On March 28, the Fedora community received word about CVE-2024-3094, which impacted any instance of Fedora 40 that used repositories outside of the stable branch. The vulnerability is found in the upstream tarballs of the xz application, which is a compression tool that has been around for a long time.

Source: Linux Magazine