | — | 34 | prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to tri… | Oct 2, 2021 |
| CVE-2021-41617 | HIGH | 7.0 | 2.54% | — | 34 | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalatio… | Sep 26, 2021 |
| CVE-2021-40438 | CRITICAL | 9.0 | 99.99% | KEV | 34 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. Th… | Sep 16, 2021 |
| CVE-2021-40490 | HIGH | 7.0 | 0.30% | — | 34 | A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux ker… | Sep 3, 2021 |
| CVE-2021-39152 | HIGH | 8.5 | 11.37% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39150 | HIGH | 8.5 | 3.43% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39140 | MEDIUM | 6.5 | 5.91% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39154 | HIGH | 8.5 | 4.73% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39153 | HIGH | 8.5 | 4.45% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39151 | HIGH | 8.5 | 4.73% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39149 | HIGH | 8.5 | 4.73% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39148 | HIGH | 8.5 | 4.73% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39147 | HIGH | 8.5 | 4.73% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39146 | HIGH | 8.5 | 14.29% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39145 | HIGH | 8.5 | 4.06% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39141 | HIGH | 8.5 | 16.11% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39139 | HIGH | 8.5 | 4.54% | — | 34 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-38166 | HIGH | 7.8 | 0.31% | — | 34 | In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when ma… | Aug 7, 2021 |
| CVE-2021-34556 | MEDIUM | 5.5 | 0.41% | — | 34 | In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via … | Aug 2, 2021 |
| CVE-2021-35477 | MEDIUM | 5.5 | 0.46% | — | 34 | In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via … | Aug 2, 2021 |
| CVE-2021-31957 | MEDIUM | 5.9 | 5.13% | — | 34 | ASP.NET Core Denial of Service Vulnerability | Jun 8, 2021 |
| CVE-2021-29505 | HIGH | 7.5 | 77.23% | — | 34 | XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4… | May 28, 2021 |
| CVE-2021-33034 | HIGH | 7.8 | 0.82% | — | 34 | In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5… | May 14, 2021 |
| CVE-2021-23134 | HIGH | 7.8 | 0.37% | — | 34 | Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their pr… | May 12, 2021 |
| CVE-2021-31204 | HIGH | 7.3 | 1.19% | — | 34 | .NET and Visual Studio Elevation of Privilege Vulnerability | May 11, 2021 |
| CVE-2021-25317 | LOW | 3.3 | 0.26% | — | 34 | A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE… | May 5, 2021 |
| CVE-2020-36327 | HIGH | 8.8 | 6.30% | — | 34 | Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem ve… | Apr 29, 2021 |
| CVE-2021-23133 | MEDIUM | 6.7 | 0.47% | — | 34 | A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalatio… | Apr 22, 2021 |
| CVE-2021-3450 | HIGH | 7.4 | 18.33% | — | 34 | The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. … | Mar 25, 2021 |
| CVE-2021-3449 | MEDIUM | 5.9 | 63.54% | — | 34 | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv… | Mar 25, 2021 |
| CVE-2021-21351 | MEDIUM | 5.4 | 82.13% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21350 | MEDIUM | 5.3 | 15.23% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21349 | MEDIUM | 6.1 | 46.82% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21348 | MEDIUM | 5.3 | 13.83% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21347 | MEDIUM | 6.1 | 14.30% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21346 | MEDIUM | 6.1 | 76.36% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21345 | MEDIUM | 5.8 | 72.32% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21344 | MEDIUM | 5.3 | 75.98% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21343 | MEDIUM | 5.3 | 46.66% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21342 | MEDIUM | 5.3 | 49.99% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21341 | HIGH | 7.5 | 77.80% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnera… | Mar 23, 2021 |
| CVE-2021-28972 | MEDIUM | 6.7 | 0.80% | — | 34 | In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolera… | Mar 22, 2021 |
| CVE-2020-27171 | MEDIUM | 6.0 | 0.57% | — | 34 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resulta… | Mar 20, 2021 |
| CVE-2020-27170 | MEDIUM | 4.7 | 0.56% | — | 34 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds spec… | Mar 20, 2021 |
| CVE-2020-11987 | HIGH | 8.2 | 13.28% | — | 34 | Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPan… | Feb 24, 2021 |
| CVE-2020-26259 | MEDIUM | 6.8 | 82.39% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to… | Dec 16, 2020 |
| CVE-2020-26258 | MEDIUM | 6.3 | 81.81% | — | 34 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Fo… | Dec 16, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 34 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
Fedora 34.x is EOL — migrate to Fedora 35.x
Fedora 35.x is the next major release. Plan your upgrade before Fedora 34.x stops receiving security patches.
Add a Fedora 34 EOL badge to your README
Show your users which Fedora version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/fedora/34)Frequently asked questions
Is Fedora 34 end of life?
Yes. All Fedora 34.x releases have reached end of life and no longer receive security patches. There are 89 known CVEs affecting Fedora 34.x, including 3 critical. Migrate to Fedora 35.x as soon as possible.
What CVEs affect Fedora 34?
There are 89 CVEs tracked for Fedora 34.x, including 3 critical severity issues and 2 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Fedora 34 version?
The latest Fedora 34.x patch release is 34, released on April 27, 2021. Always run the latest patch to benefit from all security fixes.
How to migrate from Fedora 34 to Fedora 35?
To migrate from Fedora 34 to Fedora 35: (1) review the official Fedora 35 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Fedora 34 in production?
No. Fedora 34 has reached end of life and security vulnerabilities are no longer patched. Critically, 2 CVEs affecting Fedora 34.x are in the CISA KEV catalog — meaning they are actively exploited in the wild. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA