ALSA-2026:18134 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633) * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839) * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980) * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015) * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097) * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166) * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202) * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279) * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267) * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275) * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346) * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345) * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405) * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441) * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470) * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866) * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034) * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134) * kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210) * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257) * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320) * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040) * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111) * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210) * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.7.1.el10_2.aarch64.rpm 1c9c9a2f3e584064d564fd84b686f26ca9d795a4db7dc96b89bfff81778fe22b kernel-debug-devel-matched-6.12.0-211.7.1.el10_2.aarch64.rpm 2d26af251230844cfe0aec51aba7bff78c5a4656896587d9ac7968d9fad182e2 rv-6.12.0-211.7.1.el10_2.aarch64.rpm 33221430eea97934d237d15912c20c1e4d10575a8be9132118fa374e9b0037ab kernel-64k-debug-devel-matched-6.12.0-211.7.1.el10_2.aarch64.rpm 3be993682eddabd99c65f2dce437b9053d29d30e86af08021a275db8a0371d5e perf-6.12.0-211.7.1.el10_2.aarch64.rpm 53bec778aa5adf87def8a84ecde89d5bd4c6d764e274e37db7a6b80f7aa96a35 kernel-debug-devel-6.12.0-211.7.1.el10_2.aarch64.rpm 70913ccee40fe7d2af1b3371687e7faf4dd1415038910526943ac39f6cebeb10 kernel-doc-6.12.0-211.7.1.el10_2.noarch.rpm 78db96b63b180a526d27658a5f66bd367e0d516ce72b83b9aa8ec6f642d3b051 kernel-64k-debug-devel-6.12.0-211.7.1.el10_2.aarch64.rpm 7bfe5f750db6ce141dfdeb29d0e424c53620afc35c6d2113db54824072c3dd76 kernel-devel-matched-6.12.0-211.7.1.el10_2.aarch64.rpm 819aa1f0a9d4626d0ac6612f6dcb37463deb88fe3800cb43571fcd5ab5209a7e kernel-64k-devel-matched-6.12.0-211.7.1.el10_2.aarch64.rpm ae103cfadf06b6f80af85b3addecf460d3a4404bc5e2eea3a65b8829435d5024 python3-perf-6.12.0-211.7.1.el10_2.aarch64.rpm c8ad18a6612abe088fc51c27ef49605ac40c22aba2c2a05aa662abb6e1ef6484 kernel-64k-devel-6.12.0-211.7.1.el10_2.aarch64.rpm c9c523a81b22aec6c6c36ea81994d39d119cb20efbee17bd01d5eece534119df rtla-6.12.0-211.7.1.el10_2.aarch64.rpm ccbd6f1e12088a48e33934880374b4b05d30d492338cbce2da17970973341b5e kernel-headers-6.12.0-211.7.1.el10_2.aarch64.rpm fb5fabfd92d96a2c5bf0a54b0e06e87d781feace6120e26c0abb0a4b7e82f390 ALSA-2026:18142 Copyright 2026 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * networkmanagr: NetworkManager File Access (CVE-2025-9615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default NetworkManager-config-connectivity-redhat-1.56.0-1.el10.noarch.rpm 3c3510b6b69347004ae5092b71485721e86928b812cdbbb21a7a13cf2a6cf1ec NetworkManager-ovs-1.56.0-1.el10.aarch64.rpm 50e4dde4e08adb9254b4800f3117a75b1f36512b80f4fe7ce88255f723d5a6dc NetworkManager-ppp-1.56.0-1.el10.aarch64.rpm b9f6c369013bc6022336d1fac5cac109d8330fc1c5f4f14f27d367a768412768 NetworkManager-cloud-setup-1.56.0-1.el10.aarch64.rpm e55aaf3fcde23411a3487915a1f8797f22cad4817bdf6b6e94a296fefd97bca9 ALSA-2026:18143 Copyright 2026 AlmaLinux OS 0 1 Moderate

p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files. Security Fix(es): * p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters (CVE-2026-2100) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default p11-kit-devel-0.26.2-1.el10.aarch64.rpm 4584f7f7b128bdccebf16777474b435d2b56763a56587c3dcaa5833520ae5289 p11-kit-server-0.26.2-1.el10.aarch64.rpm e2b2cc32f7305b38bf9d40b84b9abf6f8fde62d609f1c670395afeb14b94133a ALSA-2026:18160 Copyright 2026 AlmaLinux OS 0 1 Moderate

libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966) * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964) * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965) * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967) * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libssh-devel-0.12.0-2.el10.aarch64.rpm bee69410179120b2d2baf974a4433d2c54693a639d7f4cad2f251e02b4b62910 ALSA-2026:18326 Copyright 2026 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Denial of service in XML parsing (CVE-2025-12748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libvirt-daemon-config-nwfilter-11.10.0-12.el10_2.alma.1.aarch64.rpm 07764e18db84318df689c9ec821a29fabef74f6dd473a32a93376d3d1730bccc libvirt-daemon-kvm-11.10.0-12.el10_2.alma.1.aarch64.rpm 09553c80fc29c2427575d76a9c63deb82925d0f924a6df49f08ecb1db0bd0206 libvirt-daemon-driver-storage-scsi-11.10.0-12.el10_2.alma.1.aarch64.rpm 11baa6ffecc03a4f7a72fda75549d7f60a85008e064fca0a5248f8d462297d01 libvirt-daemon-driver-storage-11.10.0-12.el10_2.alma.1.aarch64.rpm 25a235280103f3909dcad397a66964921c1ae54eea617b44fbe2c127396ba401 libvirt-11.10.0-12.el10_2.alma.1.aarch64.rpm 2bf4f17413a233bef5e8b810df6268ef5cb20da36be7f91fbd837538cf5b3654 libvirt-daemon-driver-network-11.10.0-12.el10_2.alma.1.aarch64.rpm 2d8a7270b901be4ea70602896a4b1967f23ea92a600eafa8459b78b33e67d863 libvirt-ssh-proxy-11.10.0-12.el10_2.alma.1.aarch64.rpm 3c70711dcd90a43c0c03b0db28ea9ca117a0d97932db6c877f76ee0180b8d795 libvirt-daemon-driver-interface-11.10.0-12.el10_2.alma.1.aarch64.rpm 46783b8ae024cb1ff09b13e203678b5b9c93d284d8ed75107a4c6dd9121dd407 libvirt-daemon-driver-storage-core-11.10.0-12.el10_2.alma.1.aarch64.rpm 4b39bf4794f72c43c915c0ed34d6459b2c6abfdcfbcdc8ecd3c5cf17d81ef78b libvirt-daemon-config-network-11.10.0-12.el10_2.alma.1.aarch64.rpm 5e154a85dbbfd500888157dd7de700b14863648a2fd51ff743ca94e8df007f84 libvirt-client-qemu-11.10.0-12.el10_2.alma.1.aarch64.rpm 6a9918c4230021376ca5b4bd15bc518d4cf467549470773456e7c8f011cf7f30 libvirt-daemon-log-11.10.0-12.el10_2.alma.1.aarch64.rpm 72ae636af25e2c1b760940d520de089684b1f5e8d0cff227d91de6c277c42166 libvirt-daemon-plugin-lockd-11.10.0-12.el10_2.alma.1.aarch64.rpm 82e89718536e97f20164151752980680f1e18d22da5b01ce9f060e8841da08c2 libvirt-daemon-proxy-11.10.0-12.el10_2.alma.1.aarch64.rpm 834129f17c012c867e8f65aba57c0e7128e8e589fb2fbf6f631b1ab32ab6ba9a libvirt-daemon-11.10.0-12.el10_2.alma.1.aarch64.rpm 8797b6c27d7e8e093a6f0ee8fb37e4cd2e64193a4d048462b5dd6df38dfb76fc libvirt-nss-11.10.0-12.el10_2.alma.1.aarch64.rpm 98997bbffdb757e2f2e6606216fb9bb2f430a2e9c313fb4c939f1359f1f1f250 libvirt-daemon-driver-qemu-11.10.0-12.el10_2.alma.1.aarch64.rpm 9b684e97aeaea99ca37265bea19761c09dd072d7fe4f3035bd6cc651c8cd68b3 libvirt-daemon-common-11.10.0-12.el10_2.alma.1.aarch64.rpm a3d7b750578c6bc7b7e17037ae13222b9940ba2809a34729d96183c4617ec1ef libvirt-daemon-driver-nodedev-11.10.0-12.el10_2.alma.1.aarch64.rpm a6916988b85b5073eef211fc6ac1d0627113a0d7dc65974d1a355ce580b52578 libvirt-daemon-driver-nwfilter-11.10.0-12.el10_2.alma.1.aarch64.rpm b126b0270cffaea3e5eab8eecdb3bc32402dd1d4c8a9239c65089f7dbd2247ae libvirt-daemon-driver-storage-logical-11.10.0-12.el10_2.alma.1.aarch64.rpm b2b1c8898caadbc03911fa7961ac0cf5a9da05c3a0639156a9c3948a24dfb467 libvirt-daemon-driver-storage-iscsi-11.10.0-12.el10_2.alma.1.aarch64.rpm be81ebedcf5e1a79fa0496f40cea5d76a2b7bebd56878288c95af2482f65b203 libvirt-daemon-driver-storage-mpath-11.10.0-12.el10_2.alma.1.aarch64.rpm bfdaf42dbc62ec505285360cf2863192be16f205770c8d3bcfe4e7371dbd005c libvirt-daemon-driver-storage-rbd-11.10.0-12.el10_2.alma.1.aarch64.rpm c689713994d000cc1198fd41cd828883d89e62ac704f1dd850b5af8c0e0e9bfe libvirt-daemon-lock-11.10.0-12.el10_2.alma.1.aarch64.rpm d06bf26a0b4b61a9bcca56e0ef782aa6c3864289706042f090487ae5b5f777c9 libvirt-daemon-driver-secret-11.10.0-12.el10_2.alma.1.aarch64.rpm d197a63cea1509d6533c284ed9c14b32211f46d03f93d135b0f051ec39a53df8 libvirt-daemon-driver-storage-disk-11.10.0-12.el10_2.alma.1.aarch64.rpm dfe345a7c99264085c7b132b066ac8e0339bbfdb5be4ee23138f6593ea719c09 libvirt-libs-11.10.0-12.el10_2.alma.1.aarch64.rpm eba4a66694de75ff11e35a06bcb345f38f6789636cf5d75825b0aab46b3b8998 libvirt-client-11.10.0-12.el10_2.alma.1.aarch64.rpm f51a43978f4fd7e52a5a070d6ace9f9de9c6d8bd0b5685c81a799c4c5ca256e9 ALSA-2026:18421 Copyright 2026 AlmaLinux OS 0 1 Moderate

luksmeta security update

LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default luksmeta-10-1.el10.aarch64.rpm 6e868b38171e802a98eebefdd385ae2d144bb16e2183723b13ecef5d86f83fb4 libluksmeta-10-1.el10.aarch64.rpm ea084cd0d1d1192df7debc68425819ba5ef048308f237c87ff0f85dba51bd288 ALSA-2026:18465 Copyright 2026 AlmaLinux OS 0 1 Important

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: EDK2: Improper Input Validation allows arbitrary command execution (CVE-2025-2296) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default edk2-aarch64-20251114-5.el10_2.noarch.rpm 661e753247f1f87f60b2ab15a15e98b65bd5218f23543c33c5087b94428cc7aa ALSA-2026:18479 Copyright 2026 AlmaLinux OS 0 1 Important

qemu-kvm security update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694) * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696) * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692) * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699) * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695) * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default qemu-kvm-block-curl-10.1.0-16.el10_2.alma.1.aarch64.rpm 31f3b926435e3c2e527c1f91b280beb47eeb21a1835edd532b7c8f61f7d9a632 qemu-guest-agent-10.1.0-16.el10_2.alma.1.aarch64.rpm 38b8a361b0b6399d4ba15276834092e9a10b6acee39f30ee09978344b347c0f2 qemu-kvm-device-usb-host-10.1.0-16.el10_2.alma.1.aarch64.rpm 40541f87c632d6ad215112d5c01d8effe288343fb2143369069f0ee1654bc954 qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.alma.1.aarch64.rpm 40727c8dfa9b582a7e33845dfa71354a9c6e2665e7e5f544a426d9b419a25a69 qemu-kvm-audio-pa-10.1.0-16.el10_2.alma.1.aarch64.rpm 5c2ec485f04562b5309184b534e0121b58b1e9dbfb2027400e2e3de6c24baeba qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.alma.1.aarch64.rpm 5e54ac24fde7edfcb5371c29a08b12943201fa69494162f73e986dadfa5d729e qemu-kvm-10.1.0-16.el10_2.alma.1.aarch64.rpm 5f57da9510d01e86aef483d8f0d5b57a6876ebd42bd287c992fe4a9e926deaad qemu-kvm-block-blkio-10.1.0-16.el10_2.alma.1.aarch64.rpm 704c6a6265104281f690c9d76a500be6e47efa23d8da8bcfe10f561c4ecfa2bc qemu-kvm-tools-10.1.0-16.el10_2.alma.1.aarch64.rpm 870acad5d7ba5af50a08e946fcf281dc4c5674225fe42881d7afdef4e6bdf776 qemu-kvm-docs-10.1.0-16.el10_2.alma.1.aarch64.rpm 8e46414ac60910f7e35167feef14b576dbf7c0e57f151c530f7e2afb70bbab21 qemu-kvm-core-10.1.0-16.el10_2.alma.1.aarch64.rpm ab125ace2853908077dc7a4864c0eb09798edd56711eb65d796ef6ce552c4bc5 qemu-kvm-common-10.1.0-16.el10_2.alma.1.aarch64.rpm ac15bde0a4ec061d79c1d59a55a20580a504a4c8f62f2821a489191b1f7792e4 qemu-kvm-block-rbd-10.1.0-16.el10_2.alma.1.aarch64.rpm b206a2e184c68aaa49ec7bb0712ca6d1158ea091273c9f54fb18fc65848e0ad8 qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.alma.1.aarch64.rpm c92fb00063f0a973ce0229fb42316a56e74d3323fb633688abcb7d9059db4202 qemu-pr-helper-10.1.0-16.el10_2.alma.1.aarch64.rpm d6f2fc3603612ad547d6c1ec5bd666d7f7e615b533a170e0b6d97786078c49f8 qemu-img-10.1.0-16.el10_2.alma.1.aarch64.rpm f32dc609e54a27b644fa98935ee831fc413d733c506e793c54f83512cb0c530e ALSA-2026:18556 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: DNSBomb vulnerability (CVE-2024-33655) * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default unbound-dracut-1.24.2-7.el10.aarch64.rpm 25a60fc8d76354c6c91ea80d2c32d289206acac0bfe33e1c299b686696bec419 unbound-1.24.2-7.el10.aarch64.rpm 46c109c7834c165f57bb703390d7a70a30c2cb78ecc33a525449895b7f7bcca5 unbound-utils-1.24.2-7.el10.aarch64.rpm 77213746f903deb0ccd3315f2224d6261a57eda4ba39a4fe803ddec88bb70d82 unbound-libs-1.24.2-7.el10.aarch64.rpm 9e1d43dff34243008ee802c9cfd18d0bad138f0a95f75412650b0cbc0cb269e5 python3-unbound-1.24.2-7.el10.aarch64.rpm c3a6de05f5c55b5fb43070e16fcf6a61e90cdd49fea2231ddcae75fd0e406fd0 unbound-anchor-1.24.2-7.el10.aarch64.rpm f48c140fef50fdc53ef5b32a0b743fa8b9a303dba403f3adce096d904c605505 ALSA-2026:19009 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007) * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003) * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postgresql18-upgrade-18.3-1.el10_2.aarch64.rpm 0432c529126ebdbb03b0f83db1127d5bd824d914cbf993cdecdcbc64376777a1 postgresql18-upgrade-devel-18.3-1.el10_2.aarch64.rpm 1a9e64a245503bfabe4050ab2620b75e1f5c8de28ae70e767dee57ec4ec95f2e postgresql18-docs-18.3-1.el10_2.aarch64.rpm 20b6a8d513ff57c09f68bfe8fd7c9f55e50315bcbe7151fb0a655bc5b6a74e4a postgresql18-server-devel-18.3-1.el10_2.aarch64.rpm 397896c6943ff2252c87d25831488a87be5f886dc2ad5ada5448bede35f43a7b postgresql18-contrib-18.3-1.el10_2.aarch64.rpm 47bb032be38775efda0e373fae11fea9412b761b69595a4c99b10c4945df1299 postgresql18-server-18.3-1.el10_2.aarch64.rpm 681a790880e855b70e3ef89b2e078a2dd66c2d8beb36e0848a0a925e6a224a3d postgresql18-private-libs-18.3-1.el10_2.aarch64.rpm 8572eb840e7ca21490c65e08fb814156827efccdbd2c947d22211a9f5fc36500 postgresql18-plperl-18.3-1.el10_2.aarch64.rpm 9a0746ca59985d2cf3a3a5500a273c86ca6a71b97b693767af89795c6d330e52 postgresql18-test-18.3-1.el10_2.aarch64.rpm c5c6131e65af35d84a6be70f8e571c0515b5f268790a5534deed9aa3c06f4a54 postgresql18-18.3-1.el10_2.aarch64.rpm d622a49ef7d28da22d4b4e890bc0241b92967c91c05e4a2b2b78f0b96fc2bf78 postgresql18-private-devel-18.3-1.el10_2.aarch64.rpm da9f7b712572ced37370e430b51bb4ee8228fabc1bd19f4fb314fbdb31e04fa7 postgresql18-static-18.3-1.el10_2.aarch64.rpm df6bcbcdacfd11f63eb9b696206c7dfc01136ed1566d1fd77e894a4cc823aa27 postgresql18-plpython3-18.3-1.el10_2.aarch64.rpm fbc9156b819619438dde3c696786b3e387531df2b829917016de5666c666d00d ALSA-2026:19010 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003) * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postgresql-contrib-16.13-1.el10_2.aarch64.rpm 1285c003f975992d232d345b2ad8387409a666d212e6597a9a60aa7cc1c19805 postgresql-private-libs-16.13-1.el10_2.aarch64.rpm 3125a032cd74b7d540471ad1f5e11d4910cd2d139322dce139d5e6735291497b postgresql-upgrade-16.13-1.el10_2.aarch64.rpm 69c191ab0ebb206c0f6471f0e7647932e27d6f6aac93fa3320aa131c35b9d211 postgresql-server-16.13-1.el10_2.aarch64.rpm 6ae183890413916abda228f2882a8b1cfae8d914811bd476fd1d5b52287f2284 postgresql-docs-16.13-1.el10_2.aarch64.rpm 8a01b4ba1ecba2f66badb10b749a9efc23445a87cbce78d40f9e4f045d872f40 postgresql-private-devel-16.13-1.el10_2.aarch64.rpm 935905d11b39c8588901d88b5f1ac051c3724624bea8edd6bdc2a926ec743e33 postgresql-pltcl-16.13-1.el10_2.aarch64.rpm 93edd9e2435b6ec27807358d03b6fcd7c6ffc8b6544f7518e857613e4c2db946 postgresql-server-devel-16.13-1.el10_2.aarch64.rpm a953ac7141dd4884bfcff9350e384ef0548d6079efc209a8cb95da870768fad4 postgresql-16.13-1.el10_2.aarch64.rpm ba7c6847b44292219f01bad703a0d70025474148bafe8510306afeb42aa09032 postgresql-upgrade-devel-16.13-1.el10_2.aarch64.rpm bff4fe2ccaa68d609563e994e361a6e3b84f20751154e776618c85844dca802b postgresql-plperl-16.13-1.el10_2.aarch64.rpm c01751b450ed23d05a5ead62ca9e31f13cf0103feb66a8388b8dea3a9ce5bed8 postgresql-static-16.13-1.el10_2.aarch64.rpm ce9ca0dbb4cd68c50ebc85820abc1d1b51ca8e4a667721d3be2f49c25d0e647e postgresql-test-16.13-1.el10_2.aarch64.rpm f199782e00229099ca2df2bd8b0cd624d975bb8a358c71e99ea8ca535171a650 postgresql-plpython3-16.13-1.el10_2.aarch64.rpm fe888a8c116e1fe146ff38dca4c69f588d9bc03f637709a1ca9a2e5e9821fe7a ALSA-2026:19013 Copyright 2026 AlmaLinux OS 0 1 Moderate

delve security update

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default delve-1.26.1-1.el10_2.aarch64.rpm 44b03d793bd9018c3834389dbcb5bf667707d1cb211d18a58a1027cbddb4e475 ALSA-2026:19017 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default podman-docker-5.8.2-1.el10_2.alma.1.noarch.rpm 167be1b8d65574dac9045abe3e1e0b9208ed8e6c2c2c8b29b83d77c4173a468f podman-remote-5.8.2-1.el10_2.alma.1.aarch64.rpm 84cc7f1c65163224e330b100a49eef82fa7cc88267fc809bc8afe96fb2e178f6 podman-5.8.2-1.el10_2.alma.1.aarch64.rpm e0070cfebb1ec07a28055bae8f8299b34ded76eceaf8b45c9b0e1eb77548748d ALSA-2026:19019 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3.14-libs-3.14.4-2.el10_2.aarch64.rpm 3c7dccb2852b6ce479752a5fed767e55b320381e1795782b855ad518f697e002 python3.14-devel-3.14.4-2.el10_2.aarch64.rpm 3ee13eaf39933e4036bfa9a1ae8878e4205a8fc3623537fde113ad0094bdc5f9 python3.14-3.14.4-2.el10_2.aarch64.rpm 5bc6b97767236cab468e0266d93e8d2b67ea29a10f889a35819baafe64112c40 python3.14-tkinter-3.14.4-2.el10_2.aarch64.rpm d0465691ba1104972ed8c725bc54299ddc1959f1630c4cf405f98f1ae34a046c ALSA-2026:19020 Copyright 2026 AlmaLinux OS 0 1 Moderate

crun security update

crun is a OCI runtime Security Fix(es): * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default crun-krun-1.27-2.el10_2.aarch64.rpm 62f9a7e2aa2f4ffbb2066fbfc3cc2f539986968ea60cafa3e5cf5a66bb5781af crun-1.27-2.el10_2.aarch64.rpm c037689372b57c830efa3bf4539164a001dcdd20aa270950b4f8c0a7f0ae8257 ALSA-2026:19022 Copyright 2026 AlmaLinux OS 0 1 Important

golang security update

The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default golang-bin-1.26.2-2.el10_2.alma.1.aarch64.rpm 10517947b4ccdd648d4875b6199863bda3d9ed68d1f453d62652e99e84c737f3 golang-tests-1.26.2-2.el10_2.alma.1.noarch.rpm 86ddbd7f00012fa580ea1c9edb33d9e5982eef71b38e0283ad2659fa61352095 golang-1.26.2-2.el10_2.alma.1.aarch64.rpm 978a7b0420f8df11922784015e19003f90c450d373c3e859e17b953de489e2cd golang-docs-1.26.2-2.el10_2.alma.1.noarch.rpm a7b9810b608f99d1d4e8dc8771e6e1493f6f39113e88f56ae83bd92548afe904 go-toolset-1.26.2-2.el10_2.alma.1.aarch64.rpm b04696d856be18a801c6de5901cdd40eaa2cb8e800322416eee5a1dd6de17273 golang-race-1.26.2-2.el10_2.alma.1.aarch64.rpm b465e141816fe1cd7a24dc41caee130e86f0c81b371e3da729999ecd457ebab0 golang-src-1.26.2-2.el10_2.alma.1.noarch.rpm dbf8e7996f83be39afa1954de0ab45d661a96b356a3e406a1960cd6be572a7bb golang-misc-1.26.2-2.el10_2.alma.1.noarch.rpm ff930bc6ddd8d4469f1e7d1cab514142b71eff36da84ce419045251ce79e3e17 ALSA-2026:19024 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.aarch64.rpm 8a4c6dae428b36e7d22cb12b490b5945dc938179f88cda5883724a9db86016f3 gstreamer1-plugins-base-1.26.7-2.el10_2.aarch64.rpm 91c555636787b17a48fdbf40adcda77ead5e4a2f1352eca122e8c1c1869860a0 gstreamer1-plugins-base-tools-1.26.7-2.el10_2.aarch64.rpm a64a7974876c46b5c32731cd5abd28ff90a2b2b1332ca988c53d294a7e7ab435 gstreamer1-plugins-bad-free-1.26.7-2.el10_2.aarch64.rpm a7ede6dace10cfe6430df71df838f69d02f5a254ad276bb524bc7889091d061d gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.aarch64.rpm bc672d748a7ba7c36080d163b35b3547219d9368060b56861d3cde430934323c gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.aarch64.rpm d1047d76599f7ad1116fd145242d8e4c13034042e7fbc35b7243e893a427b96d gstreamer1-plugins-base-devel-1.26.7-2.el10_2.aarch64.rpm f892174eb9b251b9c57bec3b6b6087dbbf36a5120ed0436de77358f7d952e0b3 gstreamer1-plugins-good-1.26.7-2.el10_2.aarch64.rpm ff967cc6815983df83ab926b9254e95bb317bf77cf8fa1e42273d17e9d0b4b91 ALSA-2026:19031 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default skopeo-1.22.2-1.el10_2.aarch64.rpm 09ce6c634e9b34f675770c4acb74dd94ed61b8e0f92e8f857db7cb39dd02db3e skopeo-tests-1.22.2-1.el10_2.aarch64.rpm 2a1e46e49dc91ed4419a432ef7348f8d98d9cc619d05860c6e274f702d29e30f ALSA-2026:19032 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default buildah-tests-1.43.1-1.el10_2.aarch64.rpm 96179571d794941857532dbbb2d6a2ee848e583246d00d32b1a5387d0c982529 buildah-1.43.1-1.el10_2.aarch64.rpm ddaf6c1dbcd0056e2cff91eff3a140be5faf49f1dc160781990fe146f24c17f4 ALSA-2026:19034 Copyright 2026 AlmaLinux OS 0 1 Moderate

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958) * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-tornado-6.5.5-1.el10_2.aarch64.rpm 2c7978345b875f667e1ef6d83fe3c9cd5446d27328df86a8726258330b720984 ALSA-2026:19042 Copyright 2026 AlmaLinux OS 0 1 Low

python-jwcrypto security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-jwcrypto-1.5.6-5.el10_2.noarch.rpm db89aecbcd378aa983e05761a6b2cbca01c3a05e38a708730a9029e277498a12 ALSA-2026:19043 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default corosynclib-3.1.10-1.el10_2.1.aarch64.rpm 5867f003f9fd32f9035dbccf0e1f413065abbf96bf9b34e8b32c8f745a46d65f ALSA-2026:19053 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default freeipmi-bmc-watchdog-1.6.17-1.el10_2.aarch64.rpm 4d080158186e7abd390da391ab0ab0d20220e159a6abeaeb7ca864544169d478 freeipmi-ipmiseld-1.6.17-1.el10_2.aarch64.rpm be5e247f994124ea4b2df4b2cb81eed1a01a6c7241e2545515cf39431a9220dd freeipmi-1.6.17-1.el10_2.aarch64.rpm bfad0d0b21775235afcfd9df67dfe3d6129e5465bd5f8e7e1981d277cd5c7496 freeipmi-ipmidetectd-1.6.17-1.el10_2.aarch64.rpm e93376bb2c447d93868b7732241997ef1e38ff4e6bfa37ca45c8572c3d51fce9 ALSA-2026:19054 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm 032f9dfd26c60d1d72b363ff2061d11662e957528f62a47531f5bbf5f865b387 tomcat-10.1.49-1.el10_2.1.alma.1.noarch.rpm 30074a00cdb2fd116e1a86d0dd4fde4c0ee1ad6c1d76871cede1af36c10ad784 tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm 910908c4cbeb19192b15b52ff7bcb553a79de45a9fd931d50fa458956364dc8c tomcat-el-5.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm a4ea29cfcc7dc0b39309a55f0cb9f6825d1b6965da13f87f41af81d7293301e1 tomcat-lib-10.1.49-1.el10_2.1.alma.1.noarch.rpm bf8d00201d00c1d371bcb29fde0b79354efbec1bdd757baaebc03477a5d83d5c tomcat-docs-webapp-10.1.49-1.el10_2.1.alma.1.noarch.rpm cd1899698b4ef517e177bafdcbdb1e1542a1f0c867d8b7fefb87b3e46b4b54bf tomcat-admin-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm d5a2b5453e34039aa491637abe23194a845e0a52cb69be855ed09fbc360ed9f7 tomcat-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm fdbfa914a61bc11297a055cca8ba8bb8c9d37d90b771583e8b8b87d3a7a388c7 ALSA-2026:19061 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437) * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glibc-utils-2.39-121.el10_2.alma.1.aarch64.rpm 2adea958ac42744f4f21b1922d1a499b98ae22d99ce577edddcf30896e65e96e glibc-doc-2.39-121.el10_2.alma.1.noarch.rpm 8e5944044c77883ffcdf699a95b72c6bb5ec1b40fe769362ba84948c5c446f4b glibc-locale-source-2.39-121.el10_2.alma.1.aarch64.rpm d673536f673f49223065ee6278aa81790b3f606cfb4714cb2685fd022be516d8 glibc-devel-2.39-121.el10_2.alma.1.aarch64.rpm f11f95b9c7e493ceb00ad1b63fc7d7717a67f659cc09fde30d6754793320c132 ALSA-2026:19064 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) * cpython: Out-of-memory when loading Plist (CVE-2025-13837) * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282) * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-tkinter-3.12.13-2.el10_2.aarch64.rpm 17a97747c5927a405a3fd8bb8c227219a8fd9e1e7a571b84ec62b1b7cdd3282b python3-devel-3.12.13-2.el10_2.aarch64.rpm 729c5697760fd1f647f6fe2eeeeb64710539c2ac135cab66850d4ebc93b6baf2 python-unversioned-command-3.12.13-2.el10_2.noarch.rpm e02dd9af1061d81e9eb4f3b2ab2cee1f8bcaa3917c0c834b9885fbcb4199da2e ALSA-2026:19066 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssl-perl-3.5.5-2.el10_2.alma.1.aarch64.rpm 84e7a9e21e1cf01ac232cfea5f80f087e99897db65b476c27ebadf0bfb9309bc openssl-devel-3.5.5-2.el10_2.alma.1.aarch64.rpm a551188784f30306cb82194ae77e2ebb258dee1795cabf18bd650e9a8fe2db5d ALSA-2026:19067 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Privilege escalation due to failure in privilege drop calls (CVE-2026-35535) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-4.p2.el10_2.aarch64.rpm fe347d6b8ac6d4aa078e52a03e73ef6b6a01b44f3b6518fe78a66f45291ad47c ALSA-2026:19068 Copyright 2026 AlmaLinux OS 0 1 Moderate

systemd security update

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default systemd-devel-257-23.el10_2.1.alma.1.aarch64.rpm 57ceadcfa380643c469c6ee81718794211cb09ce67ea403eef3280e425361ce3 systemd-ukify-257-23.el10_2.1.alma.1.noarch.rpm b19a2e5d5ceb000880e9a0b2e332123c6cc5f6052003d8b27a6230bc528bca3a systemd-boot-unsigned-257-23.el10_2.1.alma.1.aarch64.rpm f02dcf90f0a1ae8924de2797dbb9e6123da750c84104b4fe81cb0b2fd950d19e systemd-journal-remote-257-23.el10_2.1.alma.1.aarch64.rpm ffb28981731304ca172c0b44a8bc23ae64d22da988ae5c361fbc24749362e63b ALSA-2026:19069 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode (CVE-2026-35385) * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414) * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage (CVE-2026-35387) * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388) * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssh-askpass-9.9p1-23.el10_2.alma.1.aarch64.rpm 36cb78f50b38c78b4f371e405964108200b9a177376f770a8c4e9ba37f2ec067 openssh-keysign-9.9p1-23.el10_2.alma.1.aarch64.rpm 6902e2f0d86969278e41b2f6d3c7a8c1da995cc14c056e68f3f8aabc2975c31c ALSA-2026:19073 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default vim-common-9.1.083-9.el10_2.2.aarch64.rpm 0de76b4a89ccac13894fa5e1974802dc5cb1e0fa01d437541da15a5247a28a8e vim-X11-9.1.083-9.el10_2.2.aarch64.rpm 2f4a1ae9d6ec7480a0b5b690e3b5a5565d4d3ab1c8f6fe165bc18f99d9654af0 vim-enhanced-9.1.083-9.el10_2.2.aarch64.rpm 44d52062784c27391f94353e8d0c573602e0eea8fc1752f413d00598f038cf11 xxd-9.1.083-9.el10_2.2.aarch64.rpm ed849d70ddfe54013db5e97f78e6bd38675234f7e6215eed08839ffaa88203ec ALSA-2026:19074 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677) * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-debug-devel-matched-6.12.0-211.7.3.el10_2.aarch64.rpm 01f9c87a46967bc465549823ca5fca83a6d1bd5c24b3ea7393080ddd5dfbe2c3 kernel-devel-matched-6.12.0-211.7.3.el10_2.aarch64.rpm 060f163d9f766169e80af7a210190d002f3a307fa9ffe60876d15c7fbc7a012e kernel-headers-6.12.0-211.7.3.el10_2.aarch64.rpm 07b8a806ddfd1d1a679af9e4bcf14ddba6ad034744a418862544aec49589257b kernel-debug-devel-matched-6.12.0-211.7.3.el10_2.aarch64.rpm 085f816f3035346a8dab97ca0dc8fb83325f9e5ccb42f1b024597b50d023d64f kernel-doc-6.12.0-211.7.3.el10_2.noarch.rpm 2a68239ba7e1ffded8f59859942aad0efdfdc10912c47834975a6dd22a799961 rv-6.12.0-211.7.3.el10_2.aarch64.rpm 3e830b6b51311ff2f66e76131c0091011032a4835c37164dd6978afe3738db8a kernel-64k-debug-devel-6.12.0-211.7.3.el10_2.aarch64.rpm 4619cf0fc879082640a2d32578c7f32221f2e636d90ad66f5dd1533a3c1d31e6 kernel-64k-devel-matched-6.12.0-211.7.3.el10_2.aarch64.rpm 531bddcfdb57eefb2eae6771a5caf256170af5482277f63d30727e34c2b9579c rtla-6.12.0-211.7.3.el10_2.aarch64.rpm 92380bd8cf6018f063479185f44e5677c297b620adf9f983f63261e5893bf147 kernel-devel-6.12.0-211.7.3.el10_2.aarch64.rpm b4192494064990db9ae95b2b269de2542e24a39fdb424aa596227d52ffd17ad5 perf-6.12.0-211.7.3.el10_2.aarch64.rpm cc4821231929687d89d617e11794344893010b2ccc354ea85fcffb46c391c0db kernel-debug-devel-6.12.0-211.7.3.el10_2.aarch64.rpm cfb0cb2b0743349e8d30276862f6293b1237381deefaf85fa2a1b2e3bf02c12c kernel-64k-devel-6.12.0-211.7.3.el10_2.aarch64.rpm de0e66785715938dc006d0ffa5e3a979d36366761f34fda2d7052fa1676fd180 python3-perf-6.12.0-211.7.3.el10_2.aarch64.rpm fe6fedbfecb29892b8157c6c8a393e4596c2eb8494f8cfe1609f72041f963583 ALSA-2026:19125 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.aarch64.rpm 532dd7e367ef3edb5f7cc9458dfdf74e4cf393f20e88d6b6338a812421bb775f ALSA-2026:19126 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default yggdrasil-0.4.9-4.el10_2.aarch64.rpm ec2a13fa71a6927a72a0f8b7dda2ee6fa2416c8af76d3c954115d762c795081e ALSA-2026:19127 Copyright 2026 AlmaLinux OS 0 1 Important

gdk-pixbuf2 security update

The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. Security Fix(es): * gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gdk-pixbuf2-modules-2.42.12-4.el10_2.5.aarch64.rpm 06e125167675d351940ba3746a864c5caea6150cbeeba7d6f4ab6fa8b36fe515 gdk-pixbuf2-2.42.12-4.el10_2.5.aarch64.rpm 5a876679b0f43e0966e7226ed5f21ba1f4cbea5342f9d73f5c826c15d0e51330 gdk-pixbuf2-devel-2.42.12-4.el10_2.5.aarch64.rpm b9a71fe0c897fadd69514b1210562b904a916e031d37149a9440013284f9d9ff ALSA-2026:19128 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-6.el10_2.aarch64.rpm 3f1e8c48eabdc01d6979e11eb3916bfa8936400a681ccb2fcdf10b35ab59a880 ALSA-2026:19130 Copyright 2026 AlmaLinux OS 0 1 Important

libcap security update

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities. Security Fix(es): * libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libcap-devel-2.69-7.el10_2.1.aarch64.rpm ce239618bdb70ab5c7493e799eff383abf6c97613bb46ddd785d0694ae4aa684 ALSA-2026:19133 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default git-lfs-3.7.1-4.el10_2.aarch64.rpm c561f0819a132561e9c3b82228db46ea8dd92b2e1c75cbc73673f3fea7b61cf9 ALSA-2026:19134 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default grafana-selinux-10.2.6-26.el10_2.aarch64.rpm 71293f3a5340fd4cce3a18e67a9e89dec028b4dae0d1ba374821cbed66f01cfb grafana-10.2.6-26.el10_2.aarch64.rpm d76394f7efd931419ccf885e66e7bf4ec662b1f6ebced6bcd1d499be6d77cd42 ALSA-2026:19135 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default opentelemetry-collector-0.144.0-2.el10_2.aarch64.rpm 1c2e7fa4b12f5f208f9dfdbf70e2300e614008bd17acd197a7bc82c96ee01ad9 ALSA-2026:19136 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default grafana-pcp-5.3.0-5.el10_2.aarch64.rpm b4e919c4af11f775756c61cf15838f6d6eb1b85993cdd9fd1dcfbc2b215b73bf ALSA-2026:19137 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default go-fdo-server-rendezvous-1.0.1-1.el10_2.noarch.rpm 2f723b54c36ddf004e4bea960e425128bf2d983f8a3113e157997f07bad4fa7a go-fdo-server-owner-1.0.1-1.el10_2.noarch.rpm 4fdde5d0f325c9777d1a0493b93f5f958290c8b3b8c46095516d2e7e8ea2d03e go-fdo-server-manufacturer-1.0.1-1.el10_2.noarch.rpm 503719bae2e16f1ef8bfb6389d8210cb55c14a40a4f7f7f00e40c82bfd1f8095 go-fdo-server-1.0.1-1.el10_2.aarch64.rpm 5ab498e6933546fa79e2c6c9fe41f8d907a2d9b00a4e5cea62c56b5002b17c76 ALSA-2026:19139 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fix(es): * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default go-fdo-client-1.0.0-3.el10_2.aarch64.rpm 0e286fc6e327114aa9ea5eb91bae8a539366730f7ce610d384a4581d758f8569 ALSA-2026:19141 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default PackageKit-gtk3-module-1.2.8-8.el10_2.aarch64.rpm 3935e84f01f16ecc5b470f00abed750421ea6d7b9e594d1747da2877ead894ff PackageKit-1.2.8-8.el10_2.aarch64.rpm 44953839ad0f43174ea381f7c5dcf6563977a446254d3d76b3a35440db486c58 PackageKit-command-not-found-1.2.8-8.el10_2.aarch64.rpm 722234620a375b34637f38b7b67ff4ebd6e354e304a7a19d7bc1a01271580016 PackageKit-glib-1.2.8-8.el10_2.aarch64.rpm 8c09fcc9c39f0a96dde5c653c37b8e16c1b3bd63283c02490fe94cae7d081941 PackageKit-gstreamer-plugin-1.2.8-8.el10_2.aarch64.rpm 9967bcb1d3c9e3a6dfe0f8cbcd2a6f2329f6289b2e1a8c5fd54314af6b0ac0c1 ALSA-2026:19143 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271) * libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libsoup3-devel-3.6.5-3.el10_2.11.aarch64.rpm 46359728033ef7db7509616de8fdd1c9db9ac7f54aa114f4b3b40b48a5166551 libsoup3-3.6.5-3.el10_2.11.aarch64.rpm fa5bbb6b86369a81fd38e5c62517f82e9bc75e80f11188861e60d99d38e7e7bc ALSA-2026:19145 Copyright 2026 AlmaLinux OS 0 1 Important

krb5 security update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). Security Fix(es): * krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356) * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default krb5-devel-1.21.3-10.el10_2.aarch64.rpm f5c5d16fdc0f9921f40fa48c89a561db089ac4c39bb78917d27768d4e00c9dd2 ALSA-2026:19146 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openexr-3.1.10-8.el10_2.2.aarch64.rpm a0a9c7dffff5f30611de5e17c4a36ee19d556d5f2c842d32cc6d7b4736f4abc4 openexr-libs-3.1.10-8.el10_2.2.aarch64.rpm eaff9ccb4d34fef3d3fe71166f46dfee0a0c998da4763f3c2ebea1a4f47a4cc1 ALSA-2026:19148 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.13.aarch64.rpm 7d2d0bd510d0dc18bf5b3b93771c868223ac4a6b99e2b34ac796cde927907de2 glib2-devel-2.80.4-12.el10_2.13.aarch64.rpm 8a42752fbb5b9efb6ae7712cec334c1a1edfa7d95aa2c4831c0d9bb1f30f3b9c ALSA-2026:19149 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dovecot-pgsql-2.3.21-19.el10_2.aarch64.rpm 21e68865ac13af9dc8a413cc68a52aa9fd391202f342a076925efe1af2c14d46 dovecot-pigeonhole-2.3.21-19.el10_2.aarch64.rpm 497cdb974c42021e175fe0a860b684b82f43c151e7577afcb786102b72837241 dovecot-2.3.21-19.el10_2.aarch64.rpm 81502aeb657b25edcb2bc6983c889c6d786d98a592b9df521c84e3671470d90a dovecot-mysql-2.3.21-19.el10_2.aarch64.rpm 872075cf671f1ea8dc0415d4d10847ae20eb1574255374344c9200520a603829 ALSA-2026:19150 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libtiff-4.6.0-8.el10_2.1.aarch64.rpm 8a2803c4269fd70c153e408d7b3928485e7e015908a756bb9f1d40d53f9071b2 libtiff-devel-4.6.0-8.el10_2.1.aarch64.rpm fae210c8c4f5c693aade4a2599fe474060164afb94c2e6a8605175326d1e8932 ALSA-2026:19152 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rsync-rrsync-3.4.1-6.el10_2.noarch.rpm 6ce73c87a6758941f9efbd47f3a5dd2a2ea31d8602fe86d9b50d137c2939e69a rsync-daemon-3.4.1-6.el10_2.noarch.rpm 9f76d6a1f61310d5e7fb2cad97fccf750d8a2777db08a53fec77160350cf917f ALSA-2026:19153 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323) * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320) * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322) * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default thunderbird-140.10.1-1.el10_2.alma.1.aarch64.rpm 17c5b966c85f20f42749d4d937dbb3f88bc5720b13f868d54b676297f2ffc924 ALSA-2026:19154 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default giflib-5.2.1-24.el10_2.aarch64.rpm 8b2dfb4aaa1c16606ea041b500c4eda02ed029e19692eab92a1c6f042b1b3306 ALSA-2026:19157 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323) * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320) * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322) * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default firefox-140.10.1-1.el10_2.aarch64.rpm e8615bbf4b7791b60ee9c006933ecb0a94ad47d1c18cbca6f075fbbf0a8968fd ALSA-2026:19158 Copyright 2026 AlmaLinux OS 0 1 Important

dnsmasq security update

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dnsmasq-utils-2.90-7.el10_2.aarch64.rpm 084dc08f58584e1aa8fb7bf0314bac6ea6d2875b2e4d5ea0ef92ae6467a3e954 dnsmasq-2.90-7.el10_2.aarch64.rpm db23d841b2c5eb195d7684db3a8eb3377cd41e84c009db9e0262bec419614afe ALSA-2026:19159 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nginx-core-1.26.3-6.el10_2.3.aarch64.rpm 1c9b93e78cb60b426a99cee2cebc307b0532f55ea202f60554452f01fd7ad4c0 nginx-all-modules-1.26.3-6.el10_2.3.noarch.rpm 3f0c16ba9b852a8917cd5d6999e2c127f547446efc3c0f2cf3c5eefc43e389c4 nginx-mod-stream-1.26.3-6.el10_2.3.aarch64.rpm 4d68c23f194e4d66ac7d7eb231d08c45b3f3d042f1a69e15ac5392474389c021 nginx-mod-mail-1.26.3-6.el10_2.3.aarch64.rpm 5d091c1fefe4d57e3ab79f779ef49282df9091a79fde8ba50dd7929c4cc28289 nginx-mod-http-xslt-filter-1.26.3-6.el10_2.3.aarch64.rpm 771905863512eafffe604d5e5d8e8345ee18db99d342454b94d7f3c5655530fd nginx-filesystem-1.26.3-6.el10_2.3.noarch.rpm 8890f406349040013ca50201c62964d631bbd50b288c439c5ab1bfd5bafc9330 nginx-1.26.3-6.el10_2.3.aarch64.rpm 9bc6d655a0ba95c7e1749f213f8ecbcd79aa741d9f2957d56a0e8fdd932a552c nginx-mod-http-image-filter-1.26.3-6.el10_2.3.aarch64.rpm 9fb7f4f0905e0cc5759b810ca5bbea816dbdf3916a81d37087ea4b9d67813785 nginx-mod-http-perl-1.26.3-6.el10_2.3.aarch64.rpm d2ac3c645a5ffa259ce5ee6711c3ffbc83e0e3cc0325ccce12e44fa168bd1234 ALSA-2026:19160 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Other issue in the WebRTC component (CVE-2026-8094) * firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092) * firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default firefox-140.10.2-1.el10_2.aarch64.rpm 5e1aab1ced4bfbb68f73732be1ed55cedc75c16f19aaf86e0f9979b25a95e3b9 ALSA-2026:19560 Copyright 2026 AlmaLinux OS 0 1 Important

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libsndfile-utils-1.2.2-6.el10_2.1.aarch64.rpm 5a574456d3a8c3c158e28b5aedb7c217b2df2cffd57b1572cf91b8cd92f10a1b libsndfile-1.2.2-6.el10_2.1.aarch64.rpm fe8e3a3b9a0763e0c385d7c789f5b1ef615120d434902a8f4d28709ac28d9b71 ALSA-2026:19569 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.16.1.el10_2.aarch64.rpm 055c1a4fde5c12157a4043e97bf849a392291919f4abdef9d0583d173e3729b3 perf-6.12.0-211.16.1.el10_2.aarch64.rpm 23dbb73ca00d57b76baf8f6c8fcc94c4df99ebaed0ecf184fe1df51475d925d4 kernel-64k-debug-devel-6.12.0-211.16.1.el10_2.aarch64.rpm 2f1fa7df61239e372ca197652c4b72f2fbddded8b4742ade5ad20c16e3b38561 kernel-devel-6.12.0-211.16.1.el10_2.aarch64.rpm 3020c87a7c53a0a696a5c755ea9a001852f34eefe5db3fed8ace3eb91d816172 kernel-64k-devel-6.12.0-211.16.1.el10_2.aarch64.rpm 457d61c60b794d77ab65de88865c5726d9549fa3bc96143e6642095081294a23 kernel-64k-debug-devel-matched-6.12.0-211.16.1.el10_2.aarch64.rpm 50739dbfc673b13e2efde6e59e7d288c753bec3b44e59f179a7a36a2a97daee3 python3-perf-6.12.0-211.16.1.el10_2.aarch64.rpm 6a6287e2f41ff157732a6a2f7e47cc2c96a12bab1ec83a072dabc8e740e82404 rtla-6.12.0-211.16.1.el10_2.aarch64.rpm 6e2dfc39931d8530166efe33e797c6a7a8e2f81eed4d3731cebe024a3b598b33 rv-6.12.0-211.16.1.el10_2.aarch64.rpm 96c69e7df58719df77c64045d47ddb6e048614a12c3be1a5aae570325b87aa2c kernel-doc-6.12.0-211.16.1.el10_2.noarch.rpm a30d005f590aa010563453b7942bdd2cfa63cee5945427cf1bda74dd421aed6b kernel-devel-matched-6.12.0-211.16.1.el10_2.aarch64.rpm abd137643e33e5a57e82d6d6de0fd6bcc687bf8b4869b9fb9cb86fb776eac352 kernel-64k-devel-matched-6.12.0-211.16.1.el10_2.aarch64.rpm ac344d6a5cd18a48e97944f9f967a04c66e6cf7846c5fde96914cbe215b0bc09 kernel-debug-devel-matched-6.12.0-211.16.1.el10_2.aarch64.rpm cf1f48d5b4d654a5db025a53e7b67774d63d4e4e643b39860109be9ae52aaa7f kernel-headers-6.12.0-211.16.1.el10_2.aarch64.rpm e78220b490ce60ea0afde3c5e9d479534f984d4694e6d7b5b83dab79f9520a45 ALSA-2026:20594 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glibc-utils-2.39-124.el10_2.alma.1.aarch64.rpm 01df4b7eb0c7cd36b0bcd0e0c29f54916b25e92b745f69789d6fa4be17007351 glibc-devel-2.39-124.el10_2.alma.1.aarch64.rpm 1d8e77c0af73c8a754ce7e1be7849e2828eea0af64ad3f0b3c90e58c14b12df7 glibc-locale-source-2.39-124.el10_2.alma.1.aarch64.rpm 75c672ce9afd5f07c67ee76cdae400bec34aa334135ff6b3c8023a5b6ca92a85 glibc-doc-2.39-124.el10_2.alma.1.noarch.rpm c589ecc76ade948f7fc3324ba9ed3bd004cb7f413e99688e10998fd997695708 ALSA-2026:20600 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405) * wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVE-2026-5656) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default wireshark-cli-4.4.2-10.el10_2.aarch64.rpm c4439b2082ba7acc5f24dccd0bac75acf12d00beaf8ab74e73c6108268ed7673 wireshark-4.4.2-10.el10_2.aarch64.rpm e5bdd064ddcc685084cbb657e866a333c13e38eb54e3dfd1475a4a2ed7a58f43 ALSA-2026:20606 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default ruby4.0-rubygem-mysql2-0.5.7-34.el10_2.aarch64.rpm 18ca330f83238da58fc078acc46979360699475074916dbc2a59bed32ecd5d4d ruby4.0-rubygem-pg-1.6.3-34.el10_2.aarch64.rpm 6f590165530c2170bfe7b915a49040bd334de446c02d13529a489f5006ff6514 ruby4.0-4.0.3-34.el10_2.aarch64.rpm 85cbd6ba0673f47d87af0811b1e80b2cdfc938d3f0c5b88e7872c5147c397873 ruby4.0-devel-4.0.3-34.el10_2.aarch64.rpm eb7d33e20fa1b0e0999f8c23b448239c7216fd5dbc392f1a525f71d6a08f6398 ALSA-2026:20613 Copyright 2026 AlmaLinux OS 0 1 Important

gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009) * gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845) * gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010) * gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833) * gnutls: Fix intersecting empty name constraints (CVE-2026-42011) * gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gnutls-fips-3.8.10-4.el10_2.aarch64.rpm 1b52a585e4043d25fe3be03487c0c2ce9c89449c2bad68b5542b02467042671a gnutls-devel-3.8.10-4.el10_2.aarch64.rpm 84573f2d04f825a7bbaef8711461c0cf4e2c1cc6e8af1a2668477ed9cd4f4984 gnutls-dane-3.8.10-4.el10_2.aarch64.rpm 89d5b706db4bee8fc3ffba4de756cf5a5ca5f27a481a7e8e1fbe54cc8a1ff915 gnutls-c++-3.8.10-4.el10_2.aarch64.rpm a2d9065f01739cf0753a14422b181dfab8e81b2ca0090f513ce942fbcb0f79ea gnutls-utils-3.8.10-4.el10_2.aarch64.rpm fa1d589c3a3b71e54a3cd7815b08af7e8b185790018517f12485f0a145dc2104 ALSA-2026:20693 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236) * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mysql8.4-common-8.4.9-1.el10_2.alma.1.noarch.rpm 0d7ccc94e1089ffb6b3fbcd721eec0fed9e1f3494a20fd6d6458a4b6df88a845 mysql8.4-errmsg-8.4.9-1.el10_2.alma.1.noarch.rpm 1be911010c4913a85c01b874457f48ba4933cb9701ec3fe5760128223f810f45 mysql8.4-libs-8.4.9-1.el10_2.alma.1.aarch64.rpm 3f4bd0594ba08576caabf7590a56540a52113c010b2b0d7b8f1b77d9b7cd9e17 mysql8.4-8.4.9-1.el10_2.alma.1.aarch64.rpm 74df312a24be5d0dd895546f16335af03027771e3b88873abd4dcda0e3f8c8a5 mysql8.4-server-8.4.9-1.el10_2.alma.1.aarch64.rpm e2c53be2ce8e443bbcc399372ff91e756e163a127fe0bef3b5fa86bcbffbb979 ALSA-2026:21286 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-apphost-pack-8.0-8.0.27-1.el10_2.aarch64.rpm 0063e7a1b0fa671acd2dcab8960ea3c638d0b8c6c6e1f45ae55c5a5a9f19deed dotnet-templates-8.0-8.0.127-1.el10_2.aarch64.rpm 537dcb5a680c5fca3bc4983085efa256fcf16d6576eed6ccb6235774eff4034c dotnet-sdk-8.0-8.0.127-1.el10_2.aarch64.rpm 5e86cea4d672f762828c14a7c1f68a91850c8f0bbdaa167c1f44a7ffa1736e00 dotnet-hostfxr-8.0-8.0.27-1.el10_2.aarch64.rpm 7ac18688a10f6b4942e4d18e843b1361a896cec309c9ed2f9d92282f6c822920 aspnetcore-runtime-dbg-8.0-8.0.27-1.el10_2.aarch64.rpm 7e71a27466890b5c1500985cfe7c59d016848022044772a6c1ae4cd198ec2cab dotnet-runtime-8.0-8.0.27-1.el10_2.aarch64.rpm 7ea71f8ea09f8b4a0e3fb0f1b5ddbd0d13e9e111898b40155c3b20227279ce68 dotnet-sdk-dbg-8.0-8.0.127-1.el10_2.aarch64.rpm a5a2b66c85ce8719f215face21e499e923db7715ee1ab5ed6af363951670d72b aspnetcore-targeting-pack-8.0-8.0.27-1.el10_2.aarch64.rpm cb2713df9d5d1455b8fca3c953213aed8c65cc2fc220bdc07a231e6851b3f539 dotnet-runtime-dbg-8.0-8.0.27-1.el10_2.aarch64.rpm e0431b586c82165273b5ad2ec94f30d710b69854a03696772e90475c8c314192 aspnetcore-runtime-8.0-8.0.27-1.el10_2.aarch64.rpm ef75804cedd5880ef098925d78605d2e54322fdb05a220b2d958b213c76c5845 dotnet-targeting-pack-8.0-8.0.27-1.el10_2.aarch64.rpm f9cf8e20bb9f9fcc5b5601f427deb4e4b9c043deba0e58cf9565fd5d5d8d2de2 ALSA-2026:21380 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default firefox-140.11.0-1.el10_2.aarch64.rpm 1e371ad9263e76e23ec4c40e4624731b0957ab5b8c2e0cf7d145e20c9e7583d1 ALSA-2026:21433 Copyright 2026 AlmaLinux OS 0 1 Important

httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mod_session-2.4.63-13.el10_2.1.aarch64.rpm 2fb6b3f5aceecbd68aed58f46a7bd99b92b597e4696c582cb7370074059bc247 mod_lua-2.4.63-13.el10_2.1.aarch64.rpm 433743753c1891b145f348c5a5ad2d468436b26d3b792ef4b0debadc30ecf693 httpd-tools-2.4.63-13.el10_2.1.aarch64.rpm 4d527a3da87f2f5eb6487b3ad142d06cf6f52c59809279423b7ace40811f4e50 mod_ldap-2.4.63-13.el10_2.1.aarch64.rpm 4f825cc287352d491d40f07f8de0b549099ebab9afd58a30b05e5db642f71a96 httpd-devel-2.4.63-13.el10_2.1.aarch64.rpm cfd577c8328c9303f0ea5d763185ca568c186c42795a162c79ca234ff4552ea8 httpd-2.4.63-13.el10_2.1.aarch64.rpm d4784b2c7cca8e0386a163f3fe37dfbfe625fd9e07705acc0d7bbd85c734e3d8 httpd-filesystem-2.4.63-13.el10_2.1.noarch.rpm e031b93501860443509180fc94ca9fd2f55bb1e5c48013833c3648cf8b45ea9f httpd-manual-2.4.63-13.el10_2.1.noarch.rpm e3cfbdbc5fcf4512653e1a0be2d6396861efc9b9c15498e4543c0fcbc556c07a httpd-core-2.4.63-13.el10_2.1.aarch64.rpm ed1e59655e33d4874c1bccdf536dc2276224eb4479e5aa1ab7dfdbb6874c8e5a mod_proxy_html-2.4.63-13.el10_2.1.aarch64.rpm ef43c65a2bc49e7335c4d42f9e576383fa578d4841258cbbc6fe0bf1502cd2a3 mod_ssl-2.4.63-13.el10_2.1.aarch64.rpm fd13632b15894148ce88d5917c46e6e7fc738c2b54dd09e8bd10175504532c05 ALSA-2026:21557 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375) * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392) * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006) * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020) * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051) * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023) * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110) * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190) * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205) * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-devel-6.12.0-211.18.1.el10_2.aarch64.rpm 0155dbc1367b5bcb7b8cb49e765a19e70dc54a2b743c75459306a6d9c0753e20 kernel-headers-6.12.0-211.18.1.el10_2.aarch64.rpm 1a8bd4b20385a473466fd652066bc924d7521da5bfe98e05e44ccece41719516 python3-perf-6.12.0-211.18.1.el10_2.aarch64.rpm 1d663a2ce6316d6de644fd6d26912d2992d0b42b98ea5214cf785a90343486c3 kernel-64k-devel-matched-6.12.0-211.18.1.el10_2.aarch64.rpm 275d88689a57760fca0f3351f40daf657d5d5350021b8d7b7fc7a75c9c28deb5 kernel-debug-devel-matched-6.12.0-211.18.1.el10_2.aarch64.rpm 2900b23d784e636ccd3f429f09eeafb92c203c60e2523f61857992d4ddc39cc7 kernel-devel-6.12.0-211.18.1.el10_2.aarch64.rpm 482f8dfcd5e728494c3d029b4b95a462c5e172fbdc473158dd72e026425ac742 rv-6.12.0-211.18.1.el10_2.aarch64.rpm 5dacf17feba2057d37ed48dd8e21c6c8df903ed63fb7a85cbbf3c027503360ce kernel-devel-matched-6.12.0-211.18.1.el10_2.aarch64.rpm 80b83498ce9f625eb190fa8c926d651424ed1fa6e3cafa02b7f8bab3c6acd72e kernel-64k-debug-devel-matched-6.12.0-211.18.1.el10_2.aarch64.rpm acd8ff8e691279b7b3b3dade724dd446d658af8bf773384e68aa8fa691e05e7c kernel-doc-6.12.0-211.18.1.el10_2.noarch.rpm d65ef7f528d990c65a6b7fb8ffc6e3ded25ceee509be5fa08d627d0c203045e9 perf-6.12.0-211.18.1.el10_2.aarch64.rpm e215accbf8c5364a10f09b553b3e2ff2ad1389a1a4cfa338000ac52354884d08 kernel-debug-devel-6.12.0-211.18.1.el10_2.aarch64.rpm f1fe0ce9e0f9e9865edf16ba8d7b172bdaa9b3fc84e37816082f5f993f8e5833 rtla-6.12.0-211.18.1.el10_2.aarch64.rpm f5e4b3ff576c8b75a49ec888df57e059e50bfc95912a242a7ed65fea4003c763 kernel-64k-debug-devel-6.12.0-211.18.1.el10_2.aarch64.rpm fbeb06a3a9e835786d5ec156fa5bf316fd97ce3bc6f9da380c9c43238ccd42a7 ALSA-2026:21676 Copyright 2026 AlmaLinux OS 0 1 Important

cockpit security update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default cockpit-packagekit-356.2-1.el10_2.noarch.rpm 29bea62d6da80ffe7185c0a5c07130c9f8bdd8cf3db5e6956ab11f4675ba353b cockpit-storaged-356.2-1.el10_2.noarch.rpm db2a2a221c93a54b55c9d8c46acdea7e845e9d978c1572d583e9113742dd59f2 ALSA-2026:21754 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-templates-9.0-9.0.117-1.el10_2.aarch64.rpm 0a0e255c84094604d2ebf913a8c3c6b6c188151c031051066e769b52ee2eef43 dotnet-runtime-dbg-9.0-9.0.16-1.el10_2.aarch64.rpm 27e4657d6e5dc522d0f8edba5655325d354e409238aaa841317ae76970f93f89 dotnet-hostfxr-9.0-9.0.16-1.el10_2.aarch64.rpm 45996adeb44127a3b501241a91522a07338a3d300aa2cd64a14c1c7642bf9c38 dotnet-apphost-pack-9.0-9.0.16-1.el10_2.aarch64.rpm 4c38c8c21932118f92bbee7c517350bff08353cb5e6c62c22a00dd4ba958a0eb dotnet-runtime-9.0-9.0.16-1.el10_2.aarch64.rpm 55cb5c382053d788c78e5745891d430b5c2924fd6e8eab8f6555f28924f982e6 dotnet-sdk-dbg-9.0-9.0.117-1.el10_2.aarch64.rpm 5bfe6d4d13ed8171f6ccde3dd4243d22d550d45ca5cd388b51aa0c64ab9c9c5e dotnet-sdk-9.0-9.0.117-1.el10_2.aarch64.rpm 80af86fba55013d7b6719eade0094594dcc2ec66b7e2aadce4d9010ae0e9eef5 aspnetcore-runtime-dbg-9.0-9.0.16-1.el10_2.aarch64.rpm 85a851a2bc28cd5d752a72c4f16362467914744475830dfa65ce8a857a1f7910 dotnet-targeting-pack-9.0-9.0.16-1.el10_2.aarch64.rpm 86a477ed3a4aed32adc7db584c0c6645d292f4f4fdcde87cd1385ed45100e5d1 aspnetcore-targeting-pack-9.0-9.0.16-1.el10_2.aarch64.rpm 9d3a3a99d58904bbb71cff25d2934fd34ec976cc69b86153bb8242b6a24e3e4a dotnet-sdk-aot-9.0-9.0.117-1.el10_2.aarch64.rpm b1dd0131aa5896015bbc2570c0278ecc24298b36870da16be2d104dce4d16608 aspnetcore-runtime-9.0-9.0.16-1.el10_2.aarch64.rpm b91f60a20b7fc70b6eeca9028ffb423a924b039cbeaa719b1cd5a0370bbaf532 netstandard-targeting-pack-2.1-9.0.117-1.el10_2.aarch64.rpm fae80d5c3f4813035ad188aff4fae58ed5fb0da037eaa040b8c8e32a63710a40 ALSA-2026:21757 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm 22949ff4b832a5fbaf79d354cfc73af59a6746d662dcf4d0c294b24dcd69a9c7 flatpak-libs-1.16.0-9.el10_2.1.aarch64.rpm ab47ee54e8bbb0727e9b8f9e36b1e7edcdb250c0c5ab9448682ae233947ab8e7 flatpak-session-helper-1.16.0-9.el10_2.1.aarch64.rpm beab4085aa5c4e9527b41ac5af5b3b42dcd64a1ffdfba7b8d8906bf41455c9c3 flatpak-1.16.0-9.el10_2.1.aarch64.rpm cfcb3c7fe3f1c47adcfcaeb3a71530ea886543cc6928a17a1de9ad74f0f69f59 ALSA-2026:22141 Copyright 2026 AlmaLinux OS 0 1 Moderate

go-fdo-client and go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default go-fdo-server-owner-1.0.1-2.el10_2.noarch.rpm 2f5a8bd1401f47c152f97edd4dcc2bcfe5b02e9edea564cd3f27e4152facb328 go-fdo-client-1.0.0-4.el10_2.aarch64.rpm 7f69b0fd8867a479bfed3095ff0ee56c19047d54952369998d92bfd3ac930d98 go-fdo-server-rendezvous-1.0.1-2.el10_2.noarch.rpm 843e6a44fb5ab7ca974b5dc823978d86e2f4d3d2a91a9aef3292f97beafc75f3 go-fdo-server-1.0.1-2.el10_2.aarch64.rpm ad3e9572ee7941b17efda07f030f64b6c0bf9fee0afc36c878fb7d4c7d541333 go-fdo-server-manufacturer-1.0.1-2.el10_2.noarch.rpm b1739b5cbc00a312407f39f5c8b72d26a9a88f099f93f00e1d68db826a024bb9 ALSA-2026:22145 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default aspnetcore-runtime-10.0-10.0.8-1.el10_2.aarch64.rpm 1bd0818b8567392e3855dccca20b5696664012c20f75cc8138c1ffd7e29d3df4 dotnet-sdk-aot-10.0-10.0.108-1.el10_2.aarch64.rpm 1d4924c6bf258b6476b017c6c0a4c249be21651c624eae11e76e74973ece5b71 aspnetcore-targeting-pack-10.0-10.0.8-1.el10_2.aarch64.rpm 1f62f6f20b431e93980f9c2416c2af4492216b5ea29f49fe06eae8584936dd56 aspnetcore-runtime-dbg-10.0-10.0.8-1.el10_2.aarch64.rpm 1f6985cb446231eb9178184813bd9d6732776e96a2a1871682de66c903e55dca dotnet-targeting-pack-10.0-10.0.8-1.el10_2.aarch64.rpm 35fed2159b238b522d7d708b2d93eb798f784ba478c9e286e892bec093643479 dotnet-apphost-pack-10.0-10.0.8-1.el10_2.aarch64.rpm 3c294dfbb4f947cbf8a6cbdce6722bb0afc380c10e34821f620931dca6f50a1e dotnet-sdk-10.0-10.0.108-1.el10_2.aarch64.rpm 594585fe5e2068595b4f8caa8105811dec40befd4d845e407d151f517e82f0d8 dotnet-hostfxr-10.0-10.0.8-1.el10_2.aarch64.rpm 6fdd3c16d06201043e43be1972c774830c54c3810e0accdb5f542f65258677be dotnet-host-10.0.8-1.el10_2.aarch64.rpm 80d96b79c363c5ba4c2bf3c981660aaae8cdf3fbe08f7ccd54e05bf23a83d137 dotnet-runtime-dbg-10.0-10.0.8-1.el10_2.aarch64.rpm 996a9824606c6e3e5c7b0e66b42cd8b9907432fcea59e4f92d20b5e06dbfd00b dotnet-sdk-dbg-10.0-10.0.108-1.el10_2.aarch64.rpm a75d8e536e2261a7be01a60fafd10a1e97be3d20b41f0b5fb11f20e87da1eaaf dotnet-templates-10.0-10.0.108-1.el10_2.aarch64.rpm d5c147eaac52091df1f8d4b3abe2d3439402aad1503c3bcebc4d61c994fd9416 dotnet-runtime-10.0-10.0.8-1.el10_2.aarch64.rpm dbab4073fc56321196a063b11bb335b5b4199e9faf52ac64a7dc377bd08cae0d ALSA-2026:22314 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssl-devel-3.5.5-3.el10_2.alma.1.aarch64.rpm 4635121698675f0575a935ee86148a7fbe8f5a9aadcc9d1b23044290bb35ea56 openssl-perl-3.5.5-3.el10_2.alma.1.aarch64.rpm e17df9b376d3c63a8c28a1b61ab05f2c356dce936cd5d9055961feefd1444ad2 ALSA-2026:22325 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default thunderbird-140.11.0-1.el10_2.alma.1.aarch64.rpm bbcfd9a7900ecc54206a0bc042213a77768d586d9848282ce66f774123774b02 ALSA-2026:22528 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_http2 security update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.aarch64.rpm ad3fdb694065ad02b7535d99a2bc04583386ab0d96944a3955120b51eba11755 ALSA-2026:22529 Copyright 2026 AlmaLinux OS 0 1 Moderate

libexif security update

The libexif packages provide a library for extracting extra information from image files. Security Fix(es): * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libexif-0.6.24-9.el10_2.1.aarch64.rpm f38688d10fe25c063e7cd04c007d20123685adb00f19f912751976e9ec104e35 ALSA-2026:22649 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) * php: denial of service via DOMNode::C14N() (CVE-2026-7263) * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default php8.4-odbc-8.4.21-1.el10_2.aarch64.rpm 0526c4c23418b569591815aa308e507f7b0d56aba2c958f03dddc5729d31dce7 php8.4-8.4.21-1.el10_2.aarch64.rpm 15641e77639e11c5446db84baec227669734bcf8f7180206fc7cf9c300146410 php8.4-common-8.4.21-1.el10_2.aarch64.rpm 2c5a70a4d64bbd3248386761dfd42a8636b2fb946e6ab31dd1844045955c6161 php8.4-gmp-8.4.21-1.el10_2.aarch64.rpm 33176c4525e3544b10d8420933d226aada30ebdfa5e1b60e8ea948c4e5c7137f php8.4-mbstring-8.4.21-1.el10_2.aarch64.rpm 4dda9d70b75e7461cf81ee902cfff7e05a5005c88de8cd2e854746cd5eed82c1 php8.4-intl-8.4.21-1.el10_2.aarch64.rpm 58e360f1bd78afd91e9adb165416f8dccb8b0c78ac4e9f9d94ab820359b74496 php8.4-fpm-8.4.21-1.el10_2.aarch64.rpm 5c83a518f5374c04dba637cb6f07c5f50e791b262c12e11750bb3ed1d77716bd php8.4-dba-8.4.21-1.el10_2.aarch64.rpm 609bdd78db092fe40814774f15bb51ced0dee7e5bfc1bf0aa6735fc3959ba117 php8.4-bcmath-8.4.21-1.el10_2.aarch64.rpm 669542f6a4cc8db1b192faffc1e8bc902e3d45408d61e0e415307417fefa9e64 php8.4-devel-8.4.21-1.el10_2.aarch64.rpm 7ad19c68557d9dd2dd96d7cd475dc48f0fcee84126c60123d74ffeeca9a5495a php8.4-gd-8.4.21-1.el10_2.aarch64.rpm 7d242d09f55b1b0ff8f86eed4fc85b28fd9e00c1c7f183dfb273895bdaa2b444 php8.4-dbg-8.4.21-1.el10_2.aarch64.rpm 8821c11435bdea93a9320a3d7d47b4caef1b43dbbefaccb259c6c0f3438f5d85 php8.4-embedded-8.4.21-1.el10_2.aarch64.rpm 96f2cd6ccca2dd0adcea5a7495b32ca185ead71b227a8ec03f9504c991d7490f php8.4-xml-8.4.21-1.el10_2.aarch64.rpm 9f021b7929c837edb99a9d6d0e0695cce9de99c353ecc77fd204ef55c9f68e36 php8.4-ldap-8.4.21-1.el10_2.aarch64.rpm ab504aa07129f6bc93093d791e27864b01c7e5bdd9cba00a120fe8a0b5caa739 php8.4-mysqlnd-8.4.21-1.el10_2.aarch64.rpm aef9b87cc1ba2cff8cead7fa3e679c1b0321f7428e751ddd638844e9a5f5e691 php8.4-cli-8.4.21-1.el10_2.aarch64.rpm b171d0bfcf424dfa4b0528622ff5ef84bf709b5d71ed6b56b59aada0a8407662 php8.4-opcache-8.4.21-1.el10_2.aarch64.rpm b7533a6593b68f0d7e61276bedfb0b7f0e3738a161fcd52150838e90f18ea765 php8.4-pdo-8.4.21-1.el10_2.aarch64.rpm c0b4c4e325eb5e5a03c3ac38b4a94c4075a71594224b50a48258840ddeb58b5e php8.4-enchant-8.4.21-1.el10_2.aarch64.rpm ec1ed60a56e570a418d731f84f4bd0dd6b9e637c0b0ac74d212dade29a378945 php8.4-snmp-8.4.21-1.el10_2.aarch64.rpm ec436adf050d255da531d2a01e71ec233ead387e410fc33e3b5bf4a85ff7a3ea php8.4-pgsql-8.4.21-1.el10_2.aarch64.rpm f158f7c06000f3c975af7d49423dc2e4bdd1e5c4855d3407f77b25710cf48197 php8.4-ffi-8.4.21-1.el10_2.aarch64.rpm f332035b521e834a36a9389a869b16806ec2857d092b417d26d51b8d8c1305a8 php8.4-process-8.4.21-1.el10_2.aarch64.rpm f3ffe3d00053fa61131ee656157178a3b941e56a4fc965aaf815a7c9d8323acc php8.4-soap-8.4.21-1.el10_2.aarch64.rpm fd868cfbb8ab3cd9f8f7135aeefc80645c6b9d3572a93abce004380bec9c20ea ALSA-2026:22711 Copyright 2026 AlmaLinux OS 0 1 Moderate

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default vim-common-9.1.083-9.el10_2.3.aarch64.rpm 49a9f24767075aaf647c298aff0f1e2f1857200719a73dd1a4edef071ec83cbe vim-X11-9.1.083-9.el10_2.3.aarch64.rpm 6702d9f2a065096f28eea2c9b292fe80fd8b5e110dfe5a979645a234dac9f3fb xxd-9.1.083-9.el10_2.3.aarch64.rpm b4e2baf87638b3c93d5fcf1652defefe839bf2d9ad564b55a22c31a09bdc492d vim-enhanced-9.1.083-9.el10_2.3.aarch64.rpm b713544c142def3cb610f0d97b734be08502311d2738652b23cf7c1e7df8afab ALSA-2026:22715 Copyright 2026 AlmaLinux OS 0 1 Important

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.1.aarch64.rpm 80f1733d10419f3a01342b4ee8a29d198004fff14d488d3f0996566401ceed26 ALSA-2026:22963 Copyright 2026 AlmaLinux OS 0 1 Critical

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012) * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170) * samba: Remote Code Execution in SAMR (CVE-2026-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default samba-gpupdate-4.23.5-109.el10_2.noarch.rpm 02ab33c4186fb468d4de6cffac56cd285836279fe4e2d03245fef1dcf26dd611 samba-client-4.23.5-109.el10_2.aarch64.rpm 27caf7fa9c3ba93da63abac5e9976f2246bc092b5ee53c2cab9a70d01d154642 samba-winbind-krb5-locator-4.23.5-109.el10_2.aarch64.rpm 6958a38a27a62042a986adaa9fc00423d0940d3f37669537f33cd19d4b28d5f4 samba-vfs-iouring-4.23.5-109.el10_2.aarch64.rpm 8baec8ed3bdde3611157e06ab4623679c2e0d7bf34add8011ba70feab4cd4880 samba-winbind-clients-4.23.5-109.el10_2.aarch64.rpm a5e613af0e69819967ecab9250662e65fc09f8bc71139384e3871858dd9d3183 samba-krb5-printing-4.23.5-109.el10_2.aarch64.rpm f9809e33207cec4e0a4875717b9efb2842b5425724a14eb04bb00aeb12150a56 ALSA-2026:23102 Copyright 2026 AlmaLinux OS 0 1 Important

delve security update

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default delve-1.26.1-2.el10_2.aarch64.rpm 20bb45812227a04090387bcbf186c820834fbb8e90bd1b9dbb65f7840b8bd983 ALSA-2026:23231 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959) * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default unbound-utils-1.24.2-7.el10_2.1.aarch64.rpm 352ae91a8aba6f89ab6c98af982a4fd6d50f90988faebd8ca516181195b1bf36 unbound-1.24.2-7.el10_2.1.aarch64.rpm 509f5bd08a17f6c530f7f90352514eb82e4a8709ac36ca844bd3501e335c978c unbound-dracut-1.24.2-7.el10_2.1.aarch64.rpm 84640383872f9d4e524e07e4b32916aa541dd6980fd64b9ca750886bafae4148 unbound-anchor-1.24.2-7.el10_2.1.aarch64.rpm aca7e689986679bd77a09db9e82769043f3d8b626a601fd33a53e23982f0a630 unbound-libs-1.24.2-7.el10_2.1.aarch64.rpm c6538f3a0ce2ecce51ec2d5a4d9765ee8eba85b4c5dcba157f2987838a70178c python3-unbound-1.24.2-7.el10_2.1.aarch64.rpm c7969241ba638c60efde2db3271f89f5f4808360964d81d2b4e63ea0f35649cf ALSA-2026:23329 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-devel-6.12.0-211.20.1.el10_2.aarch64.rpm 14efb8b2b1d0ea142e665aa0bc76ff97711b77b29084e9c68ff6a3ebca3db65d kernel-devel-6.12.0-211.20.1.el10_2.aarch64.rpm 30c6fb3d8f94bc6ce0cdea57e4258e5ebda964ed5cbcfb498e264f85bfcf86ab python3-perf-6.12.0-211.20.1.el10_2.aarch64.rpm 36988707d138dd5274cc045c421c60959baf513650352aaa74cc99fa33672307 rv-6.12.0-211.20.1.el10_2.aarch64.rpm 5d9163389231b75b29db9ece0a0060ad92b33f2b3f8200b6b953474c957ad6b4 kernel-debug-devel-matched-6.12.0-211.20.1.el10_2.aarch64.rpm 686fad1509e4033ae4085a72d7e7588895a4da2d3057bd92e807b4d76af912b2 rtla-6.12.0-211.20.1.el10_2.aarch64.rpm 769abbe8abf4975b8a58f92eb6e0858528f069f48d5a7abf19369fd0b7f637d3 kernel-64k-debug-devel-6.12.0-211.20.1.el10_2.aarch64.rpm 92725c2074bf5baa1bf32b80b1cf3e3cc799b662f8d8f9449f4c74cc89010f8c kernel-doc-6.12.0-211.20.1.el10_2.noarch.rpm a836026e76d4d01a4cd956f4ff3470e96d192b18c9b27f6d4d5b5e46c6aa8694 kernel-headers-6.12.0-211.20.1.el10_2.aarch64.rpm c0285e47e5a2ee70c49c8408659920c8d654a56d1e663fb0e8f95a935e7db4f6 kernel-devel-matched-6.12.0-211.20.1.el10_2.aarch64.rpm c6d5957bf1733c918d7a8926082c73d08bdd9e88d890d512e33b443ba45569f5 kernel-64k-devel-matched-6.12.0-211.20.1.el10_2.aarch64.rpm cfaf3541667ca7c0464d5a40ab7d3fe64d70bc62eff906e19eda9bf7bb65bdc2 kernel-64k-debug-devel-matched-6.12.0-211.20.1.el10_2.aarch64.rpm cfb03d418ad7ba3c8ad9211f78616701c5a2378da9e84babde1869d3fd57f68d kernel-debug-devel-6.12.0-211.20.1.el10_2.aarch64.rpm d01548be34085f1f73d30377400dbd8649b279c5954f59bd519a88af13a87887 perf-6.12.0-211.20.1.el10_2.aarch64.rpm e73fb3893cb0f7b4c266069b99e34520e63e297adeb912d30f4dc24b4f75433e ALSA-2026:23388 Copyright 2026 AlmaLinux OS 0 1 Important

php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default php-odbc-8.3.31-1.el10_2.aarch64.rpm 02ebbe4ec73281b96ae3e8fbf609832e15f5ad5f8f0783d013b691a41fc12691 php-ffi-8.3.31-1.el10_2.aarch64.rpm 2637876b33b6a8ec385adf5851cf5cb15c58bd625f821920271d25bbf3d49343 php-pdo-8.3.31-1.el10_2.aarch64.rpm 268c00c3becf4ccd3e2e4cc7753908c0c2db5f195bc692804e5bd23c0a97cfe7 php-gd-8.3.31-1.el10_2.aarch64.rpm 38481bcce41b02096ee9961e51c3ac43a35a0656b042eeeb77f7c124eb58a306 php-snmp-8.3.31-1.el10_2.aarch64.rpm 397b81ba53053c882d463abb45d67da0bb9a341d0b32cc2ee04d32ff8dc1fdc7 php-embedded-8.3.31-1.el10_2.aarch64.rpm 39a668203a62865cecb5953d4d5701da6dffdd6991fea6be2172e963bbdb75ea php-ldap-8.3.31-1.el10_2.aarch64.rpm 41156a053bacdccdef252d74ffc583e8e1e088e2e42a5c82a6871d445872266b php-intl-8.3.31-1.el10_2.aarch64.rpm 4d3d56cc3076a6d2bfbb76dbbea9efe1fa0ed4fb3ffb180412a7a74922d73631 php-dba-8.3.31-1.el10_2.aarch64.rpm 5b3477015d21aed4ac24b114eff0f5bb98ed9383c582532ce2fa07c641859ecb php-opcache-8.3.31-1.el10_2.aarch64.rpm 5d957b653d98a0c68819a4221d99fc612fe6d9f64741078f6bcd13af6cc1e15f php-dbg-8.3.31-1.el10_2.aarch64.rpm 60560ded871026142fce67b6f9c5dc42feafb8353cbe0c8f5cf22d60dfb50d30 php-8.3.31-1.el10_2.aarch64.rpm 667dcc6a92ac2b64bb459d91448883197851f31fb91a343d40e4b581d29a02e8 php-bcmath-8.3.31-1.el10_2.aarch64.rpm 78fd6ec53225944acdcabf99575f5f8d730c9788fb27ce64e3c0481d5d580895 php-mbstring-8.3.31-1.el10_2.aarch64.rpm 7fe6c46f54b3f32ea2c1c6bfa6873786993d4b8c56b8f8d5df9e0a7d54710187 php-fpm-8.3.31-1.el10_2.aarch64.rpm 8fa3a6de488b524d6fe1a051a404c40ecbf81bc9253d46e85fb48543b2ccb61d php-pgsql-8.3.31-1.el10_2.aarch64.rpm a3284f6cc4a0ed0157fc6299922a1eb584b83eb5d1bba0bc4d6b1afe5e61d9fe php-common-8.3.31-1.el10_2.aarch64.rpm b15f937ef3f3f4bec77b9e736c36e4614d24d729f6575e8153d147eec80b2ac0 php-soap-8.3.31-1.el10_2.aarch64.rpm befa3174cde96717a64ec7e8b9c465d44e1c9f727ba258ffb9124f2606128f55 php-xml-8.3.31-1.el10_2.aarch64.rpm c3e9a48470c4f4d626fa544129034e8c178340c56f5d2c69907f897a1b227510 php-enchant-8.3.31-1.el10_2.aarch64.rpm c650e35423c1d0ed797e5586c465c9d4d2813fb82d505d396a664964f6c96f1b php-process-8.3.31-1.el10_2.aarch64.rpm ca14bc5636b866cb6cbce9ee355a0d092eb2e4f68687692fc4f1927966a51d74 php-devel-8.3.31-1.el10_2.aarch64.rpm d1a864f40ec1f364fe8ff6836221e4d810a31cdc8ce9297efece05544253492e php-gmp-8.3.31-1.el10_2.aarch64.rpm e1c6fc1297930be82a91506dceecaeacf42cd556d64768ac620aa33e4251c7ff php-mysqlnd-8.3.31-1.el10_2.aarch64.rpm ef2578dfae09346b86789c6be766c3154c91c72f8f47582bf98e80cbdde23cfd php-cli-8.3.31-1.el10_2.aarch64.rpm f9e9ae25888e30151cfcdac82deed1b7e024d4c311dd09691a5fb80c4810dbf3 ALSA-2026:24338 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default bind-libs-9.18.33-15.el10_2.2.aarch64.rpm 1375282f35b522831a755d02f48d83226fdf5be556b75ea1d196d1b937e498f4 bind-license-9.18.33-15.el10_2.2.noarch.rpm 25696570fcae21d95d2b7b7d02efd735482defa1142c62286c36eabb4f6c2997 bind-chroot-9.18.33-15.el10_2.2.aarch64.rpm 68650352de2a7b0f1fef20b578147c71d66e5d4578e6ddd5c022954ee9158c24 bind-utils-9.18.33-15.el10_2.2.aarch64.rpm 7bd4855052cc3a1449b7611fbffbe430e118ab88f8e7f7e7c077997c2f354ee6 bind-dnssec-utils-9.18.33-15.el10_2.2.aarch64.rpm a6ca3c58def9c9b7c61abd36dca8cfea9a749977895acc05ae27463c5ac79652 bind-9.18.33-15.el10_2.2.aarch64.rpm ef6570721643e0f0d9e6b1c441c37c259c5af1cfff6ebb0ef004227b93aff8b1 ALSA-2026:24347 Copyright 2026 AlmaLinux OS 0 1 Important

frr security update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * frr: denial of service via crafted FlowSpec component (CVE-2026-37457) * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default frr-10.4.4-1.el10_2.aarch64.rpm d8dea90b674adf3240c12570a505c5dc2e341d172f06e2cec2970c6bddb126d2 frr-selinux-10.4.4-1.el10_2.noarch.rpm e52027fd1714316b10d57ad6d1986270e9103048cce6f181fddac53f9ff01c8c ALSA-2026:24348 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postgresql-jdbc-42.7.2-1.el10_2.2.noarch.rpm 12ad5a0377cc543161f693dbedf80444ce6430610d3c37c638d24895a91baf32 ALSA-2026:24470 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default podman-remote-5.8.2-3.el10_2.alma.1.aarch64.rpm 107a253badbc3fa97d47e3ff21a5d40bf67738c64cccb30d40399b06161be1d8 podman-5.8.2-3.el10_2.alma.1.aarch64.rpm 2217f0d05190ccd527f7bc7319c92c0d5bae9e45d3f0124f8b8633d7732b6405 podman-docker-5.8.2-3.el10_2.alma.1.noarch.rpm e205f2f26c5534f264de80514cb994d72b05f6a8fdd0b52239e7998ed355f6cd ALSA-2026:24758 Copyright 2026 AlmaLinux OS 0 1 Important

libyang security update

Libyang is YANG data modeling language parser and toolkit written (and providing API) in C. Security Fix(es): * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libyang-2.1.148-4.el10_2.aarch64.rpm 014a8f59b0efa44b37707fae662366cfd609f15851e5a078fe0c6429cc1046e3 ALSA-2026:24985 Copyright 2026 AlmaLinux OS 0 1 Important

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default poppler-glib-24.02.0-7.el10_2.2.aarch64.rpm 628b49d9a04c25287aee6b1611a55d1aff3cc35303426d563b681cc09635025d poppler-qt6-24.02.0-7.el10_2.2.aarch64.rpm 7ccef2a3a5310a5f6078fbda04de35686bb1730cf536f82a844ba545c6f49098 poppler-cpp-24.02.0-7.el10_2.2.aarch64.rpm 87879eddb478b056046aa7fe72fa05256ed064311a4e734265708f762bece473 poppler-24.02.0-7.el10_2.2.aarch64.rpm e64440c341a78c7ebf74e39de386bfb3c5a94944f2368282aa58141aa2ad99b4 poppler-utils-24.02.0-7.el10_2.2.aarch64.rpm e8c4d8236d5076cb52919e084b3d58b3c4702d068661e1311433ec7bfad84efd ALSA-2026:25111 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-sdk-8.0-8.0.128-1.el10_2.aarch64.rpm 0e15a6efedc190d6058d1834bc90ee2e768463883b76d7f8346747bd801b1c0d dotnet-runtime-dbg-8.0-8.0.28-1.el10_2.aarch64.rpm 54919e4d6920413a04be6e8716556bbe721fcabed8462228cef130d37a02a9d1 dotnet-targeting-pack-8.0-8.0.28-1.el10_2.aarch64.rpm 5a7252d6b06815fd9820f4a4fe67adf3ce8d54911173aa2327370eb2a175d1ad aspnetcore-runtime-8.0-8.0.28-1.el10_2.aarch64.rpm 67e5c2b751f19002b8b6455756227e92c24e702d0a615d8d1873111290b894a6 aspnetcore-targeting-pack-8.0-8.0.28-1.el10_2.aarch64.rpm 732a46bf8f9862d1c26c54a6b457c2bb75d206c39bdabcdb96f21f3885276e55 dotnet-templates-8.0-8.0.128-1.el10_2.aarch64.rpm 74421ebf6ff4e06ad20b0fdb807faad4d81bedf377bbad0be580b8dd74fa9834 dotnet-apphost-pack-8.0-8.0.28-1.el10_2.aarch64.rpm 8f519eac69ecd786587bbf034297acde70d2bf86aceceeb695bc4331acd2c9ae dotnet-runtime-8.0-8.0.28-1.el10_2.aarch64.rpm a8eb349852dc73dd9c3f22d50bb35f92059db7c60b7ca7b4d306c174bbc7437c aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_2.aarch64.rpm cd90cfc2d28fd98a82c46c03e9ccac143ac2772c6be6d497818ce3f43d8448fc dotnet-hostfxr-8.0-8.0.28-1.el10_2.aarch64.rpm d6f593d94e4189b69c7b55cfbd6afd49e4b1f78198d7946065f11822a0243565 dotnet-sdk-dbg-8.0-8.0.128-1.el10_2.aarch64.rpm fe0f8f277ee7b4a2f417d1e4e31df32338b18222910d91e15cbc3be9b58b2863 ALSA-2026:25112 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-targeting-pack-9.0-9.0.17-1.el10_2.aarch64.rpm 02e4a9e38672371420a8bacf01e5210251e5fba4af4614aec735091234ffa320 netstandard-targeting-pack-2.1-9.0.118-1.el10_2.aarch64.rpm 112190aaac498ffaea13e6b5e7acdeb6c4ca01d4163f21c87e5830e8ecc14642 aspnetcore-runtime-9.0-9.0.17-1.el10_2.aarch64.rpm 3b5734940945c105327c41c1e8301ac58bfe291be829a044a08d3df26755a906 dotnet-runtime-9.0-9.0.17-1.el10_2.aarch64.rpm 52f28a9f05a19d097f27f1099983ec251848b22b90b403a82df771fa480a3b09 dotnet-sdk-9.0-9.0.118-1.el10_2.aarch64.rpm 5b3912b87f515c90c9b13f871b9838c7137d327443d784343d7f1e1e5f598e17 aspnetcore-targeting-pack-9.0-9.0.17-1.el10_2.aarch64.rpm 5d8767b92e8062ab4c59d73491e017715e533abcf4e970e73681ad936e32e24e aspnetcore-runtime-dbg-9.0-9.0.17-1.el10_2.aarch64.rpm 6387c9b56a33d6885e3bcbf53ef969f5749b15654841a4a953b78560cfd6b4b8 dotnet-sdk-aot-9.0-9.0.118-1.el10_2.aarch64.rpm 7443a637aed95fe0104d8310c182854071fc0b030e28cf253342cd750bb1bd87 dotnet-runtime-dbg-9.0-9.0.17-1.el10_2.aarch64.rpm 9c31e6d8f7cfb934fece6703a10dfc0bc18f4b9ec07bcea037e862692c86762a dotnet-apphost-pack-9.0-9.0.17-1.el10_2.aarch64.rpm 9f3b898c3ea515cd17eb7ebdd70243df2d0b5d145a7d929dad24635359660773 dotnet-hostfxr-9.0-9.0.17-1.el10_2.aarch64.rpm a2b0d586abfa23837b6f13ea78ce506ae46563acf50aada095869d4cf5be904b dotnet-sdk-dbg-9.0-9.0.118-1.el10_2.aarch64.rpm f1a70a153abfb5fb0cb8ddb3fb02c3dc36948a39ea2bcff35737c814eef7c723 dotnet-templates-9.0-9.0.118-1.el10_2.aarch64.rpm f927a19795431b6c2c78d1b75502f8b33f030ba50474c0eae0b1b29c02578c52 ALSA-2026:25115 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-targeting-pack-10.0-10.0.9-1.el10_2.aarch64.rpm 2f04ac800c5bc7ce384036b24565265c1a22c548a43b0a95876285aae47808ff dotnet-templates-10.0-10.0.109-1.el10_2.aarch64.rpm 338178bf771bfee068a15fe3b8082e81b465ab8e725f49f9b45b7fece1a295c6 dotnet-runtime-dbg-10.0-10.0.9-1.el10_2.aarch64.rpm 41b45755fa4b743b0e20a44f047b6f8350b54103522c6ecf336a49a2ec8961f7 dotnet-hostfxr-10.0-10.0.9-1.el10_2.aarch64.rpm 7079c3822abcc01d642544244b4e993a911e16ad6952c31a32ca96a154a64907 aspnetcore-targeting-pack-10.0-10.0.9-1.el10_2.aarch64.rpm 87f62074f401291f0f063a81a58724f7e6e21bdab76272a36c6f97d6ca143783 dotnet-runtime-10.0-10.0.9-1.el10_2.aarch64.rpm 922d7c9c012d7aa5873f257a1210b9de4177873a9d91221d943b120304a25723 aspnetcore-runtime-dbg-10.0-10.0.9-1.el10_2.aarch64.rpm 92fc8250ec51f778411b248d364fe074a35a6bb917bec07baed1659d84da9d49 dotnet-host-10.0.9-1.el10_2.aarch64.rpm 98009216e3ada4b787bf9622f7109da299ec1e6c2c156d703ca26d015fc5d649 dotnet-sdk-dbg-10.0-10.0.109-1.el10_2.aarch64.rpm aa7c1106b40a4bd1276828446f85956bece5b51cf4fde008944173c3cf6cf3eb dotnet-sdk-aot-10.0-10.0.109-1.el10_2.aarch64.rpm c4c8debd6e21bd247ace153a41973da3888e33e64b071041cbf50842813049ea dotnet-apphost-pack-10.0-10.0.9-1.el10_2.aarch64.rpm ca1bc8b3e4a7408ecc6f66a305890d0972c707c290c385f2c2227d5847b65e27 aspnetcore-runtime-10.0-10.0.9-1.el10_2.aarch64.rpm d1d6e204b3625d911aaa0bce5444cb06e6076dfd470723df4a69363cd1fee51f dotnet-sdk-10.0-10.0.109-1.el10_2.aarch64.rpm d9ae9171cb02aab0d254d6ef28e73cf08cc8545581a71465d187943bd9b1c015 ALSA-2026:25191 Copyright 2026 AlmaLinux OS 0 1 Critical

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rtla-6.12.0-211.22.1.el10_2.aarch64.rpm 04bcd80ab065a774a431dc71d8772e95d00da4165edfa0ce069938602320766d kernel-debug-devel-matched-6.12.0-211.22.1.el10_2.aarch64.rpm 1c3fbad21ee05278e149e792fbdcb269d97645dbe70371f68226e81b52f81b0e kernel-doc-6.12.0-211.22.1.el10_2.noarch.rpm 1cb3d93030aca010c6182c61bd262ffa6d526fb1b80f5cac5d3a4e0ddfd0923a python3-perf-6.12.0-211.22.1.el10_2.aarch64.rpm 2d916334921230954b88ed80fbe1f2c120934fc4f221a2af775d964f774edebe kernel-64k-devel-6.12.0-211.22.1.el10_2.aarch64.rpm 3e001ebb1c3a8784d58ca0f785ebaf8039a15b432a0936987803c0497367282f kernel-64k-debug-devel-6.12.0-211.22.1.el10_2.aarch64.rpm 4035a9c949433e27673f4684212e9b9ab49021cafc01cfb81a2b82fad3c4304c kernel-headers-6.12.0-211.22.1.el10_2.aarch64.rpm 5ca00f3929cc046bc70bba018cf7cc357d5b89bfa797adcd18682dafdab21667 kernel-devel-6.12.0-211.22.1.el10_2.aarch64.rpm 761ca0abe6fe5b9ce56b08c72cf6f2fb0cfc33f4789749b4fb2cd4a37d97b24b kernel-debug-devel-6.12.0-211.22.1.el10_2.aarch64.rpm 817c75da94105c9ac136f9c19855d4c5b4a85915738f2d345a890326542b8396 kernel-devel-matched-6.12.0-211.22.1.el10_2.aarch64.rpm a71bd5fb390a6e74d0c4a1cef0d9396976f592ab1e2f7e1ffacd0817d0f017cb perf-6.12.0-211.22.1.el10_2.aarch64.rpm e1650cfe10b4ef6186539cff825009070e7dc94c3c1f4681dd65c24a02fb4fea kernel-64k-debug-devel-matched-6.12.0-211.22.1.el10_2.aarch64.rpm e2d51e6b79e2ee411a339d63e5cf741cb364dbc9c5b598e4ce13f52e68e089b0 rv-6.12.0-211.22.1.el10_2.aarch64.rpm ef18ed93cafdd2101c069a2f884af56fd6846ba674f5bab03bd51dab8258dfb6 kernel-64k-devel-matched-6.12.0-211.22.1.el10_2.aarch64.rpm f73dc3f6f91ceb33a5f68640163b77abef6e6f49f70bb6bbc1e1a22a52151532 ALSA-2026:25216 Copyright 2026 AlmaLinux OS 0 1 Important

valkey security update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479) * redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631) * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default valkey-devel-8.0.9-1.el10_2.aarch64.rpm 0d054215154dbc73d36ca5e3c9eff8ea065b6ac4e470c31c88432b15c53fbe20 valkey-8.0.9-1.el10_2.aarch64.rpm 3c422160d0cade8908ac8ec40170129b4b578ff1a7851850cc84157187eecd8b ALSA-2026:25225 Copyright 2026 AlmaLinux OS 0 1 Important

mod_http2 security update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.1.aarch64.rpm 5a038f074e4f2a689831e442e0015291c4984d72f0295f7c4263bc8d5036f333 ALSA-2026:25237 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383) * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076) * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180) * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181) * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182) * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183) * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764) * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766) * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767) * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768) * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769) * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770) * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445) * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446) * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssl-devel-3.5.5-4.el10_2.alma.1.aarch64.rpm 17eb3cdbff0aa11fdcd7a406072e397b6e26f041f536342c8b2f41a7c1d4c18c openssl-perl-3.5.5-4.el10_2.alma.1.aarch64.rpm c0e5435f72ef90d9cf535d91460d8db5053051b317931dd25c214fc4188b57ef ALSA-2026:25341 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat9 update

Certificate revocation bypass due to improper OCSP response validation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default tomcat9-9.0.117-1.el10_2.alma.1.noarch.rpm 05aa3bf0312387311b2ebee667eac72d7e7edec61d6304c2887bb89dce956ef9 tomcat9-lib-9.0.117-1.el10_2.alma.1.noarch.rpm 112016e28c5036aafd2dc2c8c1106032281ee655ecf0ed4660e6a407a2be6530 tomcat9-servlet-4.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm 20c189635df0064ff555758bfe0c95f21fb6875882b9d0af0d6a358047d9cf2b tomcat9-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm 4c2a31f2ac55f524c85ddedcf6348fb52bf25e3a8c51aa42bd636a679bc061ba tomcat9-docs-webapp-9.0.117-1.el10_2.alma.1.noarch.rpm 69e8e77be4f060182be8e233a029cdac2dc6d78e5dede107e51f129760e53834 tomcat9-jsp-2.3-api-9.0.117-1.el10_2.alma.1.noarch.rpm 8f03c1fb22b9b899ba5241ba26943941828f4092d11c3bf45acdfe457b177f1b tomcat9-admin-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm cc3072eda709f80d8c5d5b108fe2a57d3bcc068e817a6dad877191d45431c79c tomcat9-el-3.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm e88ff8acc2245391a6ac44a4bfd50bed1fb73d897208fbb93ff98452651fb8d6 ALSA-2026:25902 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default fence-agents-kdump-4.16.0-21.el10_2.2.aarch64.rpm 07755a58fa025913898dcb6ead3c80d7850a9d0ca4bdab2fcdbcbf03285efb89 fence-agents-scsi-4.16.0-21.el10_2.2.noarch.rpm 09ff1477d7c24e095b83789574d84696975330f2d0de542d54792c26e7974c16 fence-agents-lpar-4.16.0-21.el10_2.2.noarch.rpm 12c9076e50ad52eac0fa9c9653ce73fa79643aee1f969bc507af2d7ff138569a fence-agents-apc-snmp-4.16.0-21.el10_2.2.noarch.rpm 298e8d7a3cc1d82a186ff6a6892e4568c0979e88cd2baebaf8d23a9e24fea0a9 fence-agents-common-4.16.0-21.el10_2.2.aarch64.rpm 3a1857cfb8f72934587fe2ca1f096da722ed2cd07f9f346dd43d273c49219301 fence-agents-eaton-snmp-4.16.0-21.el10_2.2.noarch.rpm 3e29269bd4baea6327c3f106e567ba79252914196c7d9d6de1691b9b887f5016 fence-agents-ifmib-4.16.0-21.el10_2.2.noarch.rpm 3eae36839b0c37587393fedd0a94d391c7c1b32d4e0038aeb872ce77dcbeac65 fence-agents-drac5-4.16.0-21.el10_2.2.noarch.rpm 3fd2c64de218b8f14a264b6d4c513527490c25f44ac7974c6ef31fb84798dd4c fence-agents-redfish-4.16.0-21.el10_2.2.aarch64.rpm 4787f6458bd6f79948dba9f655c3b03829ae6a4d5396a86f8e6a08d981a62df0 fence-agents-eps-4.16.0-21.el10_2.2.noarch.rpm 50471bc1d7292ee0054f58620f7119f9f2224ef4260b8a953fba66633ec4adc0 fence-agents-rhevm-4.16.0-21.el10_2.2.noarch.rpm 526fcda8f27eca140ad19bc1b50f05fde1e332027a94e23cb2595e6544c91903 fence-agents-cisco-ucs-4.16.0-21.el10_2.2.noarch.rpm 5f0c4629ad31c1b9bd98c26300a2555a858e7da9be98323d3705bb2a17d23d33 fence-agents-apc-4.16.0-21.el10_2.2.noarch.rpm 600b0a86968f0aaae3296c8da0b70e18f2cc7836e9b007c314dafa38da84a8be fence-agents-ibmblade-4.16.0-21.el10_2.2.noarch.rpm 614315d7378c63e0844826317ca53254844a3938c32f3665bf1df10dacb31d62 fence-agents-ilo-mp-4.16.0-21.el10_2.2.noarch.rpm 6731b497ac7785ff2dfa81e440a312e85ac8e725199bb261a3290e15f4a3d6d5 fence-agents-ibm-powervs-4.16.0-21.el10_2.2.noarch.rpm 6ce383af0646539baeb184e2641a29ae6df028240286e91f57c016285057771a fence-agents-ipdu-4.16.0-21.el10_2.2.noarch.rpm 8368915fb9a5f0e382da7f974a5e4bad3c7a34142bd9ce52c57c100697a5e366 fence-agents-kubevirt-4.16.0-21.el10_2.2.aarch64.rpm 8e0c2e540bd9fa591fa65e89fc010879882077bb9860319154122787b4b2942e fence-agents-ilo-ssh-4.16.0-21.el10_2.2.noarch.rpm 90c5f69dbd53eaddbb46b7de1584000376afcb442f82782208b63a07ddfc9bdf fence-agents-nutanix-ahv-4.16.0-21.el10_2.2.noarch.rpm 970f4b76795e517102ff1e870b5e2a7be172ef477fd8821eb3e190b99f0af539 fence-agents-hpblade-4.16.0-21.el10_2.2.noarch.rpm a12bb2e9542b76485ce1221906f35e37ff7d6a8f2a241d21f6547347683b5a4a fence-agents-vmware-rest-4.16.0-21.el10_2.2.noarch.rpm a236afaca18d09d042be0d498c52c254bca90aa39d7048b9c3d72fbe2a966a76 fence-agents-intelmodular-4.16.0-21.el10_2.2.noarch.rpm a2bd565e1af480ce00436ca7608818bf704d05480762acfa13b190ec1005bfcf fence-agents-ilo-moonshot-4.16.0-21.el10_2.2.noarch.rpm ab44451f3d94da168a7e3b360f7b9aedaa9e42107bdc97e68befbf4d4ee759d3 fence-agents-mpath-4.16.0-21.el10_2.2.noarch.rpm b2ccee8dd645e52151c781abd778eb861ab3d54b5f99a252ce703f56bd144800 fence-agents-emerson-4.16.0-21.el10_2.2.noarch.rpm bab15153adfef696f0496913ac9161a048bd71b538b1691aa0bf3c8d8ada5590 fence-agents-brocade-4.16.0-21.el10_2.2.noarch.rpm bb0c8a0011dacba56e4874d5634add35a6f754e354513e4b6cd736bfa70e0cf8 fence-agents-heuristics-ping-4.16.0-21.el10_2.2.noarch.rpm bce9f617920cf266311a3e70eabdf9efc748e71a34550fc398f1d09a1f866c3c fence-agents-amt-ws-4.16.0-21.el10_2.2.noarch.rpm c1311ad03e9d6aaecf221246f0a33f34e04186c91c4f94936a73ce91f0b8db62 fence-agents-sbd-4.16.0-21.el10_2.2.noarch.rpm cf3c3cd8d2407a4b215021e252553d437c3251f3f621c8600b1df2d2bf4c1be4 fence-agents-rsb-4.16.0-21.el10_2.2.noarch.rpm d1087cec15bbee8464f580cd85448b7b671ec9b6b50e7f414c01cebf25a27af6 fence-agents-wti-4.16.0-21.el10_2.2.noarch.rpm d4442641c3bdb9695e3303315183f9df36ea59d0979749e0fa73a2dc062a307c fence-agents-virsh-4.16.0-21.el10_2.2.noarch.rpm d4ea6c9d27d6b72c2ec4588d5b86ece102a2e5b5189970f0da144bdea249084d fence-agents-ilo2-4.16.0-21.el10_2.2.noarch.rpm db55586c824957f510c58c45bb2f1e13b97c5a8e23cec28841a2fde724ad0cd5 fence-agents-ipmilan-4.16.0-21.el10_2.2.noarch.rpm e115cb7a9584a1268df698f1c2808d858f01ae1dcaa9502ab776538cc16b7458 fence-agents-rsa-4.16.0-21.el10_2.2.noarch.rpm e50d48d8913ec8dddde456634ae7d0fe1110e61c50c0b31dc281bfc30173a4bb fence-agents-vmware-soap-4.16.0-21.el10_2.2.noarch.rpm e5953455691ce0520db86e36d4a0520df1aa88bd8345553743a6c5d9eab94360 fence-agents-bladecenter-4.16.0-21.el10_2.2.noarch.rpm f2c5425b489f9273f19850815a2fd2af26422f93e9111fa72c09114aa8974593 fence-agents-cisco-mds-4.16.0-21.el10_2.2.noarch.rpm f65d2ca2ae09bc957279acfab3819afa89a6b4fad45c221655d3f53ba90126d5 fence-agents-all-4.16.0-21.el10_2.2.aarch64.rpm f727c39c80768251921a24ef34ccd05ab01c7ce20d040d5fd081e2ea71811ea7 fence-agents-ibm-vpc-4.16.0-21.el10_2.2.noarch.rpm f86bf5b2eee3fe4a01366a531f4012957b6b7a9030f7c02c9ebae1fda6d2874f ALSA-2026:25930 Copyright 2026 AlmaLinux OS 0 1 Important

postfix security update

The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS. Security Fix(es): * postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postfix-cdb-3.8.5-10.el10_2.aarch64.rpm 291cfa30e369b785e715c6161a80474da27c4d20b186bc5bc0f150ff43deb99c postfix-pgsql-3.8.5-10.el10_2.aarch64.rpm 413703f81ddfa9f7507a8d74a90bbb4b24ce00e1f32c5d016ec3fdbdefe7a45f postfix-perl-scripts-3.8.5-10.el10_2.aarch64.rpm 4f1d986d093e12137f7e34b16d48f254464b7cebf08a340bbdbbaee5f65bc659 postfix-sqlite-3.8.5-10.el10_2.aarch64.rpm 53713fcd00d1c27c3478ddbe1665c1cfbfe75d3b96d8957004774a6000d5de6f postfix-ldap-3.8.5-10.el10_2.aarch64.rpm 801d485c45585aab0cd6c4319e25c9fe37aaffc10b582dd9b285f63f7f16b0d6 postfix-3.8.5-10.el10_2.aarch64.rpm 9a85eb84e6cc0c07655f06f95510b8ecc413e1facb10d3b65e38ca5a441a1cd2 postfix-lmdb-3.8.5-10.el10_2.aarch64.rpm 9d29901080e7bbed967dd3cf36958d80114774a1e5fdc2b69446ed34714a1454 postfix-mysql-3.8.5-10.el10_2.aarch64.rpm ccdcdae0e1f879fab6c4fd5cabefc7d2754dda1278e273c17994b49a0a192c06 postfix-pcre-3.8.5-10.el10_2.aarch64.rpm e001106e395eb19bfb6e16c96c64236d88343f6b8d8b1b73149ed2a5fad33690 ALSA-2026:25999 Copyright 2026 AlmaLinux OS 0 1 Moderate

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-7.el10_2.aarch64.rpm 93b32b03617c0d712b9154c331853fb7b32cae09733a5d8d65213ee20de34a6c ALSA-2026:26332 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618) * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518) Bug Fix(es) and Enhancement(s): * Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rsync-rrsync-3.4.4-1.el10_2.noarch.rpm 540a428308cad863c69c33ed960b0bc940301aa9b2b59258a14f1fc3273c97b0 rsync-daemon-3.4.4-1.el10_2.noarch.rpm c41feb2a21f43ce9aa84fc833bcabb0d96f6b707a7ee6ccbb51ade3b02c7e18a ALSA-2026:26532 Copyright 2026 AlmaLinux OS 0 1 Important

dracut security update

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dracut-live-107-7.el10_2.aarch64.rpm 97a6f206ade338f11a48889820ca3e8221215f780016c75f6fcf26011648c64d dracut-caps-107-7.el10_2.aarch64.rpm fbac076cf1e68f19623dc5a689be9d2a7e7f386c3ee78c12d0e31bf366a7b786 ALSA-2026:26566 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security, bug fix, and enhancement update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xwayland] Backport other security fixes without a CVE assigned [almalinux-10.2.z] (JIRA:AlmaLinux-184290) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.2.aarch64.rpm 8223d2787289b7374246d028beda39c979edd4d27e277d1de47ad2a877510c41 ALSA-2026:27288 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) Bug Fix(es) and Enhancement(s): * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047) * AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774) * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495) * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723) * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127) * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319) * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-doc-6.12.0-211.26.1.el10_2.noarch.rpm 11db01dd6e6ddd890f4d22adb09a488c7d4dc0295f2128ecd209e94fadbced54 kernel-devel-matched-6.12.0-211.26.1.el10_2.aarch64.rpm 33888e784f0fe32051290c9f9119a07458f9a10fdbb86bcb09f26ce16aad55f1 python3-perf-6.12.0-211.26.1.el10_2.aarch64.rpm 3adb60e43bc6677088085fbc14c32e1e1a2a241e03cf726723feef3c343cbd2a kernel-debug-devel-matched-6.12.0-211.26.1.el10_2.aarch64.rpm 3cf3a7f3bfcb2fe6f3fe1b7f301295eba89d8f8c753a1c644bc7ade9252578eb kernel-64k-devel-matched-6.12.0-211.26.1.el10_2.aarch64.rpm 49d4bcab68551d7c06f5c41caee58436d72ff52fd5da35b853a4970d9ef2a715 kernel-64k-debug-devel-6.12.0-211.26.1.el10_2.aarch64.rpm 6171772270e51546da15da6280a0243a060dbfd22f748e667d15214c853c028b kernel-devel-6.12.0-211.26.1.el10_2.aarch64.rpm 74e153c37b4fb51b89c53180111e76788f31f19abdf57bc94d914043868b214f kernel-64k-debug-devel-matched-6.12.0-211.26.1.el10_2.aarch64.rpm 7c00f31dc5dd6edd53f32500264ba7ccad53c6a31d3eb21fdcc6304645308a53 rv-6.12.0-211.26.1.el10_2.aarch64.rpm 889a9d5cea134e05e2c7824f3f063f9575d1a457abfa639331ab49ca6644b38b kernel-debug-devel-6.12.0-211.26.1.el10_2.aarch64.rpm 9cab1567ad3b1a36d8d08310679f1e270c2ad567125e09e10b4300daa908a0a7 kernel-64k-devel-6.12.0-211.26.1.el10_2.aarch64.rpm a3c72ea3454a307a5a52dad79f51aa45ee603999c9b877bef9c03880561385d1 kernel-headers-6.12.0-211.26.1.el10_2.aarch64.rpm b64f7cd9048710ece876f90de24f36ffb84ba458d8000864dfbe50cb263a5a90 rtla-6.12.0-211.26.1.el10_2.aarch64.rpm d75e0c22a58db17f4fbd4115ea72a28415da47201e5d281c72544f7c07ca182b perf-6.12.0-211.26.1.el10_2.aarch64.rpm ec2a3fcb5cae5f450ca1a7e361fc301b33db38b2dd30ff1b17a47bb588f76b14 ALSA-2026:27733 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default firefox-140.12.0-1.el10_2.aarch64.rpm 0dfec6210a69fa367af431a1add2ad9eab2abea482999e69712acb69af6334ec ALSA-2026:27742 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postgresql18-upgrade-18.4-1.el10_2.aarch64.rpm 0ea79efaab231a0dcfd7ece23b6dd9bdd938bcab2397cf3ea5a664c7891d1b79 postgresql18-upgrade-devel-18.4-1.el10_2.aarch64.rpm 0f872d729168456ae4775924f030a87921d70ffaddb6ad5bffd5cc7a8451b802 postgresql18-static-18.4-1.el10_2.aarch64.rpm 17c8660005d574803e62e7a8404ee89b57eb91d59727c7ba2dce0feec531bfbe postgresql18-18.4-1.el10_2.aarch64.rpm 196d440b30242708a84af913e2c4a8d7e61fca0666d240b090271e3c3767a69e postgresql18-server-18.4-1.el10_2.aarch64.rpm 1fcde8936b494b93f3d26cb9ed7d230e27723b4aaeea6b6da0369445a54dee51 postgresql18-contrib-18.4-1.el10_2.aarch64.rpm 7f7ae3e6ebaad9e0a72676c76d7c8658f39537bc226efd3576177fab84f9cdd8 postgresql18-private-libs-18.4-1.el10_2.aarch64.rpm 82963e72ff59e4dbb578bf55bc114d2a731966ffbc96cd61b72448131a11dd55 postgresql18-test-18.4-1.el10_2.aarch64.rpm 9043b779ccca395b679600a40db4c7b377fdd368df6302459ebd8445b0360af4 postgresql18-plpython3-18.4-1.el10_2.aarch64.rpm 94bed68a9cd932903562a408a231d47720318afebc21253fb9f02e5a9eb72369 postgresql18-docs-18.4-1.el10_2.aarch64.rpm a6b6cd89596fdcbd07065de60334b610f2af814033512a331a48d3adceafcb18 postgresql18-server-devel-18.4-1.el10_2.aarch64.rpm aefc41c8f2466c99d1b022edea35391df71ca9a169971a84ac758211fbecc0e9 postgresql18-private-devel-18.4-1.el10_2.aarch64.rpm c01c320cc74e1fadfcfc5d708d1d4355a9f44fe9410609eaae4fc19d36119424 postgresql18-plperl-18.4-1.el10_2.aarch64.rpm dbffecf83a5b1b8fc43deace967d8c644d856104056aa799d8c970ce9d7e7d88 ALSA-2026:27743 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postgresql-test-16.14-1.el10_2.aarch64.rpm 02550f2a17e107d47773c462ed8615f8280e6be029821312318bae41e07b611d postgresql-contrib-16.14-1.el10_2.aarch64.rpm 205c2a38e6f59ca8a424802a66e8a3aaf7c78b7a656d417ad8aa581d12065cf9 postgresql-private-devel-16.14-1.el10_2.aarch64.rpm 3020baf649c422919bc23152a81f092c93177dc13e786c53bbd2a1b334c269b2 postgresql-docs-16.14-1.el10_2.aarch64.rpm 30d5a7a836afd6c1d5a571786ad641b63611fd342bbe87e8c1eb41968a1444ca postgresql-upgrade-16.14-1.el10_2.aarch64.rpm 3bb5f47a78b72d8246cf388fab492263e415960b9a4cc81292d92f038179d0ca postgresql-16.14-1.el10_2.aarch64.rpm 55731064834a3f6229e80e0c2d4dd1fbc243968a9f1ffa6622e943e1c6007ed2 postgresql-server-16.14-1.el10_2.aarch64.rpm 608cc46bf84032055805605505508d1952d84192e50ffdc6633a4154ebcb0819 postgresql-plpython3-16.14-1.el10_2.aarch64.rpm 765c9bcc24b023d6ce25171f60c254686d25843fd4ec6a34316b7c544b99706d postgresql-server-devel-16.14-1.el10_2.aarch64.rpm 8df06ad5a163a5b0c065abd28f0590859b321bb76357938b79f5c85ed3e35cd7 postgresql-static-16.14-1.el10_2.aarch64.rpm 9609274a1592b7eb25145f80335e50db14acb792c3386d4205d6563b0f5f473e postgresql-pltcl-16.14-1.el10_2.aarch64.rpm 9aa96fd3cfe1e93d02b9cecb98028dd0d01f6ed6184fe8a2eaabe55cf627cdab postgresql-upgrade-devel-16.14-1.el10_2.aarch64.rpm a812368d04acb5e8eb9926477893de1956072b83fd40011caeb0dae13b38b901 postgresql-plperl-16.14-1.el10_2.aarch64.rpm e253ccbe4b05df256fab479dde57f30fa51548dae40011118512e969e0e0d6a6 postgresql-private-libs-16.14-1.el10_2.aarch64.rpm e7b3032a391e9efb14743496a411883ef8aff277aa882f93e131ae6b22a074f8 ALSA-2026:27842 Copyright 2026 AlmaLinux OS 0 1 Important

memcached security update

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load. Security Fix(es): * memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default memcached-1.6.23-7.el10_2.1.aarch64.rpm 28602fac8a531bffff63e5d963707821ebde163f53c1d8095c8a6d647c7a17ed memcached-selinux-1.6.23-7.el10_2.1.aarch64.rpm c922c827213e6744c3310deb2a377bf39d3169b7f17be90a1934f6633799f3ff ALSA-2026:27929 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432) * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3.14-urllib3-2.6.3-2.el10_2.noarch.rpm 57130c6cb8bb3cf561d8de37fc42674c447fb5b7868aa36aa521c9f85eb9cdd9 ALSA-2026:28210 Copyright 2026 AlmaLinux OS 0 1 Moderate

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default vim-X11-9.1.083-9.el10_2.4.aarch64.rpm 1c73a741e774178a400ce5260d144ec32343470404e100a928fe686c9e09a907 vim-enhanced-9.1.083-9.el10_2.4.aarch64.rpm 2eb36db88c53c67882a0144aa3e1ef4e12ffeeafb624a7f9fbcfe87bc1360009 vim-common-9.1.083-9.el10_2.4.aarch64.rpm 60196ab2d438519b3c70be92dbb9ccd724aa788e406369b1507de08b7802c199 xxd-9.1.083-9.el10_2.4.aarch64.rpm c67abfb821ea1fe95291c454d3f4fbe15ba08c56db13d5ef3717023afedb038a ALSA-2026:28233 Copyright 2026 AlmaLinux OS 0 1 Moderate

libpng security update

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libpng-devel-1.6.40-11.el10_2.1.aarch64.rpm ce8b7e858f43b99beb04d771a71230666ac47bd4ac2ed6384f66a737a67cb50b ALSA-2026:28234 Copyright 2026 AlmaLinux OS 0 1 Low

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c (CVE-2024-34459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.1.aarch64.rpm da3fc0f361dbbb390e59ab926ba4dc0b9b061929df59c1efccb9b6f0354d6805 ALSA-2026:28235 Copyright 2026 AlmaLinux OS 0 1 Low

libtasn1 security update

A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions. Security Fix(es): * libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string (CVE-2025-13151) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libtasn1-tools-4.20.0-5.el10_2.aarch64.rpm 4b7c2610fdbc255ba3e2030bd4a963d0a156b37f656b835bdafbcec0f21cda57 libtasn1-devel-4.20.0-5.el10_2.aarch64.rpm ab66beb80a547044e194a3a377af5fe5a6aaa2658df7fe66a9434ac9819e7b4b ALSA-2026:28236 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsolv security update

The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150) * libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (CVE-2026-9149) * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-solv-0.7.33-5.el10_2.alma.1.aarch64.rpm 9ae4a8f37c17788d1df05dd85efca3749fe4bff98393853733bd443d7b9f992e ALSA-2026:28581 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019) Bug Fix(es) and Enhancement(s): * [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3.14-3.14.5-1.el10_2.aarch64.rpm 855a84d5c9d73f6e7678f0f46c83d5a604a5ca396f504a98509ab92c492f1a5b python3.14-tkinter-3.14.5-1.el10_2.aarch64.rpm 8cffeb0658e4353e5901c337c605c819702b843c8e06f06ab37e114b0e8e6d10 python3.14-libs-3.14.5-1.el10_2.aarch64.rpm ad65036c84f418e1c662dbdf8de0b4c1a5e855ee7c50c34c5947a2fe8601940d python3.14-devel-3.14.5-1.el10_2.aarch64.rpm d1827d983e70e10ab487eedc9aa5cd2e003d8da0d6c90480c315330c3e7a69c6 ALSA-2026:28582 Copyright 2026 AlmaLinux OS 0 1 Moderate

keylime security update

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default keylime-7.14.1-5.el10_2.1.aarch64.rpm 02906b2fd442799b46e5634b5e6ea75607e741c7f9489d533cad3eb509bbaa83 python3-keylime-7.14.1-5.el10_2.1.aarch64.rpm 3b5f34f412ed77a3cc87f4cdb89fb8d8a0311d7474cabb4a833a62274bee56d6 keylime-tenant-7.14.1-5.el10_2.1.aarch64.rpm 47da61efcdb599705d13f94c800cb3e9bfc63bd49816964b14c1e109d929bae4 keylime-verifier-7.14.1-5.el10_2.1.aarch64.rpm 4faabbbbf47898e9486d25ec4f290d0a5481102413ba49edc672c860519fbc8a keylime-registrar-7.14.1-5.el10_2.1.aarch64.rpm 82a76e548785fda6e969ccf72aef55d4694d8cd02a874990db625d594dcd8b82 keylime-base-7.14.1-5.el10_2.1.aarch64.rpm ab85b9df2adfe1b69d73b8828dd92bb3e4813b5a2330aa9b4d2f135703d29ed6 keylime-tools-7.14.1-5.el10_2.1.aarch64.rpm c1930416038862ed3df5b02c67dbe128a17115785bdef559b646e7cbe9d9acc8 keylime-selinux-7.14.1-5.el10_2.1.noarch.rpm d087cd9f6da8c7f7422c92a84a47ffcc48661ffb612541d27410ec43622a490a ALSA-2026:28584 Copyright 2026 AlmaLinux OS 0 1 Moderate

libxslt security update

libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. Security Fix(es): * libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libxslt-1.1.39-8.el10_2.1.aarch64.rpm 1ce827100b3c5ddf277247c6843229d1887fbfa397298f230124a59f931c8729 libxslt-devel-1.1.39-8.el10_2.1.aarch64.rpm e980fe68ca2999df8053d62cd8ffd454e6eeeb8e886a5295087cd344fb8056f1 ALSA-2026:29035 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default skopeo-tests-1.22.2-2.el10_2.aarch64.rpm 6dcca7d7bc11abdd81ebfbe3888e946307d322cb593df412c6286de41ad683b1 skopeo-1.22.2-2.el10_2.aarch64.rpm e2d3b913c0389fec54adf2f0772cf99bff38a6ad1ef1c3d31fbf88a0770e9066 ALSA-2026:29195 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default buildah-tests-1.43.1-2.el10_2.aarch64.rpm a3a5fee5c5dbf2c606316531617ea700caeefed12e2025acde3dcab4fab22fa6 buildah-1.43.1-2.el10_2.aarch64.rpm d253f3cbd74c1ce42c08620dc2a754257f0b2c7ee295fe4a9b9745be22fd5e28 ALSA-2026:29874 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nginx-mod-http-xslt-filter-1.26.3-6.el10_2.4.aarch64.rpm 4004357691568c3b0b961cc4b717641d3e97a134bc38b2f8171bd4cf6f9ef7cf nginx-1.26.3-6.el10_2.4.aarch64.rpm 4c6bbdcd80c6cdfc866f2836b0ebdf2157b822794d1206ee95db78d42d8ebbf0 nginx-mod-stream-1.26.3-6.el10_2.4.aarch64.rpm 562b582351d4dd0359551eb4a22c08b820bdcbd834aeac99b26965749591931a nginx-all-modules-1.26.3-6.el10_2.4.noarch.rpm 562b83c5c4657fa12e3561c30f43284f0fbc49e4d410c9f9b7f57f8dffef487c nginx-mod-mail-1.26.3-6.el10_2.4.aarch64.rpm 700a6be5e1b520affede4c63ecee1adbc37964021375f4a4324e757abb73b84a nginx-mod-http-perl-1.26.3-6.el10_2.4.aarch64.rpm 8eceaddfbb1f4ce61c99850917240bd9793d34dc09093a8f1244e023c0519bf1 nginx-filesystem-1.26.3-6.el10_2.4.noarch.rpm 9f23da9e2b3a022ca250a77c0fe4ad02e555ea9d6fc291bd81545b117d01a511 nginx-core-1.26.3-6.el10_2.4.aarch64.rpm e5aced1edd36f4ece2f9ae3712b2703c5a5d95d26eb2e7bcdb2eeaf5f3a44992 nginx-mod-http-image-filter-1.26.3-6.el10_2.4.aarch64.rpm edf96ebc8777ec1fbe3ca5c70bebb13a51b85114fc190b415cbee4eea1bbe277 ALSA-2026:29980 Copyright 2026 AlmaLinux OS 0 1 Moderate

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.4+1 [almalinux-10.2.z] (JIRA:AlmaLinux-183347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default golang-bin-1.26.4-1.el10_2.alma.1.aarch64.rpm 0e1320784503b93afdc66a90c012f2884bbec7b44aae734f01883450e376e173 go-toolset-1.26.4-1.el10_2.alma.1.aarch64.rpm 2bf5b01f6074a321dc82c922e2031c77c54364334e78b4aa72dbc85a43c26888 golang-tests-1.26.4-1.el10_2.alma.1.noarch.rpm 3726ef009f97fa8d5d3a2547243c897a2ad61b3d3bf8c47c5d2bf97663366857 golang-docs-1.26.4-1.el10_2.alma.1.noarch.rpm 833fa429b2a24d184ef4308625d865d9e06a1d3211c741a966b78c83ea469dd4 golang-misc-1.26.4-1.el10_2.alma.1.noarch.rpm 902dcd6c5009e267bf17ad6a17c944bab1e8d0806d3951286a1e40c6bed7d271 golang-race-1.26.4-1.el10_2.alma.1.aarch64.rpm aa6ed3a5b5f398918faac3035245fcb99b5fe08774c6f428d4e63b83c2af6f54 golang-1.26.4-1.el10_2.alma.1.aarch64.rpm ac580f96b1480cc2d3934332b1045a4a42d3e3d73ac4f499e58099764dea5b9f golang-src-1.26.4-1.el10_2.alma.1.noarch.rpm cfe20b9d0486e89e04d2f4b28058235230bff4d282b1571fc4c5279579e60d21 ALSA-2026:30129 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rtla-6.12.0-211.28.1.el10_2.aarch64.rpm 0c0f27ab62822fbf20119dcc7940c5b5b040ee0dcca961f5225e80da6bbd0605 kernel-64k-debug-devel-matched-6.12.0-211.28.1.el10_2.aarch64.rpm 30c778b458388cbb78adb64eaa39f02db454ee51639a91e0d2745f8009db06b1 python3-perf-6.12.0-211.28.1.el10_2.aarch64.rpm 321194d2b2267e986d80fe3c25d485ab9815978bb8401d453fa6f1fd5f488501 kernel-64k-devel-6.12.0-211.28.1.el10_2.aarch64.rpm 52d702c37b2156f0ba6b88cd0e3e0e02179990d911961e6717a6137dcbb3b8cf perf-6.12.0-211.28.1.el10_2.aarch64.rpm 55a16c30b46384763b21d2a20aece829c4322b03e46be65a610dc108c683366c kernel-devel-6.12.0-211.28.1.el10_2.aarch64.rpm 5c001a04691401bfb2d1490e59e4799cb85a30b5d1b7121813312e6a2e6910b4 kernel-doc-6.12.0-211.28.1.el10_2.noarch.rpm 7017f858229dac25fead46f7a86ea9f48bda9ff21527d8dafd2ca37464130d2e kernel-64k-devel-matched-6.12.0-211.28.1.el10_2.aarch64.rpm 704fb01fa5432dde88fbbe41caff007fa0517583b7a0f036838a668d3ffc6fc4 kernel-headers-6.12.0-211.28.1.el10_2.aarch64.rpm 8e93bb85372364ec245f7ea9e8efd5c7911da5385f1555efa1409f7952cb079a rv-6.12.0-211.28.1.el10_2.aarch64.rpm 98734bddffbe449eec0d8c3095fc57533f7c4e1143bbe86ca8950ac2f393505d kernel-64k-debug-devel-6.12.0-211.28.1.el10_2.aarch64.rpm 9d01cfcb53ceac48072fa8c5f197a2c9d3b25f41c78352748d321b0529dbea02 kernel-devel-matched-6.12.0-211.28.1.el10_2.aarch64.rpm b2e2c1496c00a774c0414e6cb5f8d9d2169277f3868feb652da3aa8f3155e957 kernel-debug-devel-matched-6.12.0-211.28.1.el10_2.aarch64.rpm d4ad30f51a9d9d89a9e11b3d1e1b8539289a85642a7206043d1f043f799fc8bb kernel-debug-devel-6.12.0-211.28.1.el10_2.aarch64.rpm ef62ed42701236d5371f60f43c97930a84b1eef54f71958fb192bdf6445b4a80 ALSA-2026:30845 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_md security update

This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal. Security Fix(es): * httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mod_md-2.4.26-5.el10_2.1.aarch64.rpm d3da73530b616cdf1ffe4f9e887cc93f9da15e1c81b8c0cece791842c8047220 ALSA-2026:30846 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default thunderbird-140.12.0-1.el10_2.alma.1.aarch64.rpm bb21cd63e6e0b8d90665430ba8504f450560248e3beccc39fc55a0c4b6ea9f86 ALSA-2026:30855 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.5.aarch64.rpm c146ff2fcfdaf4ac9b672c89ba837a2ba6a53326bf4867f050db1faae1f1c8a5 ALSA-2026:30857 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files. Security Fix(es): * perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-Archive-Tar-3.02-512.el10_2.1.noarch.rpm e6efbbe6db7984a333245143097f48825a68f0f7cc2d488c57fd1eec9db1d08b ALSA-2026:30860 Copyright 2026 AlmaLinux OS 0 1 Important

perl-IO-Compress security update

This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. IO-Compress supports reading and writing of bzip2, RFC 1950, RFC 1951, RFC 1952 (i.e. gzip) and zip files/buffers. The following modules used to be distributed separately, but are now included with the IO-Compress distribution: * Compress-Zlib * IO-Compress-Zlib * IO-Compress-Bzip2 * IO-Compress-Base Security Fix(es): * perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-IO-Compress-2.212-512.el10_2.1.noarch.rpm 741508f5ad1fac081838f6f573ee7ee5aed1ab60be165fde7eab4c556b6b2f28 ALSA-2026:33092 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) Bug Fix(es) and Enhancement(s): * Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on AlmaLinux 10 [almalinux-10] (JIRA:AlmaLinux-174869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glibc-doc-2.39-126.el10_2.alma.1.noarch.rpm 07f1c0fec3d86d729f94febb97a600a9829176f2de6b4eac4354dc95cf165db1 glibc-devel-2.39-126.el10_2.alma.1.aarch64.rpm 41c1008d375fefdbed10fd34bdc5f96581ff0be4996b07d35bc207885342d2c9 glibc-locale-source-2.39-126.el10_2.alma.1.aarch64.rpm c6142b457eedee8e26a30fe6af1a80fdc2f6e2b99d4cb90fd62fda41a877fd3c glibc-utils-2.39-126.el10_2.alma.1.aarch64.rpm e1cfe8650d96d89595db01cd6612465aa69eca517340c2a9b9b184bcddb74dda ALSA-2026:33093 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb10.11 security, bug fix, and enhancement update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux10 (JIRA:AlmaLinux-183086) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mariadb-server-galera-10.11.18-1.el10_2.alma.1.aarch64.rpm 077af148f355258681facadaca0dcc557f6dcc519a3480e5bbccfc6a4f9e18fe mariadb-embedded-devel-10.11.18-1.el10_2.alma.1.aarch64.rpm 09a5839bbf61fe2904b666529ab3ae61ae98eb58168de37e43c9f43b37f0f661 mariadb-embedded-10.11.18-1.el10_2.alma.1.aarch64.rpm 1ea9b1eb7cfdc21caae3e57a59bbf30fc09915acfe778de8d16f9ac63a031036 mariadb-server-10.11.18-1.el10_2.alma.1.aarch64.rpm 30b70d1b001bbf68c4638325a720e0aba7d051af10eb2394c5b7c7135be86322 mariadb-gssapi-server-10.11.18-1.el10_2.alma.1.aarch64.rpm 43a24405225252a4df5deb02d5fab5248db4f9259e6eb5ea6356c881c3f607d4 mariadb-oqgraph-engine-10.11.18-1.el10_2.alma.1.aarch64.rpm 44843fa92af96bac73be3e7c1b270f627d7b1bc8688789124e928264888c8b41 mariadb-pam-10.11.18-1.el10_2.alma.1.aarch64.rpm 5895936535c18a02c3fb0f309a87a002427e76305aac4cacf21467ff87496f2d mariadb-common-10.11.18-1.el10_2.alma.1.noarch.rpm 681f8ea6830f9775d238ef434fe0cb1d7ae292f04e23bb51b564dd3396b48a53 mariadb-errmsg-10.11.18-1.el10_2.alma.1.noarch.rpm 714e7719347d3e47e8ad2c0770a97c3dca85f00f5f67c30868bbc81cbeae8dea mariadb-client-utils-10.11.18-1.el10_2.alma.1.aarch64.rpm 95f54b5291154104ba12c2b2cf9e171c544543a7ef1df96d283cad538b0646bf mariadb-backup-10.11.18-1.el10_2.alma.1.aarch64.rpm 96b19f03939d5808ee6abcf789d117cbdc6b33e0ea4cd0d257630e38d3129f1e mariadb-devel-10.11.18-1.el10_2.alma.1.aarch64.rpm a67ca83d13003497be85815bcc24ff49c81a5d5646d90fd87c33f8deebf9ad18 mariadb-10.11.18-1.el10_2.alma.1.aarch64.rpm ee840fb2d91f2a2c5639149a8990be2abc76ac4ed74d4d0ac1c72c80824bebb7 mariadb-server-utils-10.11.18-1.el10_2.alma.1.aarch64.rpm fcc46fd5d727b3d878f74747fea1c4a0488c5ac88ced685c83799b869a433ffc mariadb-test-10.11.18-1.el10_2.alma.1.aarch64.rpm fea47a35d27512fb98f68b0b41e756f11b1731564b7839b132a5bc6eb7fdf468 ALSA-2026:33412 Copyright 2026 AlmaLinux OS 0 1 Important

galera and mariadb11.8 security, bug fix, and enhancement update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 11.8 to 11.8.8 in AlmaLinux10 (JIRA:AlmaLinux-183084) * Rebase Galera to 26.4.27 in AlmaLinux10 (JIRA:AlmaLinux-183259) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mariadb11.8-gssapi-server-11.8.8-1.el10_2.aarch64.rpm 0a295e317d16f4c781d96a9d1c9864b0d7e602843081c4821632b34902c3c697 mariadb11.8-devel-11.8.8-1.el10_2.aarch64.rpm 13a203e1dff43e30a79f3239f2e0c79809a475f93012d934591b45040433c416 mariadb11.8-client-utils-11.8.8-1.el10_2.noarch.rpm 1b8213a94b5a803fee91159889715d18dce58d1206715acfe2ca987d9c88560c mariadb11.8-embedded-11.8.8-1.el10_2.aarch64.rpm 37b6a02c855186a4b1bc97a01645379c8ebcaea412a97eea0de2fa8b6063ffa1 galera-26.4.27-1.el10_2.aarch64.rpm 4b1765b30559da19a735acb4dcf51069e2118753738bacc184d63ea28967fc4b mariadb11.8-oqgraph-engine-11.8.8-1.el10_2.aarch64.rpm 5189bbdf2fa6a9f1014c2ebec85859cb7f70c62a22e50a8f6c5f9bb77972bc4c mariadb11.8-embedded-devel-11.8.8-1.el10_2.aarch64.rpm 5d65b83b7f9a3ac0f4ea0ff45675bdede1a83ff97fb0b923c332d22d12a2f530 mariadb11.8-pam-11.8.8-1.el10_2.aarch64.rpm 9598009f058648b38edab051972be46b3255b8733bf4b488241f5b91f197ad8b mariadb11.8-server-utils-11.8.8-1.el10_2.noarch.rpm 9b959318939709d585735442a771104817080a3fa715a214b85e0185a5e94ac0 mariadb11.8-backup-11.8.8-1.el10_2.aarch64.rpm b10c4fa64d2bc25e353bf4741ca0dbfb8ad6784f77d70d9fde4e8f27b7c23387 mariadb11.8-common-11.8.8-1.el10_2.noarch.rpm bf247857f833df313151be70c72cf6cc08b2708a50410ff68503d30347ea33e0 mariadb11.8-11.8.8-1.el10_2.aarch64.rpm c9456c3b0438fa85430471a8ec0580d64731eb1c9125653f642d34f8926b62e4 mariadb11.8-errmsg-11.8.8-1.el10_2.noarch.rpm cedb5ef493d966e6486d252d6067e6b53503d8ae6ebdb7dd3e8f68edfd7f05aa mariadb11.8-server-11.8.8-1.el10_2.aarch64.rpm ebb4a9df18427231c591dc7fc409c9ff4991639b76c5da267cf76304612e18db mariadb11.8-server-galera-11.8.8-1.el10_2.aarch64.rpm ebe11487d38248b68bee84d81a49146c927aeebaf95e9fe734a6e8b1a1b852f7 mariadb11.8-test-11.8.8-1.el10_2.aarch64.rpm f1592ea34cfe2629497d286fc767059d5a0e1aa6df6753043cea91ed355cc0e8 ALSA-2026:33502 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default giflib-5.2.1-25.el10_2.aarch64.rpm 20603f6ab27f20010640d1c20f688f635f564071b2378f0ceda83a9a6d33f7a0 ALSA-2026:33540 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default ruby4.0-rubygem-mysql2-0.5.7-35.el10_2.aarch64.rpm 1f1dcbcea23baa3f43d9c7a9c1c2c3725de5abca54d7b386b4cc20cbffb9046c ruby4.0-devel-4.0.3-35.el10_2.aarch64.rpm 2477f21557b3bd3955ddd4c0ab82143ed8692af1226110295997d973534f8bc3 ruby4.0-rubygem-pg-1.6.3-35.el10_2.aarch64.rpm 507bc5a84cc7351513ec0265b6eed013a88e4c94f7b5856f5b612436d8df35f6 ruby4.0-4.0.3-35.el10_2.aarch64.rpm f2ef036db640cd5865558e59648ea8357c5a2297b194f859bde220134bf5c62b ALSA-2026:33565 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rubygem-racc-1.7.3-13.el10_2.aarch64.rpm 0c7e4616a8e6140414c5cb01e659608568f400a6b329da6f54aaeb330176cddb rubygems-3.5.22-13.el10_2.noarch.rpm 2f09c90f0b4981535ebbe0b5b7b4ba60dd9bf5785c27f0948403aee04d0d5b28 rubygem-bigdecimal-3.1.5-13.el10_2.aarch64.rpm 31068a0092358b26fa30190f72517f90d25146a165c1e9f3b5908efa1fc6a5d0 ruby-default-gems-3.3.10-13.el10_2.noarch.rpm 39ee09200809903651fa2e054e18cb445e9dae3f0c19984efe4045642eba7d34 ruby-bundled-gems-3.3.10-13.el10_2.aarch64.rpm 5aa80574fe267295ae616189b3c75e9d3a75b650e8f674c83c57ee829d814173 rubygem-irb-1.13.1-13.el10_2.noarch.rpm 5fe9dfe4760320749f19a851ab422764bf54367af0eb5510c9e54a95549daba8 ruby-libs-3.3.10-13.el10_2.aarch64.rpm 689bdaa582b0494bb9fb805c445d0c2085c9f22886c3b8e6350bd43ed6a1febd rubygem-rss-0.3.1-13.el10_2.noarch.rpm 77dbae3e8147ddc42bab5b6ea0d18c2e4118e0105e415dcfe6fde5793202bb0a rubygem-rdoc-6.6.3.1-13.el10_2.noarch.rpm 84f1915103438280abdc5b9e57ca39fb26ffae2bf1bc21027bd6ffc6d79f3a9b rubygem-test-unit-3.6.1-13.el10_2.noarch.rpm 866eeea21e0bb345ada37a03f5d13b57a0399196476d646d5eb5506909bc81d2 ruby-3.3.10-13.el10_2.aarch64.rpm 87ab10e6fe74d8c9663a03ce4c3d753882736af7187cbbd9f43074433d0e565b rubygem-minitest-5.20.0-13.el10_2.noarch.rpm 8d9d188779b8666f560bb68d91edd4391c9dc0cf440b9130fc0564c11966ea8f rubygem-json-2.7.2-13.el10_2.aarch64.rpm 8f9dc360bbc8e26c401801836dec0f4515a295a7b45865df4078359d4ea51734 ruby-devel-3.3.10-13.el10_2.aarch64.rpm 98b7df6aec7f2d1d3835c165f3004a82a117f1d94900a12891456c615c672a42 rubygem-rake-13.1.0-13.el10_2.noarch.rpm 9b79c2f558b1658de031381b86dd753b030592a6199883a0022919c04b379525 rubygems-devel-3.5.22-13.el10_2.noarch.rpm 9c2bdfcca295e0d66484e9c97a77cd7f3e0ac57cfdb203043fc7933c70d2ca71 rubygem-psych-5.1.2-13.el10_2.aarch64.rpm 9c72aec7821021af5d0cd523a00b375bde26fa2c188055b6a1c06d5f289c7e0c rubygem-io-console-0.7.1-13.el10_2.aarch64.rpm 9ed322cc57640b22988eb419000172dc49f536097d23415e502bce9983dd5e3a rubygem-rbs-3.4.0-13.el10_2.aarch64.rpm ac2c668cbad73693416a7ade1d9f975a4bbbef155809bd648e00c737c29adb7b rubygem-typeprof-0.21.9-13.el10_2.noarch.rpm d3a54b16ced51c5e321382a648a7fb7a1a9cac1940df6d3e2b907de4669c5d3e rubygem-bundler-2.5.22-13.el10_2.noarch.rpm dd71e0f69e1f86a3e4c35e6fd46db1e3360041d19976243b46e4612a81b06606 rubygem-power_assert-2.0.3-13.el10_2.noarch.rpm ed105a1583192586a2f3343deb1cbc054e85193e938c0fb1822c3397f0e7ffa2 rubygem-rexml-3.4.4-13.el10_2.noarch.rpm f59082b3a7963f92107e82ec2557edc1e4be848f32ef1752978e61ea1311d1c2 ALSA-2026:33685 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) Bug Fix(es) and Enhancement(s): * CLONE - [AlmaLinux 10.2 Bug] qla2xxx flash image validation failure [almalinux-10.2.z] (JIRA:AlmaLinux-181887) * tegra-se fixes and updates [almalinux-10.2.z] (JIRA:AlmaLinux-182759) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-devel-6.12.0-211.29.1.el10_2.aarch64.rpm 26eb86464ee7c292e12e0761630e813656c012c0d2c08d3cfad843f91310cb59 kernel-headers-6.12.0-211.29.1.el10_2.aarch64.rpm 72ddb978cd65224ad232716342590bf3eef922b96943609f85f8605cdc4f5ee8 kernel-64k-debug-devel-6.12.0-211.29.1.el10_2.aarch64.rpm 84dd50716a3c61ed18699924092fceb154f56af96348317aea2c2244968f654e rtla-6.12.0-211.29.1.el10_2.aarch64.rpm 8d5299186abc90609b2b1ebe6263a0e2b55f1fb5da2022f37338874ad9349763 python3-perf-6.12.0-211.29.1.el10_2.aarch64.rpm ae7f8cbb3bf1bc7c58d3bdde04874b385f68ba7ec7a32e6f90ccffa09f8f23ef kernel-doc-6.12.0-211.29.1.el10_2.noarch.rpm b836e329534f6755772c1ddbdf8b9206b050a9efd1b92e1c01c0d98fdd9037c7 rv-6.12.0-211.29.1.el10_2.aarch64.rpm b9f2325a310dc4b795830713b05eda7cbedcd5e2ff55fd1c9e9927c69d331d67 kernel-debug-devel-6.12.0-211.29.1.el10_2.aarch64.rpm c4eeb8ae679548d735ba52e0b9ee16ff303f1a6dbae361e3a2799cc8afdaf7c9 kernel-devel-6.12.0-211.29.1.el10_2.aarch64.rpm c87fcea8597beecf9760e712f0b37c81578db7df9e12dc3c49f8fb71ea0dcc89 kernel-64k-debug-devel-matched-6.12.0-211.29.1.el10_2.aarch64.rpm dae03a33ec8b8728fcfb7555f03eeadd812de5cca7fd17c0d085fc02be312a2a kernel-devel-matched-6.12.0-211.29.1.el10_2.aarch64.rpm e108557d8dcca94c9f5a4dd1b92d3a9b88ecf244b89b42bead6443534aab2ad3 kernel-debug-devel-matched-6.12.0-211.29.1.el10_2.aarch64.rpm e214f9d6aaab71a0997f36bee3ea1d41c5de4c32d56245e13841a06865e8c713 perf-6.12.0-211.29.1.el10_2.aarch64.rpm ec97f0dc44a0b5016ccbd8d3166c1c88eb0701a259e93bfc70a3900db6fb4d88 kernel-64k-devel-matched-6.12.0-211.29.1.el10_2.aarch64.rpm f22be2d6fc4c052367a0bc15b98831f3492fe20b012935e721c03a9dff13068b ALSA-2026:33731 Copyright 2026 AlmaLinux OS 0 1 Moderate

