More information about this security flaw is available in the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=2296854 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
By comparing the fix https://github.com/Tencent/rapidjson/pull/1261/commits/8269bc2bc289e9d343bae51cdf6d23ef0950e001 (as referenced in https://bugzilla.redhat.com/show_bug.cgi?id=2296854#c1 and https://nvd.nist.gov/vuln/detail/CVE-2024-38517) with the contents of OpenUSD-23.11/pxr/base/js/rapidjson/reader.h as packaged in usd-23.11-15.fc40, I was able to determine that the bundled rapidjson sources already include the fix for this CVE.