rrdtool security update

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density. Security Fix(es): * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rrdtool-perl-1.8.0-21.el10_2.aarch64.rpm 39c8d5a85607a7e58ae707b963a6cf6a34e4815afcacd8d8eb6a2f543f288b3d rrdtool-1.8.0-21.el10_2.aarch64.rpm dc34edc145b57c2fcdb875d6691b7ebe0f550942764f3501be6dc21a874ffb39 ALSA-2026:34109 Copyright 2026 AlmaLinux OS 0 1 Important

httpd security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) Bug Fix(es) and Enhancement(s): * address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default httpd-filesystem-2.4.63-13.el10_2.4.noarch.rpm 30a9431c19d9b0eaee77dd0b3a9c83a8c8a3a28bd86f1779bae9f85de7bc9f30 httpd-manual-2.4.63-13.el10_2.4.noarch.rpm 5e32be7a095c8c1c4519272d18d660a3422b7a943ac850a731cff5f11027152d mod_ldap-2.4.63-13.el10_2.4.aarch64.rpm 73aaec40ad393d802255b323d05abab817190a50ac21fcec62296a840e5e6828 mod_proxy_html-2.4.63-13.el10_2.4.aarch64.rpm 7702f911f6289c6fbc63f35020c7e78bb6522a7a98f4b7cb97faee50c446bd6f mod_lua-2.4.63-13.el10_2.4.aarch64.rpm 8381f2ef25e4c971456954ff1f45f07de4c7ef32a41a023d094057cb31289473 httpd-2.4.63-13.el10_2.4.aarch64.rpm 839bb7c46cfbda8089d7ab22641550451fd0eb8aa183b79356a9b70e5af4ecc2 mod_session-2.4.63-13.el10_2.4.aarch64.rpm 913f32f9dc2d86123cd4427cf374b223c29abdeac3243a70e7100bfba1b8c77f httpd-core-2.4.63-13.el10_2.4.aarch64.rpm ad1d95f599958df7e6fbe328beba9855f38f7a511cb7e5816b2a9598e33ffff2 httpd-devel-2.4.63-13.el10_2.4.aarch64.rpm b6b95b4bf34c82fb63af257254951b965174664d33a4784e30d32a988fcfab36 httpd-tools-2.4.63-13.el10_2.4.aarch64.rpm eb1c741cfb635dde4d65dce20fd6721629add3b703430bc56377825aadded105 mod_ssl-2.4.63-13.el10_2.4.aarch64.rpm ec4384668cdc722448a6e8e9d48396a36c0ddea87b65a145ccffa73a3a659323 ALSA-2026:34355 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_http2 security, bug fix, and enhancement update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Bug Fix(es) and Enhancement(s): * address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:AlmaLinux-188008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.2.aarch64.rpm 9b89ef86f1c348c9554f9d80f2d7e521100db343b986c49ca87b4e99740bdb7a ALSA-2026:34357 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default opentelemetry-collector-0.152.1-1.el10_2.aarch64.rpm b69efdd2baa3a6de54776cb3c5209f9207e068b2bce5a6ac7c087a6fa3018cb8 ALSA-2026:34911 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) * kernel: kernel: ipv6 frag escape () Bug Fix(es) and Enhancement(s): * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z] (JIRA:AlmaLinux-182537) * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perf-6.12.0-211.30.1.el10_2.aarch64.rpm 05f684bf6462d7ca72c959480cb3d4368b33ff66fcbc76e2cc1d1e2ce03ebc3c kernel-debug-devel-6.12.0-211.30.1.el10_2.aarch64.rpm 1a5b82b37cdeeffa388033047cb3ee845beb6e32d80c1a2b61cc64ecd53f02e0 kernel-doc-6.12.0-211.30.1.el10_2.noarch.rpm 37071c47ef6d33902382a8ed775082ac0e87202627db8e9d81a39e5f0fbdfabc kernel-64k-debug-devel-6.12.0-211.30.1.el10_2.aarch64.rpm 42de07bced94951db2aaa4a9a3412d34e630b1a56ec26b2bb24538d050c46b6a kernel-devel-6.12.0-211.30.1.el10_2.aarch64.rpm 5106dbd8d7c2afe0514ce516df951e8090d78b9cc3d9a79ef59146521736d714 python3-perf-6.12.0-211.30.1.el10_2.aarch64.rpm 6b44445edf7b3f5a934868a8ab45f91c09cfc5221484ee3e3a32964e7dc24db1 kernel-devel-matched-6.12.0-211.30.1.el10_2.aarch64.rpm 73d37b7bd4884e837082bd1e1bd3838ae2c88bdd9fb6c3f89f98ce488022b1e1 rv-6.12.0-211.30.1.el10_2.aarch64.rpm 75dd95e5c4b634748d1d8010bfe1b3d8a609917115cfed507304929cc3ae5b96 kernel-64k-devel-matched-6.12.0-211.30.1.el10_2.aarch64.rpm 9519435657a8dd86547de7c8705a22400192f9265fda581e12ecf7a72849d520 kernel-headers-6.12.0-211.30.1.el10_2.aarch64.rpm c85a076449dbb6e9a126655ce0924f845e66e8dde580c55707ef79f93c047809 rtla-6.12.0-211.30.1.el10_2.aarch64.rpm ca016cf19a6a1d690d46ab72fd6d999c90370302766d729bb75856294353b6ba kernel-64k-debug-devel-matched-6.12.0-211.30.1.el10_2.aarch64.rpm cc3ccccfe1741d02d5d302a42793217cc88a3ec068a31624701240fcd85c0d69 kernel-64k-devel-6.12.0-211.30.1.el10_2.aarch64.rpm dc44bc3814c34c5bb7d4637abf209d9228a37734def260384fa15c0d2795447a kernel-debug-devel-matched-6.12.0-211.30.1.el10_2.aarch64.rpm fc19d52281441620b0f6e5302c43b7b47262f0f8f2cc8cff1224c1708fc32a3c ALSA-2026:35826 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default grafana-pcp-5.3.0-7.el10_2.aarch64.rpm 64137909f3ba3d445afebf6b38fd9894b444439dd195425a442809e4c11d3088 ALSA-2026:35827 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default grafana-selinux-10.2.6-27.el10_2.aarch64.rpm 4ea561deb71b38a36309f55153ccb7953d279d256552ce06968ab13de31c21d1 grafana-10.2.6-27.el10_2.aarch64.rpm d3f80e785a2039de589b439f9c2a187826729e5ccf0fa84954fada7d301eb8ce ALSA-2026:35832 Copyright 2026 AlmaLinux OS 0 1 Important

golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default ipp-usb-0.9.27-7.el10_2.2.aarch64.rpm efb3e86a8c1fcd099dd599a57cc96ca0ed329382570fb2dee97b61a707ddfb5b ALSA-2026:35841 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs24-full-i18n-24.18.0-1.el10_2.aarch64.rpm 17893ae76be6864e04edff7ab4db13d75055bc1cbc4bc00c3b11c10263a98c02 nodejs24-libs-24.18.0-1.el10_2.aarch64.rpm 3a22d86941f8b3726797aac86b6ee4a60094e1408cc25743a350237a38866b41 nodejs24-24.18.0-1.el10_2.aarch64.rpm 98937aac705ff5b14dd3522c370aaedf22651eed7f8df3545b11ef6332d163e4 nodejs24-npm-11.16.0-1.24.18.0.1.el10_2.noarch.rpm b26d8267ca66276f7e691e6ae46d36fc0beaccc3064246c73bf7e97f5437ff7d nodejs24-docs-24.18.0-1.el10_2.noarch.rpm cfbfb133600350bcd79f384de1fe77fa2508bf7bbac0e804b4b4b5991450e772 nodejs24-devel-24.18.0-1.el10_2.aarch64.rpm e4ded7bdbcd76be7f868c90aa5ae440d3e25af195432deef2d63cfc843c1d822 ALSA-2026:35842 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs-libs-22.23.1-2.el10_2.aarch64.rpm 1418cc3cc68c6067ae09576c28cb298e01b2233e7258948be27149fe28bdd177 nodejs-npm-10.9.8-1.22.23.1.2.el10_2.aarch64.rpm 15782ae93a16390f7f109632bf1df72aef35dea574b63c8ab168a8f3bc01054b nodejs-22.23.1-2.el10_2.aarch64.rpm 3f1bc61157a0e6fcd8f68c15172db625a2d8bc297a517ab5a32db95bd428957d nodejs-docs-22.23.1-2.el10_2.noarch.rpm 492a598f325fdb1de667b1cf3eb563ff290a931816399634238410c6852efc36 nodejs-devel-22.23.1-2.el10_2.aarch64.rpm 5f58c12bf37334084db2993e52f16929554ff4bca8d935cef475c2186a42628e nodejs-full-i18n-22.23.1-2.el10_2.aarch64.rpm ec8c46568d7b97abd421e98dbf44e8decd12c4d62fbca422117418340a5b0551 ALSA-2026:36193 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-pip security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3.14-pip-wheel-25.2-3.el10_2.5.noarch.rpm 80456c6bf4f96a398309a5858cf83bf96d5c0f655b8b581a95e3ff83b8664e80 python3.14-pip-25.2-3.el10_2.5.noarch.rpm 927cdfb0565ce93516e52106bc6c1092e3eb33f3170f0a74c8dfae46233929be ALSA-2026:36196 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default 389-ds-base-libs-3.2.0-8.el10_2.aarch64.rpm 581fe74e22f1ce5f06cba17152abe7167c565798a133184d1d2f24b8ff4004f9 389-ds-base-3.2.0-8.el10_2.aarch64.rpm c6df13a192b214345b68e492873dd1eb159db79617ff43716116bf3aa1e3d743 389-ds-base-snmp-3.2.0-8.el10_2.aarch64.rpm d334c173b70254c51d9c3fce8abb1c764b38f274663f191b88323fb8e8eaada9 python3-lib389-3.2.0-8.el10_2.noarch.rpm db8acba0242228f0760021708fbba6f09ec6c3ed8b57470de69e594a8a184aa0 ALSA-2026:36199 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default buildah-1.43.1-3.el10_2.aarch64.rpm 12824731bca2508d6a06b74bb58bcf79b71970918613dd965437e60bae2dab31 buildah-tests-1.43.1-3.el10_2.aarch64.rpm 710424dbfa2d405e6d1722ac82f765e54fbdc3572b64eeb132e100849fc4dbb7 ALSA-2026:36203 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033) * freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422) * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700) * freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421) * freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.6.aarch64.rpm 325ae44d46691946f0ca08826291f64ad0302283829a69511aa484aa90071e3b libwinpr-3.10.3-12.el10_2.6.aarch64.rpm 45daf50e53aa858f7d95bfeb26c947eca56b2889b07af4be5a118cd6c6a75219 freerdp-libs-3.10.3-12.el10_2.6.aarch64.rpm 9064db4548d23609e70655eefe1141379a5edcb10d69bd66590615c386f705ec ALSA-2026:36211 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default freeipmi-ipmiseld-1.6.18-1.el10_2.aarch64.rpm 3fa0a90345442bd34c306adb15732042726097460d944b7cfc31817a47671bfb freeipmi-1.6.18-1.el10_2.aarch64.rpm 42e1c3f29d5d7f151f1329e1d7ecf412a4833ec5a191c733baa6674ccbb1bd9a freeipmi-ipmidetectd-1.6.18-1.el10_2.aarch64.rpm 806db92dc10b41584d54df1fd54f7e5bdb74dbc8bdbdeee037da313fe4f983e6 freeipmi-bmc-watchdog-1.6.18-1.el10_2.aarch64.rpm a509e8f0e78e6c75aff46f7201faaf02502326f737b4f186587e6841fa2ba3e2 ALSA-2026:36320 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292) * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622) * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390) * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default unbound-libs-1.24.2-7.el10_2.2.aarch64.rpm 66300164d781913eca797a614e3c555931764cd4e4991f032ba241e3d0faae21 unbound-utils-1.24.2-7.el10_2.2.aarch64.rpm b6068d699ecd6459d0647819d6ef65d9550240de5d3d570b21eca3e5a7595b14 python3-unbound-1.24.2-7.el10_2.2.aarch64.rpm b756736bdf4e76f9d03f36c5507add3185b8107cd690a835e02c81f0a79e5b80 unbound-dracut-1.24.2-7.el10_2.2.aarch64.rpm cdcd3c38731e3798127d5ab4b6d268061ea6f58193b0cd37cebf09cc2ea29a19 unbound-1.24.2-7.el10_2.2.aarch64.rpm d49edc6237bf531439c3fc4be9c079738fc241a34c9faf9f1a6541aec034d8b8 unbound-anchor-1.24.2-7.el10_2.2.aarch64.rpm f5e3923dd9955ae8479e681a062d7611ef4e4cbafbc2f143234d4e01a8934203 ALSA-2026:36364 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) Bug Fix(es) and Enhancement(s): * "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-10.2.z] (JIRA:AlmaLinux-191778) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nginx-mod-http-image-filter-1.26.3-6.el10_2.5.aarch64.rpm 0b50f46f5d190e97026aa20f8f4a3dc70918508e66d438102771bd077683aa24 nginx-mod-http-xslt-filter-1.26.3-6.el10_2.5.aarch64.rpm 5f647d048b359ea2a611ca49cba7ee755b6bd3efaf6ab613ca140e220a8e6a5f nginx-all-modules-1.26.3-6.el10_2.5.noarch.rpm 63783f2757ef9f4c14eb7739660124c6c7d8094475d4b3333f54aa552c72f0fd nginx-1.26.3-6.el10_2.5.aarch64.rpm 77819453304f4c4b7ae7ce34c3f702463cb69768f62ac94a59be4bc21a9d1867 nginx-core-1.26.3-6.el10_2.5.aarch64.rpm 8ef714150f45dbe07d1bd4e9948a1e7c1cadc51335471a973c21532a8624ab3b nginx-mod-stream-1.26.3-6.el10_2.5.aarch64.rpm a89c9b85eb8bf053151152ffbb8d4d1f4afd2d0dc3a36d9fb40e12d53ca0ac21 nginx-mod-mail-1.26.3-6.el10_2.5.aarch64.rpm c2448d3c059dd2cd2daa41c5dca3362b966a232521d6b755cc404a7870606179 nginx-mod-http-perl-1.26.3-6.el10_2.5.aarch64.rpm c66805b07378c6cefbc92412557e1f113532557eccb3ecec1ea87d3bd2ee74c8 nginx-filesystem-1.26.3-6.el10_2.5.noarch.rpm e33cd1bd4272896159c0e7c1cd3fb48f85a85d98e7641fd3ac67aa121ff5fae5 ALSA-2026:36541 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) Bug Fix(es) and Enhancement(s): * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z] (JIRA:AlmaLinux-162140) * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z] (JIRA:AlmaLinux-182770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-debug-devel-6.12.0-211.31.1.el10_2.aarch64.rpm 68900e088fc0b5c8a55a5fdef1ff8aa968d2db43a05e3d98a2398a1835a476c4 kernel-64k-debug-devel-matched-6.12.0-211.31.1.el10_2.aarch64.rpm 6e4825febe4a23f22996b4e820e74c96cac7bfaaf5004f7a5dbf347f23baffbf perf-6.12.0-211.31.1.el10_2.aarch64.rpm 761f13ba7daf1925f089646bf89ff3e21b16be8fd531db3d46949fa9520144fa kernel-debug-devel-6.12.0-211.31.1.el10_2.aarch64.rpm 85d0359bde0d639511952857a36e859cdbac4dcf9abdbf12a43c28b017453bbe kernel-debug-devel-matched-6.12.0-211.31.1.el10_2.aarch64.rpm 88722ae282245bd89dfe250c5a840e6bd97708389c45b93d3e0a1f138adad27b kernel-64k-devel-matched-6.12.0-211.31.1.el10_2.aarch64.rpm 89b5bb4516763848c092823f81d298f9454c00e3bdc009a1ad931261f92f13f0 kernel-doc-6.12.0-211.31.1.el10_2.noarch.rpm 89b91f15b9a6c2c75be8b2c7e16409d5457cac0e17efe5cccd145ffe6964e501 kernel-headers-6.12.0-211.31.1.el10_2.aarch64.rpm 906c8eaecfef02194eb9572dc1e081cb112cf8517e2d8e05f5e219592aefd86d rv-6.12.0-211.31.1.el10_2.aarch64.rpm 97e938d5919bf38b1a367472e7dc09c0504e113d468efe79eb9ffe753b9231ff kernel-64k-devel-6.12.0-211.31.1.el10_2.aarch64.rpm 9c19b81514a267120dba5febe03fd2f7d892fd52e08ccdb70085b56e9ac35d04 rtla-6.12.0-211.31.1.el10_2.aarch64.rpm 9fb95f3b266cf524e23b7c95497d42b94cd5f9205c66536471d7ea6020dddff8 kernel-devel-6.12.0-211.31.1.el10_2.aarch64.rpm b31dcacac07d30d06a176936b39cc92003ebf1c5619785e81331bcf6152e9b15 python3-perf-6.12.0-211.31.1.el10_2.aarch64.rpm ca34f300d3d2fd5a380b785de2552744334816f64b2ae6173002b1344566779b kernel-devel-matched-6.12.0-211.31.1.el10_2.aarch64.rpm f4d78765aec16e4a62e2843304acaafcc355ab8f984daeb469061e91803f2fa1 ALSA-2026:36673 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL. Security Fix(es): * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1.aarch64.rpm 96b6d88eed8ed088e9289430b577be81e2e50257414d79a5927749905b12b059 ALSA-2026:36675 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.1.aarch64.rpm 101d60c80b765c80f151472f0f8f6ca122f10a5996cffc4d45b8e2144deb490f gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.1.aarch64.rpm 129bb3430a8e5c7b1cb9f380d95c9622701443a13d03a939ee809281eaa6d18d ALSA-2026:36749 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.4.aarch64.rpm 26786c882244af7b66132986f16533deeff663be69e154ae9aa10cd3bae17c6b gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.aarch64.rpm 2f3befa1f34bca5c3a5c122a297803fffa9ffa3bc624e469528b5356f1a7d2e3 ALSA-2026:36782 Copyright 2026 AlmaLinux OS 0 1 Moderate

aardvark-dns security update

Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in `src/backend/mod.rs`. Security Fix(es): * aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset (CVE-2026-35406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default aardvark-dns-1.17.1-1.el10_2.aarch64.rpm 1a40e6b6c641e4ff2e9f3758f03d945575abbd70e0b645b4eed12bc481155a54 ALSA-2026:36788 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat security, bug fix, and enhancement update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default tomcat-jsp-3.1-api-10.1.49-3.el10_2.alma.1.noarch.rpm 1819dbffc1a4bca43680dfb716f9f6bfca480b2c4603395e77e0a419a58fbf40 tomcat-servlet-6.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm 2554b1cd27aae45d566ee543e529a7f8b631976f3dc644dccaa3151198093639 tomcat-el-5.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm 4b09a49a6a830ea70914354fdb2180be3d73be82a0bebb83bdfefc3d3432cb85 tomcat-10.1.49-3.el10_2.alma.1.noarch.rpm 7a52ade066f085dc82c61eb86e4ef336c98d2ac6ba70eff0127686795e779fa3 tomcat-lib-10.1.49-3.el10_2.alma.1.noarch.rpm 8493861578941c0333c0447a8fba9719aa909187e4dfce1eb7ea6f9689eb73f4 tomcat-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm 8545fc47344bf1f124375700093b8bd550c7b5bbd3885316391a2c6901779bf3 tomcat-docs-webapp-10.1.49-3.el10_2.alma.1.noarch.rpm cd529a071ef3d5271bd60e65c7097b158dc762889174cff1d29908a19942df9b tomcat-admin-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm f1ca32a57c82c415745065d6ad5dee139ea70ca3e4b206c2c5213577fb413f9f ALSA-2026:36790 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat9 security, bug fix, and enhancement update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default tomcat9-el-3.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm 1e7a1f290d83d33dca1568da1d68c956d2ff9d703a7b398d2955f8f881f6c51c tomcat9-admin-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm 35f74b44de15b3b04a6bc454a111d3dfb26dfee6c7ad16644fb1a88130dce735 tomcat9-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm 3682120341af35136b188a86d60de457c2c5936026aea99b5a7b1317d71f90f2 tomcat9-lib-9.0.117-2.el10_2.alma.1.noarch.rpm 3a1e23335ca4fc1ca27006743516d5c74f7da734dc74dcdc72f5a4bed710668b tomcat9-servlet-4.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm 42f01e89a5d4c20d96e5212710be93238f72ce04851d86ae714c53b925109a88 tomcat9-9.0.117-2.el10_2.alma.1.noarch.rpm 7b18a53d3580ad05f99f8ee76bc0a5408bc9f0a2ca45465fd3446184546c2cb9 tomcat9-docs-webapp-9.0.117-2.el10_2.alma.1.noarch.rpm a59f4bad7f545f5287804da402c7f5be36cbae0c74cf7b8b5f691c3473fe68b6 tomcat9-jsp-2.3-api-9.0.117-2.el10_2.alma.1.noarch.rpm ac4d0fe0045a2723cfb5b6f43bdf719a027a0d7e5f26985bc08e3b4c1c91feb3 ALSA-2026:36956 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rv-6.12.0-211.32.1.el10_2.aarch64.rpm 02e2c0f9cdd7eee120ec3bfe8a270e5e3c7e855cd500974c79ef80fd4ef12b5e rtla-6.12.0-211.32.1.el10_2.aarch64.rpm 3615cd1a983838a28e597753a68ec4c05b38298445edf6d16018e4ae4029c099 kernel-devel-6.12.0-211.32.1.el10_2.aarch64.rpm 402636b5bdcc9f3064e61eb42e8fe350d1c9b8517910a95138b1dba2752c054f kernel-headers-6.12.0-211.32.1.el10_2.aarch64.rpm 40a330f586146b068dd9645b451e20d597d274a30fa0f4c9288cb1dd244c651d kernel-64k-devel-matched-6.12.0-211.32.1.el10_2.aarch64.rpm 48dc4cdf2f5da4f5be0a9f83c853202c437d77f6026bbc6ca3ab389e6289b61f perf-6.12.0-211.32.1.el10_2.aarch64.rpm 4a127a939b2bdea794af95f8327683a65ba1ec65c5a07e87e5d778e5f9f13c91 python3-perf-6.12.0-211.32.1.el10_2.aarch64.rpm 4d9736ce4a96e709a8a8dd7693a0698156b2e700aefb3b3c5b983ec930f62f13 kernel-doc-6.12.0-211.32.1.el10_2.noarch.rpm 4f6f025dca58da64c2300881e18f8767aa214eab6914aec981f04cad4cabb279 kernel-devel-matched-6.12.0-211.32.1.el10_2.aarch64.rpm 5e2560def8ae444a1afec909e2d6dbb889ecde9e727aea87586fbf1334189d84 kernel-64k-debug-devel-6.12.0-211.32.1.el10_2.aarch64.rpm 747fab9ae4fcf1a4b99ee5df0c2b5d472da5a558f3a82ceb9922420dc4a1578e kernel-debug-devel-matched-6.12.0-211.32.1.el10_2.aarch64.rpm 7c0373b8961441474ee7b40b529dcbfad82097a43be81c147c8e4cd1fb3d7da3 kernel-64k-debug-devel-matched-6.12.0-211.32.1.el10_2.aarch64.rpm 89d9be78791e59de09b47fa70769dcd309a0eb05ca60ac70b2cffbe3b2c73d5c kernel-debug-devel-6.12.0-211.32.1.el10_2.aarch64.rpm d4c6a692b325563796d1a7f7dc364b67bf47e613d7ad9a737299feee8090cbd8 kernel-64k-devel-6.12.0-211.32.1.el10_2.aarch64.rpm e0a0a0e20a4a07b5032d95398f6d54d99b6ece7f63d546a14a8d318f1a051d25 ALSA-2026:37436 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.5+1 [almalinux-10.2.z] (JIRA:AlmaLinux-193473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default go-toolset-1.26.5-1.el10_2.alma.1.aarch64.rpm 11e1280db9ea847faf8ac1aa091367243d060e16254d4be9e1c9320a784ef4d1 golang-1.26.5-1.el10_2.alma.1.aarch64.rpm 58851081d6bbf0ac67b3707396e1ae7375580e86a270f9ed9842af54e385e606 golang-misc-1.26.5-1.el10_2.alma.1.noarch.rpm 8b1baa3232557c008b80897b0d878d2d32cb781b8cc9b3418c2541f114ab8bd2 golang-race-1.26.5-1.el10_2.alma.1.aarch64.rpm b2595b3a89d36725a1a40e02f0fc44f176662e12b29737946ae976e36180433b golang-bin-1.26.5-1.el10_2.alma.1.aarch64.rpm db83a7a41d4ae502378dea041566968f8a11934164cfcf266d0d5feccb7d1e2e golang-docs-1.26.5-1.el10_2.alma.1.noarch.rpm e79232aca5b77e65b500df22bd8d4d8328e0c2dce6833e3fc94730d5830a9c07 golang-tests-1.26.5-1.el10_2.alma.1.noarch.rpm e793fc42fe1650f9a19106e8b5b7a3d9bdb7d8d0204ee5e5af2c808d2d66a9bc golang-src-1.26.5-1.el10_2.alma.1.noarch.rpm ec33bba2e56c497962b088c3e47106cc014d357d9e7a0743489c3b9f1da82635 ALSA-2026:38489 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) * X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.aarch64.rpm 2ce522fbe26a81a103eebb1a30501d208b28184b472bd894ab50acde0c418b28 ALSA-2026:38492 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.33.1.el10_2.aarch64.rpm 124f836857ead85fa9b78bf92dbbaddfe0dcf2408f0e0d2062f5c44cf0fcc0f6 kernel-64k-debug-devel-6.12.0-211.33.1.el10_2.aarch64.rpm 1aefce6772b7c1717a3facc959e9348b630b6fd0fdcc1604d149689301ae1685 perf-6.12.0-211.33.1.el10_2.aarch64.rpm 3e6cd8a5500b65931c3df2cabb0b54f8b5a9d17de100874851f086cfb207a291 kernel-64k-debug-devel-matched-6.12.0-211.33.1.el10_2.aarch64.rpm 4b334aa30fd8d01ed39519ab62d37fe5088c0ff12a65c749ae7991b4637f9b4a kernel-debug-devel-6.12.0-211.33.1.el10_2.aarch64.rpm 4efb34820f1de710ac563190f3556f0ff45a6bd2e98a1f8b6fe3bf97e6a6e4ef kernel-64k-devel-matched-6.12.0-211.33.1.el10_2.aarch64.rpm 5b3402eff39108f3ca7e9560de664677905de799898057e09610d3f5df67dc58 kernel-debug-devel-matched-6.12.0-211.33.1.el10_2.aarch64.rpm 643fad7f616a16815515e1d13b916c6e1c0cba1e8cdcda831861b38ee49d444a kernel-64k-devel-6.12.0-211.33.1.el10_2.aarch64.rpm 64852a73748b165399d4ecf47143d49735427059cd0547f8cdbf3fda5630a2f8 python3-perf-6.12.0-211.33.1.el10_2.aarch64.rpm 71082494fc47389f2e4049259a4040f1b46c128e322546bc33cc751a08a71c58 rv-6.12.0-211.33.1.el10_2.aarch64.rpm 8de9ab045a7c60b6b856fb6dabd188551ef7159ef64a57dc60f03cb5c09b83af rtla-6.12.0-211.33.1.el10_2.aarch64.rpm 992383a916cc908b968c331104ac410422975886c11312253081f327612b1a91 kernel-headers-6.12.0-211.33.1.el10_2.aarch64.rpm a55ed0295c3729f8ddb82c3c38a6e1dc54c66c8fb04cfe2c9c553c2d8b9a72c0 kernel-doc-6.12.0-211.33.1.el10_2.noarch.rpm cb6b5ac15159f9f1673206a9a80d24ed89608d643c0b10f5ae9295c1579474e0 kernel-devel-6.12.0-211.33.1.el10_2.aarch64.rpm e2e75711c9a38a033ded88fb5460be4dacdd14b4bc8235f0484770a351f96014 ALSA-2026:38494 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default buildah-tests-1.43.1-4.el10_2.aarch64.rpm 4a453ad6255eddf5c3b820689b015f590a71e8c4f7d5da64f87645d749c4cf8e buildah-1.43.1-4.el10_2.aarch64.rpm 7f31e1e7102ea0b6acb82d294994199b9adf219c27a5583e996466e22a26d1cd ALSA-2026:38495 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default podman-remote-5.8.2-5.el10_2.alma.1.aarch64.rpm 4ece61580de876de879294c8afe6b08e3cfc4489c9d51f66ab4693b274417f4c podman-docker-5.8.2-5.el10_2.alma.1.noarch.rpm 6d642e7bf54d7d8737244e959bd94e167100278c8303a9671587b40898d8f8a0 podman-5.8.2-5.el10_2.alma.1.aarch64.rpm 841b551aacd67cc91acd700aca7d555797ec895fda83e3476d1b46da1dcb4704 ALSA-2026:38499 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142) * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openexr-libs-3.1.10-8.el10_2.3.aarch64.rpm 12d30931de62ed26cbc852d0e4300a55f06140c64dcf5de40df2ced399cdde24 openexr-3.1.10-8.el10_2.3.aarch64.rpm ec0c70315ee9f49040f681483c97564a0245807be5c74a501f870b08906d2e11 ALSA-2026:38509 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162) * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858) * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default vim-X11-9.1.083-9.el10_2.7.aarch64.rpm 90c0f42f38df6b919342b209ace1a867c347a6ad846c1ce5cc68cde4e52a6b0b vim-common-9.1.083-9.el10_2.7.aarch64.rpm b7e1ba4d040a8096f729c4993d146075ab2f5e3832ebc3e873f346a266bab56e vim-enhanced-9.1.083-9.el10_2.7.aarch64.rpm c350d303d04389a13b978801b810e2353a20388e34c545c700a32da8522002ce xxd-9.1.083-9.el10_2.7.aarch64.rpm ebef73832fd92d9a7ff6a2e059c29a4ffa6f068c82e7fd894344913b062a60c1 ALSA-2026:38513 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.1.aarch64.rpm 5b7a30f065646d30c0b42bcb88bf5d9601393f7719093341d643d517e7cedd97 ALSA-2026:38514 Copyright 2026 AlmaLinux OS 0 1 Important

plexus-utils security update

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage. Security Fix(es): * org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default plexus-utils-3.5.1-9.el10_2.noarch.rpm 0e05d395f8b55a153026dfa3c8010ad4245d0439c34d80e42db758da41ab8738 ALSA-2026:39183 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python-unversioned-command-3.12.13-2.el10_2.1.noarch.rpm 01fd0cfaa34357b582559770297e93d57c2b9e0ffb6f529c89ba4cd34d50ce96 python3-tkinter-3.12.13-2.el10_2.1.aarch64.rpm e9ceedf025b6e0828fd8c1e368cd0ef68d20f0dcde9e48fd643a1d66796d8e09 python3-devel-3.12.13-2.el10_2.1.aarch64.rpm ed8a8701c338c112455e98c703504b0ed135f7286938d08f4cbca5f048686730 ALSA-2026:39272 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.6.aarch64.rpm d876207b382904315589d19e82ee98b164575c9320e3b52ac9ca2a028541501a ALSA-2026:39296 Copyright 2026 AlmaLinux OS 0 1 Moderate

libinput security update

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es): * libinput: local privilege escalation via crafted uinput devices (CVE-2026-50292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libinput-1.30.1-2.el10_2.aarch64.rpm 61595cde17ebb36c96d1ed8563484c31b39f5523a6e9ed733fa43f1afbfdb528 libinput-utils-1.30.1-2.el10_2.aarch64.rpm c9561da04dff3ba38fb4aba7d8f56d94e44f6d9c2d66501f83ea16032e5f15e3 ALSA-2026:39297 Copyright 2026 AlmaLinux OS 0 1 Moderate

edk2 security, bug fix, and enhancement update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) Bug Fix(es) and Enhancement(s): * edk2/x64: re-enable legacy kernel loader [almalinux-10.2.z] (JIRA:AlmaLinux-182421) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default edk2-ovmf-20251114-5.el10_2.2.noarch.rpm 15c2aa72562324380757fa4e4264b27e8d215a4ead60505448e6556096472823 edk2-aarch64-20251114-5.el10_2.2.noarch.rpm 5ebf1586f73cdbb4f6af4b6fac8634e21e96c81337572dd52d11cb6022b477ab ALSA-2026:39302 Copyright 2026 AlmaLinux OS 0 1 Moderate

cups security update

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVE-2026-34980) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default cups-2.4.10-18.el10_2.aarch64.rpm 17564567df6667cce2a007362bd80164e11c6934c3d4f753880ecceae427a338 cups-client-2.4.10-18.el10_2.aarch64.rpm 84f08d5e0575ec30584e6df4436cba9dac35c9e1ab78ad1568bda41a22b83335 cups-printerapp-2.4.10-18.el10_2.aarch64.rpm 9b736169c77a3a9495411b58a197ee1e8c576d5415f0cc6163f24255f611eaf7 cups-ipptool-2.4.10-18.el10_2.aarch64.rpm c0ca59a9b5e8d2ecd8dc6941c250f18be0f16cbbaaee048336907fcb0a731146 cups-devel-2.4.10-18.el10_2.aarch64.rpm cd036a7cc316addacb8d92a0bd439a71ecafb3294e26688a068998d83abfc6c7 cups-lpd-2.4.10-18.el10_2.aarch64.rpm fb91a2702fd2311d39cc4afcfd03a29a5e17b7f58a203fb5802690af15a72920 ALSA-2026:39304 Copyright 2026 AlmaLinux OS 0 1 Low

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling (CVE-2025-6170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.2.aarch64.rpm 4c3ac3d39453fe1d14a81a27c8b6f5ceb1c424322d907e67b0e93425f56f3fc9 ALSA-2026:39494 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: XFS data corruption using reflink () Bug Fix(es) and Enhancement(s): * [Exploits (KEV)] kernel: XFS data corruption using reflink [almalinux-10.2.z] (JIRA:AlmaLinux-193945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.34.1.el10_2.aarch64.rpm 344f199771bb8531fe091f6119689e6cc66b07bd0a3710d910db8ccbb96a319e kernel-devel-6.12.0-211.34.1.el10_2.aarch64.rpm 40218c7b46a29db2ecfc8c47d3a05b4da477ce274033039f48a2b6067d1ca6e4 python3-perf-6.12.0-211.34.1.el10_2.aarch64.rpm 7a4fa30250b07d64ac2f9c8673178e5b3eda795077460bada0d73caf65efb204 rtla-6.12.0-211.34.1.el10_2.aarch64.rpm 7a6536af1250a1b4689e9f8402a4ef642f5aaba70c25fdff0dd61163e76f6713 perf-6.12.0-211.34.1.el10_2.aarch64.rpm 8876b40d298f2a5a8e45128cc0d4d790f446e06ec7cb276c692e53f365a110ec kernel-64k-debug-devel-matched-6.12.0-211.34.1.el10_2.aarch64.rpm 97f54c4cbd350b35b3cbc2314905db355954cd3725719975f44f9b878bda96fa kernel-debug-devel-6.12.0-211.34.1.el10_2.aarch64.rpm 9c6da61396880e129fde6a954dba72ce843b04a9a3839b0d36db682309d7aa1a rv-6.12.0-211.34.1.el10_2.aarch64.rpm b25a99a42549a0f1e1bda12cc78f8b00b85003247618a5bcb14f2982ca72a227 kernel-64k-debug-devel-6.12.0-211.34.1.el10_2.aarch64.rpm b4643473ce0ef6f6d1fdef9ae2480beef878614bfc1fa3ceba109fb2c3479b35 kernel-headers-6.12.0-211.34.1.el10_2.aarch64.rpm bdc0871d86042023af780584e2e2cd4940ee0aa44e6d2f88e9547aa2d22a38ee kernel-devel-matched-6.12.0-211.34.1.el10_2.aarch64.rpm e71f218434a920f44fd87923c25903c75cc688d71b01a75ec58462a418d2b6b6 kernel-64k-devel-matched-6.12.0-211.34.1.el10_2.aarch64.rpm ee1c33b671bcd5792b52de0f405160dc3882dd3332c8e27a4bca6a63ca4f76f8 kernel-doc-6.12.0-211.34.1.el10_2.noarch.rpm f70c0c028135ad9c40726ef7b16d8d2b3251fe80614da1fb1532d5c0d7eb97a4 kernel-64k-devel-6.12.0-211.34.1.el10_2.aarch64.rpm f92e13b6aa99e79a1cf770344a9f479e68141fe97a977019cafc62f6c3a605b4 ALSA-2026:39547 Copyright 2026 AlmaLinux OS 0 1 Important

perl-XML-LibXML security update

This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fix(es): * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-XML-LibXML-2.0210-4.el10_2.1.aarch64.rpm 2cd951a69c636c1714155553977011fd2df00b96a544a4bd9f3588076393d912 ALSA-2026:39573 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.aarch64.rpm aa83a55f0c9023b5cde3ec5bbc13a394a149879fb0fd109b0668bd0bdefc1181 ALSA-2026:39976 Copyright 2026 AlmaLinux OS 0 1 Important

hplip security update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * HPLIP: Incomplete Fix for CVE-2026-8631 (CVE-2026-14544) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default hplip-libs-3.23.12-10.el10_2.5.aarch64.rpm 1bba0587a96917bdf5a14576215f3772a28c0d5c627a246c0428e192ec11e011 libsane-hpaio-3.23.12-10.el10_2.5.aarch64.rpm 4b9f201c3c97fcf4cedc8f3d05c4382a0330d9247c2255a81debff024fa97009 hplip-common-3.23.12-10.el10_2.5.aarch64.rpm c2f916d38398772097e79d9b66fff8f70b3676133d5e9c68645a06cd073e8892 hplip-3.23.12-10.el10_2.5.aarch64.rpm deaaed487f166e9102285107a9da30a2d3e671e98e6c71da602099ac6387084d ALSA-2026:40833 Copyright 2026 AlmaLinux OS 0 1 Important

pacemaker security update

The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures. Security Fix(es): * pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default pacemaker-schemas-3.0.1-5.el10_2.1.noarch.rpm 6e3da70c121af183095ce7a58c2b0a382194143758f71b5c897c62fa60a07c53 pacemaker-libs-3.0.1-5.el10_2.1.aarch64.rpm d50c6ac0fbbccf8abba3dde620a69aeaf5837755dd3bf5c1a0e93f27ea9a7669 pacemaker-cluster-libs-3.0.1-5.el10_2.1.aarch64.rpm f417c00b601a1e52fba0a1bd1ab032d2588c6919147be8935b8d9587bd2745ed ALSA-2026:40856 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3.14-devel-3.14.5-1.el10_2.1.aarch64.rpm 356bcf92e59f6b9669f9ea80211b42473af5f02a7515298a3e52e70aae7369fc python3.14-libs-3.14.5-1.el10_2.1.aarch64.rpm 55fffe0ad60f99841571efdf7051c66ada40381804ec5df54404b70e0291eeae python3.14-tkinter-3.14.5-1.el10_2.1.aarch64.rpm 56b32b1df280839a48cef729e85f469809b55bb08eddc08ddcb0d322ff717be5 python3.14-3.14.5-1.el10_2.1.aarch64.rpm a2dfc6af87223b86473cc8d883b49c1ae8da28531f41320bfc6fad0d23b73dd9 ALSA-2026:41892 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security, bug fix, and enhancement update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355) * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) Bug Fix(es) and Enhancement(s): * Reintroduce the `tiffcp -i` option (JIRA:AlmaLinux-185328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libtiff-devel-4.6.0-8.el10_2.4.aarch64.rpm 55aa13d9f6c3ac04642cf66eff904c150232ba2184b9948a95b711b6daa5f89b libtiff-4.6.0-8.el10_2.4.aarch64.rpm 96718d60a21ab60c5c5912df9507c0449031eb028cb29b600a1e54395b85d84e ALSA-2026:41893 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-10.2.z] (JIRA:AlmaLinux-192468) * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-runtime-dbg-8.0-8.0.29-1.el10_2.aarch64.rpm 018b3fba8653b30d29ec209837976da137269e5bbe3110c876e97ea4011a1bb1 dotnet-targeting-pack-8.0-8.0.29-1.el10_2.aarch64.rpm 284c77c1afd4fc3156289bf962e94caa72daee3c31dd13bd1957366a6f2d48be aspnetcore-runtime-8.0-8.0.29-1.el10_2.aarch64.rpm 3cc3940332edf2ab0f85e5ac458b40f70dfb931582520a03a4cebf255a1a2a6e aspnetcore-targeting-pack-8.0-8.0.29-1.el10_2.aarch64.rpm 7170459b7eb59d853e557214a43219ee55e0dcd84abfb54aa2a38788fff03dbc aspnetcore-runtime-dbg-8.0-8.0.29-1.el10_2.aarch64.rpm 808f8a73f463b6d6bb6fa9243e7c60b57273ea0dea7df6034fe2d239db4a2c49 dotnet-sdk-dbg-8.0-8.0.129-1.el10_2.aarch64.rpm 863fd306436eb675fccef1eaf772b01e5b1d9080e4ca449f95295bb6ff894af8 dotnet-runtime-8.0-8.0.29-1.el10_2.aarch64.rpm b9ee47ccfeba4cf7a058c59afc07df099e5dce524c1464d9e28c3e3cd4c05e9b dotnet-sdk-8.0-8.0.129-1.el10_2.aarch64.rpm bdd4844ee6cdad91ee269dcb103e666364bc62ea63391e4fc9e87284e54f28a0 dotnet-apphost-pack-8.0-8.0.29-1.el10_2.aarch64.rpm d3f244af3dd4596141b86e15a87f75619d14ad9ce1c03ab7cef7592a5d61b122 dotnet-templates-8.0-8.0.129-1.el10_2.aarch64.rpm f8ca2c7d56170992435ee79ded8426eaec7f8d6eaaf1ca80ceafaacdcf57af53 dotnet-hostfxr-8.0-8.0.29-1.el10_2.aarch64.rpm ff7ce3a0d1f10b663da75acb9c67ad9bbd2bb3814483992327f732477ae9a2a3 ALSA-2026:41895 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-sdk-9.0-9.0.119-1.el10_2.aarch64.rpm 033916cc8cf767c22f307927660c482f9bb25acb7aefffe99c701639c17331f3 dotnet-runtime-9.0-9.0.18-1.el10_2.aarch64.rpm 0737939c28e0999626583c652058aa2649560c6a36b45ca02c9fab18ceb5fcc5 aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.aarch64.rpm 42905e68a2cc68dc69ac6a93531bad6563b83b3f175feaca9f37729a816dffd0 aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.aarch64.rpm 532e7c6a6a2478e686bc1c8735086962da7dcf1adc8d216f1836b113c29854b1 dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.aarch64.rpm 539389f8dac3be553d9f834adc82a6fc4ce152f4536af9db7f4e5d9556e98a74 dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.aarch64.rpm 53c14a68dc3b6ad70110250e2d9d8b9583fc0d8de202fa433f6dbf0463c628c0 dotnet-hostfxr-9.0-9.0.18-1.el10_2.aarch64.rpm 5b18c1131525e60522745b3ea82f1e12ee3daef85ab37648c0d74bb9b20cde91 dotnet-sdk-aot-9.0-9.0.119-1.el10_2.aarch64.rpm 7d4f5f6f5029f229cdc7432661a445271b889ad9ab9ecc2960b82210f886d4ed dotnet-apphost-pack-9.0-9.0.18-1.el10_2.aarch64.rpm 827db7d237fa6dbad077d6bf26aadecbbb082c15a54fd2d7e3cbe92bfbfd1b05 dotnet-templates-9.0-9.0.119-1.el10_2.aarch64.rpm a42c7f9baaab8cd4423223101cca3cf71a60dfe3d45ea982d686acf5cede1223 aspnetcore-runtime-9.0-9.0.18-1.el10_2.aarch64.rpm aada8ece56e8172ea41aea7b84d6fbf012725561d71e9e2e174451fe0da37ccb netstandard-targeting-pack-2.1-9.0.119-1.el10_2.aarch64.rpm cceadd95a35c30541ca5152a86d7a8d57993fe383714c071506ccd2ed80e41fc dotnet-targeting-pack-9.0-9.0.18-1.el10_2.aarch64.rpm d658b2622da1c30347af6c3e64b5d99027fa5d9810d0579654d977c79ceb3181 ALSA-2026:41897 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-10.2.z] (JIRA:AlmaLinux-192463) * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192326) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-apphost-pack-10.0-10.0.10-1.el10_2.aarch64.rpm 2df187383725e12d62c7536c17b585d148d3c5ce56e355847ca3f17cf9c572da aspnetcore-targeting-pack-10.0-10.0.10-1.el10_2.aarch64.rpm 369f08f14ec4a17a16dee99940ac4c426d9046ed67822ac526be3b6b75a926f7 aspnetcore-runtime-10.0-10.0.10-1.el10_2.aarch64.rpm 40a1a4c6be11804d69556b69d4f1ba13257600450e20cb9e33a20b0a16d65e81 dotnet-host-10.0.10-1.el10_2.aarch64.rpm 479491cd9ac82ad591f9e300fabef12ca05f31a16f37a6e9268c6df612531826 dotnet-sdk-10.0-10.0.110-1.el10_2.aarch64.rpm 49506ed9ceecf8733b9aaabc496619ea57cf9e77a30c7167bbe3a936246ecdf2 dotnet-runtime-dbg-10.0-10.0.10-1.el10_2.aarch64.rpm 59455f76caccbb2bbaa6706da10cf95bda9ab0a1cab9284b9cbb81ead5fb685a dotnet-templates-10.0-10.0.110-1.el10_2.aarch64.rpm 774f6192b900a8245992f56eebd76669c781b47a33d0243276e2fe02e74a040a dotnet-sdk-dbg-10.0-10.0.110-1.el10_2.aarch64.rpm 811c4cbaeef693b1271cd766af94b4dedf6d1736973a1091c9c9fc3b31fce085 aspnetcore-runtime-dbg-10.0-10.0.10-1.el10_2.aarch64.rpm 92713a5506e7885ce3ca936bd02e05575a72571db831e1d00d05f76cd4b98946 dotnet-targeting-pack-10.0-10.0.10-1.el10_2.aarch64.rpm a508b52054111ac42641160d38c3efe1df525cd63a3115897a1b5673e8c976f3 dotnet-runtime-10.0-10.0.10-1.el10_2.aarch64.rpm bbd17619cb1ad6fbcb7c4d2e42b00a8cac8116a40a794a9fa0d0f3c751f5081b dotnet-sdk-aot-10.0-10.0.110-1.el10_2.aarch64.rpm efcc56d302bbe425be245545135b0cc357f87f07828bffa42e305e6c07e9785a dotnet-hostfxr-10.0-10.0.10-1.el10_2.aarch64.rpm f80ff0458354014c8a5711572b3fb96c6294841f2f4122d1fd1c9dd5e66c8952 ALSA-2026:41937 Copyright 2026 AlmaLinux OS 0 1 Important

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) * sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default sssd-idp-2.12.0-3.el10_2.1.aarch64.rpm fe01b23630989fb7fdbd7deb9c9fd7392135a60c9dce430c1e799e3b6b7403ac ALSA-2026:41988 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dovecot-mysql-2.3.21-19.el10_2.1.aarch64.rpm 0cc4e82701328867ae5dcb30576004e3d0774b9e57304ffba3af60f269aceccd dovecot-pigeonhole-2.3.21-19.el10_2.1.aarch64.rpm 1244e628fdd7b954d6cc961cb88115ce509e8c894a7af3d27332bb819b8f6885 dovecot-pgsql-2.3.21-19.el10_2.1.aarch64.rpm 58925838e6b2133845eea141d82a3739423e297b8cb19365cfad7d9456e2235b dovecot-2.3.21-19.el10_2.1.aarch64.rpm d3fd560d9cc1c11a4fac3b5b5bd64adc43ec44e1a7769d27efdab64bfd3030bc ALSA-2026:42063 Copyright 2026 AlmaLinux OS 0 1 Important

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.14.aarch64.rpm 69eb47cb3d8ad11e506e5517a85cb92b874e1d0b1ff2feec145e64e4ad78de00 glib2-devel-2.80.4-12.el10_2.14.aarch64.rpm f54668c64ea947353a9ba39ddda4e663733d3539e2059d363e44a8524f895300 ALSA-2026:42096 Copyright 2026 AlmaLinux OS 0 1 Important

c-ares security update

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default c-ares-devel-1.34.6-2.el10_2.aarch64.rpm fcb05cde723a1b040ed0a5b85c80e96419757927d07452b27c9553c4c4ce3753 ALSA-2026:42694 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928) * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435) * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glibc-devel-2.39-128.el10_2.alma.1.aarch64.rpm 3fe14283fb02e3fc3a05638e79bde4570da697aff3cca353d99e38953bd4019f glibc-utils-2.39-128.el10_2.alma.1.aarch64.rpm a43b8d133a83b33dc23017e2e501bbdca4512b9f7c24713b7ff2b84d365dd419 glibc-locale-source-2.39-128.el10_2.alma.1.aarch64.rpm ea318a943248ad57581e74711b540ed4dcfec167b22f67e93ff7fc1e2a155ab7 glibc-doc-2.39-128.el10_2.alma.1.noarch.rpm ec6e77a457ba7f13faf9ac4994f0f83f6fa55864f6690c7cb0495903d28a82f2 ALSA-2026:42739 Copyright 2026 AlmaLinux OS 0 1 Important

acl security update

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fix(es): * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libacl-devel-2.4.0-1.el10_2.aarch64.rpm 61a99902cb231a69ddd2dc532e6b56432e34db886e1035ad4c69af00e07171b7 ALSA-2026:42895 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.aarch64.rpm 251923dca1e55f9c50a8b881952680f6e0baf249da9c96693de875bcc1885b03 java-21-openjdk-src-21.0.12.0.8-1.2.el10_2.alma.2.aarch64.rpm 3d6da0eead6a1db263ca33a1e4d7245c3075879aa9ebc6d267e075f6d7568d6e java-21-openjdk-devel-21.0.12.0.8-1.2.el10_2.alma.2.aarch64.rpm 3db0aa6aad1a579aef31da93a5625ae30dc84ee518af105380ab435232f35c19 java-21-openjdk-jmods-21.0.12.0.8-1.2.el10_2.alma.2.aarch64.rpm 510ac50b3bd43a4d7fd374b8f7b1fa87caf3aa536a346df9311d305358815126 java-21-openjdk-static-libs-21.0.12.0.8-1.2.el10_2.alma.2.aarch64.rpm 51880018af8e3eb4200df547d920015a62c6340717bb228537f22e5b36878aca java-21-openjdk-javadoc-21.0.12.0.8-1.2.el10_2.alma.2.aarch64.rpm 62136463b35675752da814aa5b251509e39221c828efbd2537ea33e7be3570f5 java-21-openjdk-headless-21.0.12.0.8-1.2.el10_2.alma.2.aarch64.rpm 76bfdce95477be8a50e4e5a691087133e8ec915780f073d6c32b811759927688 java-21-openjdk-demo-21.0.12.0.8-1.2.el10_2.alma.2.aarch64.rpm e21e23568a0f9aa3fe43ca6885f80023f095f1acd54261811f9993e833bb638e java-21-openjdk-javadoc-zip-21.0.12.0.8-1.2.el10_2.alma.2.aarch64.rpm f199bfcc738bef4eb237cb512801422f0ced5d5b02b0346bfb813bb1f3d6a7db ALSA-2026:42899 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048) Bug Fix(es): * The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052) * On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default java-25-openjdk-demo-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm 0544f8d6f2c599f9c3be0a732761024968b5564e76f925abae9036e8b05ee2ed java-25-openjdk-static-libs-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm 0da6e5beabda0a8488addc920ea74366228a5151df43a907f7989b0fe38c7c81 java-25-openjdk-crypto-adapter-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm 37bcf8b9ae9c3deeeabee9570e37b21f4f769cfc302f1346e892f07105ec1409 java-25-openjdk-jmods-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm 4a73690cc173bdb1863ba5fad8a7dbed949eff874259b4ff61ece0c8934a7e0b java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm 4cce3bb8a226e6cb2469d7e08a981e94a8a7d07ff420f85d8df4ddcbad3bec88 java-25-openjdk-javadoc-zip-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm 7af607c9ca373c4e717208660a1a529708c8aef7fada8a1da252f08f381386e0 java-25-openjdk-devel-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm 85e231fee68d3893d024e8ef36d6e3be088bf35488bb6bd421b3f2bcd4bb6415 java-25-openjdk-src-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm 984e7c9587e5815a085cf18606af182197a4685e4ca73f882e3c4000dd357402 java-25-openjdk-headless-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm ae1ad0d1b9175c0eb2334df8f301844df6c29cca24cedfb13958fea4f34c495f java-25-openjdk-javadoc-25.0.4.0.7-1.1.el10_2.alma.1.aarch64.rpm edb90843dab453ff17548d65554b830f130875f780e98faa92e9873e6e04e3c9 ALSA-2026:42919 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168) * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950) * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: can: bcm: thrtimer use-after-free during RX operation teardown () Bug Fix(es) and Enhancement(s): * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:AlmaLinux-173103) * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975) * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [almalinux-10.2.z] (JIRA:AlmaLinux-186311) * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-perf-6.12.0-211.37.1.el10_2.aarch64.rpm 2f6ff33e5589b88c5b4bb831d88e604c6623e618621cdcca3ee8725167fbe04f rtla-6.12.0-211.37.1.el10_2.aarch64.rpm 49982126045c46235d91fdb1490713386961e4a6f47a20d1cfad0e30eab96456 kernel-64k-devel-6.12.0-211.37.1.el10_2.aarch64.rpm 666e7e5b792975b517f113506574a98c38ee8e7bc2bcbbfa962e5dea3a350adb kernel-64k-devel-matched-6.12.0-211.37.1.el10_2.aarch64.rpm 670472db4708826e4e9de6b8e37e8a4725b247316b54623ec307dea9950dd5b2 rv-6.12.0-211.37.1.el10_2.aarch64.rpm 685137556910083fbe2b1421c0eaef74f710cff38dcaebea2273c0f6e056ebcd kernel-64k-debug-devel-6.12.0-211.37.1.el10_2.aarch64.rpm 724b9501e258ec361ccb89e3d0a8a93e6743abe886ea06782a2ae0de169d2607 kernel-debug-devel-6.12.0-211.37.1.el10_2.aarch64.rpm 789ddc9703141a8d4b7d55630f222bb17377c21c86c8959466a7a4c51a690c53 kernel-devel-matched-6.12.0-211.37.1.el10_2.aarch64.rpm 7d934adff0f4624d375e242840c05fe791737eef6c42f99950aec3dd11838e21 kernel-doc-6.12.0-211.37.1.el10_2.noarch.rpm 87d31242d05551914e981aae0b0f4d898f16e6999a0326758830d5c4a4582d3f perf-6.12.0-211.37.1.el10_2.aarch64.rpm a998c0ceaee72ea69b729a09c1b94710704d0de205aaf83a8a74f9f2b55854f6 kernel-debug-devel-matched-6.12.0-211.37.1.el10_2.aarch64.rpm c2c1c6d5f9f670b88f6dc1a44120a9081a917b4ca5f0d6c2a18206c5c717f86e kernel-headers-6.12.0-211.37.1.el10_2.aarch64.rpm ca7d66367c2aff8cdf5951395cd291c84263390fc098f1aa56639d95c6718a08 kernel-devel-6.12.0-211.37.1.el10_2.aarch64.rpm dffc150dfd2b267958e47bff66450a04557fdc4152796eb61370d101ee6806fb kernel-64k-debug-devel-matched-6.12.0-211.37.1.el10_2.aarch64.rpm e106313902ad6af0e349a47526a65e83f41086f5802f681521be798e907e5b0a ALSA-2026:43400 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default idm-pki-kra-11.9.0-4.el10_2.alma.1.noarch.rpm 0969cdaf908804a41b9168709166a69e8aa7ae8fcc2e747357080f04a1172f5e idm-pki-ca-11.9.0-4.el10_2.alma.1.noarch.rpm 0b735f0dd0d261caa3582e67de71f6261dbab4015274cff710fc04879b00b9e9 idm-pki-java-11.9.0-4.el10_2.alma.1.noarch.rpm 19db97d8c3e96b064b9b644b115703383e1a284592656856fb4c10b17f0ff783 idm-pki-base-11.9.0-4.el10_2.alma.1.noarch.rpm 2078148c1821766f42e07686376b4f47372e0d8d1f28117d64c14ecfa9c35ec2 idm-pki-acme-11.9.0-4.el10_2.alma.1.noarch.rpm 65f47e5c5837435369b77d7a6e0414cfd4e2ab76ac728e69b36043659fdf4ae8 python3-idm-pki-11.9.0-4.el10_2.alma.1.noarch.rpm 6e8938d303bc048889247d06f240b4f4e4629de2d3a8d8d05230791ef281e8a6 idm-pki-tools-11.9.0-4.el10_2.alma.1.aarch64.rpm 911d56e54a90d54c502becd129b5c678560b834c3f624cfc4a1ab320c71ed902 idm-pki-server-11.9.0-4.el10_2.alma.1.noarch.rpm b82532ebd593f44ece5bc792082777393864e54da71878f86dc5d3f9abd9a78a ALSA-2026:43505 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb-connector-c security update

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fix(es): * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mariadb-connector-c-devel-3.4.4-2.el10_2.aarch64.rpm ad815ec4da9e53959867b00032ff0988d9e82a62939a1626a4954b7e64c5f3ee ALSA-2026:44270 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.38.1.el10_2.aarch64.rpm 1188c810fe760339b1903724adf572e0247ffc3b9a0fdf05b6f53219024728da rtla-6.12.0-211.38.1.el10_2.aarch64.rpm 2eff951f526c0f74fbae96c17a26c475d0bddab67392f76a2522f60806660fba kernel-64k-devel-6.12.0-211.38.1.el10_2.aarch64.rpm 308c7c85f88153e286f5df63061d4f896613f0da4136a479f22fe0010c48bc8a rv-6.12.0-211.38.1.el10_2.aarch64.rpm 3df885f135ef99146b4b5d29b407fe6fb3f1462d1bfb0e704b43fecbe06a3950 kernel-doc-6.12.0-211.38.1.el10_2.noarch.rpm 4a069b5675e58961c90a55b7563fc8b4cdfeb44341f929a948dd293d00bbc4cb perf-6.12.0-211.38.1.el10_2.aarch64.rpm 5c0f19fd825662e4f8c180bb485be8189e3b17cfa8f3114565b30e6f4ea3417e kernel-headers-6.12.0-211.38.1.el10_2.aarch64.rpm 5c1a5c5b0aa297afa2beac365024c73cae3e128f8e7d43f6252e90bc743f38c5 kernel-devel-matched-6.12.0-211.38.1.el10_2.aarch64.rpm 7496aad2296277703150ac88bb44836e9402270bc14786b69b94e38288653638 python3-perf-6.12.0-211.38.1.el10_2.aarch64.rpm 916614c64ea37f6cf4a7f4d9b5bbba4660c6b82a2b743e5ca3fc3527bdaf3f1c kernel-debug-devel-matched-6.12.0-211.38.1.el10_2.aarch64.rpm a2b1782ab17f9aeb53457df401e5f54032677d416df283d8c22cb8e3045dd2c3 kernel-debug-devel-6.12.0-211.38.1.el10_2.aarch64.rpm b4551a2a18e39d756ddb92b7c5052e3952dc095f00d36b6cb3233c311b189130 kernel-64k-debug-devel-6.12.0-211.38.1.el10_2.aarch64.rpm c0554318d7c207da2cde4a27c0dd215717d784bfa31086e5c2a972d333b3f7af kernel-64k-debug-devel-matched-6.12.0-211.38.1.el10_2.aarch64.rpm c5d69774aa9517c39883f4be10e4081b71c5df3eab7e841aa3cfafbea3f82af3 kernel-64k-devel-matched-6.12.0-211.38.1.el10_2.aarch64.rpm ffdf7e6a6c96091e82ca6751023b24e937ff77489b39a9fdbd92212943ac14ad ALSA-2026:44391 Copyright 2026 AlmaLinux OS 0 1 Important

libpq security update

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libpq-devel-16.14-1.el10_2.aarch64.rpm ecad497e38c0b1f880e7a9bd3f3b2f4c8a32e5010b1aeea51b6e61eb6d7f19a8 ALSA-2026:45114 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973) * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.39.1.el10_2.aarch64.rpm 094c331637045e32f77d63ae143de10e11a2656c3e72411f95ea3d740bc06528 kernel-devel-matched-6.12.0-211.39.1.el10_2.aarch64.rpm 16a0857e5933c1f04d70c5ad6883d34a450ecc786ca673266b91ffa771f5eea1 kernel-64k-debug-devel-6.12.0-211.39.1.el10_2.aarch64.rpm 2cc0e5e5d40055a34e23eb8c240438b1712751f201ccb08ab194c6165aef9b71 kernel-64k-debug-devel-matched-6.12.0-211.39.1.el10_2.aarch64.rpm 393e43c1f98f02097cfc2d56655810b664c8861af5f72378ad2cfa5b0aceec7e rv-6.12.0-211.39.1.el10_2.aarch64.rpm 3c9f12067d687dd252a741608fc73675136e96806dafb50ab267b76f1fd5da1f perf-6.12.0-211.39.1.el10_2.aarch64.rpm 52c5d3ab6915fd1162cb17ba43abbf55d12ed85d0d53bbf441a8d1de07371213 kernel-64k-devel-6.12.0-211.39.1.el10_2.aarch64.rpm 968a30408be2ef73f164bb6e102d8e5746dd141fc5d6006f1772322ae5ce6b46 kernel-headers-6.12.0-211.39.1.el10_2.aarch64.rpm a34a4d6fc35692c824bc0df880e2ebcdc1d2c93939cf8eaeae84e86e3dceaa0a rtla-6.12.0-211.39.1.el10_2.aarch64.rpm a420e0e5d5c402d592380bee54f7d07433c80bb1af5b6d1985524d4af440d005 kernel-doc-6.12.0-211.39.1.el10_2.noarch.rpm bed818f0799b768ff6cfc2f657938405ca4fdd836ecda0511057e50c36a60fb4 python3-perf-6.12.0-211.39.1.el10_2.aarch64.rpm e9dce0eb1805016c0af6f34f9e5ba80d4815cb651789b3347974e43b48c3f399 kernel-64k-devel-matched-6.12.0-211.39.1.el10_2.aarch64.rpm eba1f03222ff7da094451841cb81b1547c76b67c9a5e5f20abcb867451065988 kernel-debug-devel-6.12.0-211.39.1.el10_2.aarch64.rpm ec4af0d2c2274c8342e2316047fece7c18e41e2a9c4d15cd0a168fdb729cc55d kernel-debug-devel-matched-6.12.0-211.39.1.el10_2.aarch64.rpm ef643b6ed1e779871b461a1599245807d4866bfe2b7ab81c48d015eabb5a9ba7 ALSA-2026:46394 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fix(es): * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default go-fdo-client-1.0.0-4.el10_2.5.aarch64.rpm ebeb8f6ec5269d0f579bba5ff27d11f5eb2edc3e32d1816e3ce34d6739921542 ALSA-2026:46395 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default go-fdo-server-1.0.1-2.el10_2.3.aarch64.rpm 68395fe2807056fe72d319477df0057f52c4b5f216e2c81b3a4e4afcbd1ef99e go-fdo-server-owner-1.0.1-2.el10_2.3.noarch.rpm 8a1f12fb60dd6f709e8d044b6d020d14de7e6afbde8dda5848544a5e669cff85 go-fdo-server-rendezvous-1.0.1-2.el10_2.3.noarch.rpm caf1db0da6a4940dc368733c9e45509fe9a782dd4331421e6ca8bcf1a5779321 go-fdo-server-manufacturer-1.0.1-2.el10_2.3.noarch.rpm cb7c2a74215550a5f2ce3d4355be09b754b0e502285caecb7e0f536ef2a0011f ALSA-2026:46398 Copyright 2026 AlmaLinux OS 0 1 Important

libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721) * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722) * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413) * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libreswan-minimal-5.3.2-1.el10_2.aarch64.rpm 740f1255f23fd60cbbdaa78877885811f241121e4c0431ce55b0253945c285f0 libreswan-5.3.2-1.el10_2.aarch64.rpm e216f1807850b4cee2354d6022423fbcfa3adfe3fd6dd86b6dbb3c9cf2e17ee9 ALSA-2026:47017 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281) Bug Fix(es) and Enhancement(s): * rxrpc: Address CVE-2026-43500 [almalinux-10.2.z] (JIRA:AlmaLinux-178254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-perf-6.12.0-211.40.1.el10_2.aarch64.rpm 03cf6ea8c79ff59a5f10d640d5205b47447a2e4ae5e9edfd75a05a753a050fb6 rtla-6.12.0-211.40.1.el10_2.aarch64.rpm 1440f743107d48accd741d22a36c14f2f6b3baf5f8201a756d402a89e8f6c4fb kernel-debug-devel-matched-6.12.0-211.40.1.el10_2.aarch64.rpm 34be26cd389024c061dc61d6a3b7cd8e337d9e729f75a6159043279672e09daf rv-6.12.0-211.40.1.el10_2.aarch64.rpm 39f253c01032175c13f800417284d5559b325190cb5b94e6bd7655f2397ca517 kernel-devel-6.12.0-211.40.1.el10_2.aarch64.rpm 3c9ec01d24d4b1823ef51a6b40d9d1257504075da9841d7793a11755c727f575 kernel-doc-6.12.0-211.40.1.el10_2.noarch.rpm 3f33284f7c4ea3f56149f8190f4db9d0acabacfef1186c7aa7ad46d25395aa49 perf-6.12.0-211.40.1.el10_2.aarch64.rpm 3f5bce2f36211e209a693bb0554cc26ff16c9f0555c703f555768a787976b613 kernel-debug-devel-6.12.0-211.40.1.el10_2.aarch64.rpm 5145be9f3ddf4d778b7cd3a562b624fee9fc5e62a34d0e40d2560e0cd5bcd499 kernel-devel-matched-6.12.0-211.40.1.el10_2.aarch64.rpm 6727e8aca6af086a6a95adf5d0c21b1d30fa23ed74dc599ef2fd1f7529e03ebb kernel-64k-debug-devel-matched-6.12.0-211.40.1.el10_2.aarch64.rpm 6b33053b9c5abef78ecdb9634655802b4241208f6f649f398421b37ebd55ddcc kernel-64k-debug-devel-6.12.0-211.40.1.el10_2.aarch64.rpm 6b5187ff873c4cfd989e1edbee5360bf75ed8a1448faa26c22126de5482dea37 kernel-64k-devel-6.12.0-211.40.1.el10_2.aarch64.rpm 8e04b33bdda2ba4a9826a4b573d530a5ce43c68cd350ced798dd44c0fe6cccc8 kernel-64k-devel-matched-6.12.0-211.40.1.el10_2.aarch64.rpm ddfd7f63494901d84c0b48dbcce079db6c1c944ea39dddf335cdffc4a5a3c19e kernel-headers-6.12.0-211.40.1.el10_2.aarch64.rpm ec8e46f621dc71931bf13e989f4c5389e7c47fd4c43d70ae407d8512c8a036fd ALSA-2026:47079 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libXfont2-2.0.6-5.el10_2.1.aarch64.rpm cbf0c46be6a65e750b34be4e9fef69413c49c10882db09a1b0a70695b014a3f6 ALSA-2026:47083 Copyright 2026 AlmaLinux OS 0 1 Important

pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading (CVE-2026-5674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default pipewire-1.4.11-1.el10_2.aarch64.rpm 0dc9b5cc9ea822117b24f942ec9189b7f67e8085c014f5fb1b0d3e715241766e pipewire-jack-audio-connection-kit-libs-1.4.11-1.el10_2.aarch64.rpm 0ee1059e7d2b728e03707593ec097ef19b998546b4bf00bfc6509c36c5afe07e pipewire-utils-1.4.11-1.el10_2.aarch64.rpm 239c55aba3ec022c058803a2521e087b9ca69f9c0f8c0e1d14d870038b5a2a14 pipewire-libs-1.4.11-1.el10_2.aarch64.rpm 453d185758d99cb30e724a2b99052851807965a352b5f86201bb7a962e923be3 pipewire-gstreamer-1.4.11-1.el10_2.aarch64.rpm 49b85cb148a65f0e92afd9d6f614157ed33f4ae0fb7963dfdef936d533964678 pipewire-module-x11-1.4.11-1.el10_2.aarch64.rpm 5c98c9c9ff0930bfe2ae2bd9138fcfe5f745b93b77d7bb689aaa3a7906ed1ab9 pipewire-alsa-1.4.11-1.el10_2.aarch64.rpm 705f7177d361c933d43500dfc5d1e3cbcf9b4edc6f82eda46096f4591aa566b5 pipewire-devel-1.4.11-1.el10_2.aarch64.rpm 8385ff93a9a41afceb6020f6fb44d5def57b1023b0aec75636ff5ca5a90ae1e8 pipewire-jack-audio-connection-kit-devel-1.4.11-1.el10_2.aarch64.rpm a1a7265fcc8b9098d427164db71c68d96998dc05a03022b235e2bb0b38b08474 pipewire-jack-audio-connection-kit-1.4.11-1.el10_2.aarch64.rpm a45e1db88281f38a9089d8aed533247ddd389c408fe79c86e986b6f20e1e6d71 pipewire-plugin-libcamera-1.4.11-1.el10_2.aarch64.rpm bcbf5206ca29c74b3b47f856ffa794610b78360e9088843abb550001509e67bb pipewire-pulseaudio-1.4.11-1.el10_2.aarch64.rpm e655c0b4d7c71800f5c5b995bacf889eac6aed79fa3400f410a452ce5ba70430 ALSA-2026:47085 Copyright 2026 AlmaLinux OS 0 1 Important

rest security update

The rest packages provide a library for access to the RESTful web services. Security Fix(es): * librest: weak random number generation in PKCE implementation (CVE-2026-16615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rest-0.9.1-11.el10_2.1.aarch64.rpm 8b4c2fe56b3d0726e1f1d5c587b2d6c4070be05db907c94a8d57a325dbac6148 ALSA-2026:47101 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default firefox-140.13.0-1.el10_2.aarch64.rpm afc643d2176d11e5d3c81014321fc49a4683a4b1240db8c3bf1a0c61dbb0d8cc ALSA-2026:47180 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer (CVE-2026-59691) * gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback (CVE-2026-59692) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.6.aarch64.rpm 5cb61a92e08bbafab856c834a8855070f70917f3efec1ce754d8fb869e5c56a6 gstreamer1-plugins-bad-free-1.26.7-2.el10_2.6.aarch64.rpm 7229c833dfb8b5e9844a133234e6a0a0174969605442e24ce860dd6b2f5311da ALSA-2026:47757 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenSSH client versions (CVE-2026-55655) * openssh: Double free in AlmaLinux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653) * openssh: Heap out-of-bounds read in AlmaLinux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654) * openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002) * openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy (CVE-2026-59996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssh-keysign-9.9p1-25.el10_2.alma.1.aarch64.rpm 31bf2e717431dd3e86dc449bb2e0cd693a25ae7b629e46a909bc9759a3075d7d openssh-askpass-9.9p1-25.el10_2.alma.1.aarch64.rpm a6081683aac0b5273f1653c52b2e726c5f14650989f121f78c67f70db305b884 ALSA-2026:48032 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm bbd3e0be33345b40f7140ed617b9d6ac035fa7d714eef964005b4f634524f37c ALSA-2026:48033 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs-docs-22.23.1-4.el10_2.noarch.rpm 4a83c12224f35412b6625e9741ade14adf2898f3deb3cc76c129e06984205bf2 nodejs-libs-22.23.1-4.el10_2.aarch64.rpm 5422d032a9ed4d7a40abcc9413fde4e50bfd51f47496ca4cebe86a3bcb13a325 nodejs-npm-10.9.8-1.22.23.1.4.el10_2.aarch64.rpm 6f38c50904cdca0aecc7cfc638072b3f8c84f521412a5909425fd71e54276a57 nodejs-devel-22.23.1-4.el10_2.aarch64.rpm 8589bde7d4d292597f3c791a510dd41b8fda9a0885479aade0663742d31fea11 nodejs-22.23.1-4.el10_2.aarch64.rpm a0dffdbcfb90e9f2c8cd9ee9ccfbfd0d5ac2de2cfd2ac0555c80c2cf5c75199e nodejs-full-i18n-22.23.1-4.el10_2.aarch64.rpm d5eb299f5fe36dee50ea58e2b99af548cdc63c90702c43e546f2528efd7aa4ae ALSA-2026:48034 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs24-24.18.0-3.el10_2.aarch64.rpm 376cc4807f2207404fcfd9273af15c8094ac4c4ac04616820b61ea7f532aa74b nodejs24-docs-24.18.0-3.el10_2.noarch.rpm 89066bd3e4a424f6060b375e6c02c05394b0753a9457c3f2bea0b8ca3a7ef097 nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm a0d67f6698a66c5d36c8a723a620bfc3e7512941af628d160a75f70e47142745 nodejs24-full-i18n-24.18.0-3.el10_2.aarch64.rpm bb07bb11ff61d830c8ed6af44b2fb146238014a0921639797a4642aa55526d84 nodejs24-libs-24.18.0-3.el10_2.aarch64.rpm e4a0231960c2ea96881f4a06986fcdfc5b9dc14e3d2ff95904cfd314176270f6 nodejs24-devel-24.18.0-3.el10_2.aarch64.rpm e96797f8f5ce7e4ab0a03eb87833691e51e961873fd368fcb7482a41449114c8 ALSA-2026:48170 Copyright 2026 AlmaLinux OS 0 1 Low

php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default php-gmp-8.3.32-1.el10_2.aarch64.rpm 05908b3b98134c906f32eab7a82a71d169be81baac47ad06eda60cf69e9b9b3f php-dba-8.3.32-1.el10_2.aarch64.rpm 13a15fc104485ba91ad19a6b26f8f4079d76f2f35d4af4c31429f547de2b7c5c php-soap-8.3.32-1.el10_2.aarch64.rpm 1ebf9bdac863eee73702b9ba26f51132eaa70b356548758e5337f78f0760fa5b php-common-8.3.32-1.el10_2.aarch64.rpm 1f2d6d252226fb7a0efd3d747a8da396d521e54c323e75282225beb64427f274 php-mysqlnd-8.3.32-1.el10_2.aarch64.rpm 29dce74c0db782a6c92eef90f9ec8a03b86724b430c808dfdcb159bc49ad1aab php-xml-8.3.32-1.el10_2.aarch64.rpm 2a3e54b51143f89c56c490c1c90fd0c76527b869b4400d8d2ab8d3aef8d6c423 php-devel-8.3.32-1.el10_2.aarch64.rpm 5a977a91d84e3b2109711bc87be068f27544e32ee10c278627a48e699b6b27b8 php-gd-8.3.32-1.el10_2.aarch64.rpm 5c72590b8660d443c12f35ee87e2592dd0ad91d95338723113167878284969d9 php-pdo-8.3.32-1.el10_2.aarch64.rpm 64b7499e5880b2c9ae3a24f712130d410b36e57249bfa6beaf2fb0c81288f7af php-intl-8.3.32-1.el10_2.aarch64.rpm 73428e44e574f23e1e3f89418d4eb0d1110cc358ed3701ae45880c32bad27baf php-pgsql-8.3.32-1.el10_2.aarch64.rpm 775fa50a71cb47d6ebbd803be22b182707475d5a88f704fc7c64919aaed33a0c php-mbstring-8.3.32-1.el10_2.aarch64.rpm 78ccc7d65efd1f35d7b1ce829b87216b4541f7d83e972273a04d44039889221d php-snmp-8.3.32-1.el10_2.aarch64.rpm 7e59c263c2ff0d3552bb5a6b927a0930094cc0b611ea0322410fcd78296ab6c3 php-8.3.32-1.el10_2.aarch64.rpm 89e57a7651798cb6ccb072f0bdbc2e4f06d8a24ba3e5efd55266559e947cb658 php-ldap-8.3.32-1.el10_2.aarch64.rpm 907d14117a4b950e056aa1fae20cc28a7ad8acf4265d9050c9a1abe2fb5ef7dc php-enchant-8.3.32-1.el10_2.aarch64.rpm 9bbde44bf56f4aa7c8a2f6e81ac76c0a13232213194f5f890b298fa88e75d4b0 php-opcache-8.3.32-1.el10_2.aarch64.rpm bdd124faeeec0982a5c1c6cc8883639f4de2e45b174e7799cdd9d971955fd847 php-process-8.3.32-1.el10_2.aarch64.rpm c81303afa64f6951f6593d81b19b85cd265ad4edbe1d888fc3566d8d63d17c5a php-dbg-8.3.32-1.el10_2.aarch64.rpm ccc9a1a61bc805521fb70f453f1e7653b87c1864102ce94f93a01e98057fab88 php-ffi-8.3.32-1.el10_2.aarch64.rpm d430281a71721ec4b48431565a22d5b25d068f5fd8cbdfaec4a897781f239e4a php-fpm-8.3.32-1.el10_2.aarch64.rpm d5c369d8047478216c6cab6bfc35c1b4e9ca0917d307efd27e09e65b882c3f43 php-bcmath-8.3.32-1.el10_2.aarch64.rpm dae0ddcb3c6318dbc628fc5dd19b9e3b01242aa88ab2b934c68b75a91610d2bc php-cli-8.3.32-1.el10_2.aarch64.rpm dc17768246da18c993df8f04e16fb8438ebf461bd73bf79aa8688122ff6e9d6a php-embedded-8.3.32-1.el10_2.aarch64.rpm eae3e60a9db9140c46d4ee5ffb34cdf97084527b396d41f5ad44aa88831bdc9d php-odbc-8.3.32-1.el10_2.aarch64.rpm f596b18001b8c6f79e480a9e6ef64fd7b8dc4058e0b375c0c01dfd48d8143d0e ALSA-2026:48585 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default fence-agents-scsi-4.16.0-21.el10_2.5.noarch.rpm 02a9562b78a8a24d7e333970efbc532e24161062499846a84fe75f07c16df2e2 fence-agents-cisco-mds-4.16.0-21.el10_2.5.noarch.rpm 0585c3e9f38920e515019f74ebdb69e2987cda9c3fc8f55553b0d5b46a04667e fence-agents-ifmib-4.16.0-21.el10_2.5.noarch.rpm 079ef24bb4d641ff4713ab43de2a354ad8dc7350f764f31380313fb52bb8e396 fence-agents-eaton-snmp-4.16.0-21.el10_2.5.noarch.rpm 089facbd88cf4480c948daef5080d8a4e863f876af741e894953a052c18472f1 fence-agents-apc-snmp-4.16.0-21.el10_2.5.noarch.rpm 0ed42a2237e32de2ee788e8d1ce0205de2e3e3668fe8621b0454862360f4cae9 fence-agents-virsh-4.16.0-21.el10_2.5.noarch.rpm 0fbe596f99db8f892c67c85f7cca46ccd883667a63ee6aa5c0a06fc771d1546a fence-agents-rsa-4.16.0-21.el10_2.5.noarch.rpm 1af89745129e72d3cf10835d0b18dc20f4fbb3c87def696fa64d2677f26078eb fence-agents-rsb-4.16.0-21.el10_2.5.noarch.rpm 205874c6618128431f134d578571738ee9368d524e16f9991bf507a48a1fc4af fence-agents-wti-4.16.0-21.el10_2.5.noarch.rpm 2ac50c4183e12154477c90ad233354a1b426ce6ada8318cd9ff1c95783d0a6e9 fence-agents-ilo-moonshot-4.16.0-21.el10_2.5.noarch.rpm 33a6033ef28cbf57fe6ae177ba899bee9efa2586458cfc9f4b17d8816f4852e9 fence-agents-sbd-4.16.0-21.el10_2.5.noarch.rpm 393ba16d2124e745058334be1a9ea19466f1ea2ed79be749f9534c0eb2eae3a0 fence-agents-ilo-ssh-4.16.0-21.el10_2.5.noarch.rpm 3b06b3b6370f1542f6c561b830148802a761f1a54cced27f5b897bc72bbf000c fence-agents-bladecenter-4.16.0-21.el10_2.5.noarch.rpm 43be7813f12ea8487c7144e058efdca667f8ee63e3b8fb3688b1ee768242c4db fence-agents-amt-ws-4.16.0-21.el10_2.5.noarch.rpm 4f4f9455dc2124c09068d3955018c52d59c5e5787e20c74b56664df7585682b8 fence-agents-brocade-4.16.0-21.el10_2.5.noarch.rpm 512d3a91950b1d4aba9d521f1b1298cb5281a94cc741007163fdefa3ff9c6d6b fence-agents-mpath-4.16.0-21.el10_2.5.noarch.rpm 63316b6226135353f691c6e8611077a5d55c61e96e1bbd2f0feae1ef1156055f fence-agents-kdump-4.16.0-21.el10_2.5.aarch64.rpm 6def648ca6ebfab532d8e08c3bacc1a5ae334f06181f1846ce38444d5e879e76 fence-agents-eps-4.16.0-21.el10_2.5.noarch.rpm 70805cb3186ce3b83c61dd6a92392e10e2269d97bb12901831a705caa2e13e67 fence-agents-all-4.16.0-21.el10_2.5.aarch64.rpm 73b0a13a85ada47a9a4ffbb7a54671de1fb1bd00660c520127128d3edcee81dd fence-agents-ibm-powervs-4.16.0-21.el10_2.5.noarch.rpm 769c27a5bdf674e7ae7d3e284ca2ef59c325032952f687138b4de3eb49bbf684 fence-agents-ibmblade-4.16.0-21.el10_2.5.noarch.rpm 7d422de49cf099ef097c46e463774d835a7a6341739f62bf21f362bf0369b424 fence-agents-hpblade-4.16.0-21.el10_2.5.noarch.rpm 89fef3d43f7585019392d0dc5d961f1c4648edbad79329024e184b6e229a1f31 fence-agents-kubevirt-4.16.0-21.el10_2.5.aarch64.rpm 8d32e8f80f4ccfac7e1e573957aeec1d8d8e0018d56034eefd0092a119556351 fence-agents-lpar-4.16.0-21.el10_2.5.noarch.rpm 91ae58cf021e245e1a1bf1024c70c1f559915400b560633a3068c117a652dbec fence-agents-cisco-ucs-4.16.0-21.el10_2.5.noarch.rpm 9380d9758dfd4d1453e71e86b6de038363038a4d33fa19c298d368038b30f2cd fence-agents-vmware-soap-4.16.0-21.el10_2.5.noarch.rpm 998f6222b512104dd6ebeef7539b27e306dc5fcfa10ff8331e8975e680821aff fence-agents-heuristics-ping-4.16.0-21.el10_2.5.noarch.rpm 9a5a0dc003e77f5a9ea108f92a622c5d6976e36a844c4b748e069257b31f1021 fence-agents-common-4.16.0-21.el10_2.5.aarch64.rpm ab8556814e76774ad75a9587ebad14888791859081cd49582084ccc0597bdc35 fence-agents-intelmodular-4.16.0-21.el10_2.5.noarch.rpm af75659dc64c53a891fd4636e3b0602ad519684579d5271ea03c01a7caa278b2 fence-agents-emerson-4.16.0-21.el10_2.5.noarch.rpm b3ba20e516f6f7d2812656bf61775f98e42e342544de7b9ed01aa80028d7e454 fence-agents-vmware-rest-4.16.0-21.el10_2.5.noarch.rpm bc1b3776aff2e7d3bbe29a17599074c9bf396e5e1b77fe5ab1defede6847358b fence-agents-apc-4.16.0-21.el10_2.5.noarch.rpm bec0c532edc9657fca3d85daa3a0597c46af622904928c2339a37f0adf7ed7ce fence-agents-nutanix-ahv-4.16.0-21.el10_2.5.noarch.rpm c009350e071848c015df98437c80cab01c9ca98f0801415e0e5a445ee998c502 fence-agents-rhevm-4.16.0-21.el10_2.5.noarch.rpm c41641cbe4507b116bd310318f52a3d80536a50089c6df7dca2a11a7a759457c fence-agents-drac5-4.16.0-21.el10_2.5.noarch.rpm c72dc94ebe3471be09580a457d1e65fd832107047626548b5bfb15a04b9060dc fence-agents-ipmilan-4.16.0-21.el10_2.5.noarch.rpm cc3c20cef2b889d5204bd8db41430e7e4147d375fba2c598f1d7f4ae9a00fd26 fence-agents-ilo2-4.16.0-21.el10_2.5.noarch.rpm eb84f77d4c349914d249a21e99b260421c5f9152deb8ab4f6aefcad2c4b71e68 fence-agents-ilo-mp-4.16.0-21.el10_2.5.noarch.rpm eeb9b2bc6cde8b87c3ec4e65ba4ab628d789e89f6bb675f9de06ddff240c830a fence-agents-ibm-vpc-4.16.0-21.el10_2.5.noarch.rpm f902c8e652433f804325f4d993ebdaaa7d96b4806e8da803c04d74fd44eb47e5 fence-agents-ipdu-4.16.0-21.el10_2.5.noarch.rpm fc9de80e97011d49b8861f131eb3794c92c566c1c4502d917365892d71a8bb61 fence-agents-redfish-4.16.0-21.el10_2.5.aarch64.rpm fe2062d94db1627f4705299945f6703899942b21e00a55891d780ce62810ddd5 ALSA-2026:48650 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default vim-enhanced-9.1.083-9.el10_2.12.aarch64.rpm 4b398190dd889152c155117a7b6382b39d87e63cd67e79a800f60d06b6badce3 xxd-9.1.083-9.el10_2.12.aarch64.rpm 8de0cbfc5604799eef56aba714d8cc6e86960c9d9d6a751a8bd7022ae4b2c103 vim-common-9.1.083-9.el10_2.12.aarch64.rpm cce60fc8141233c58a1c4bf8f5b4b7fb9a28445cb2a17747fa866d0a6b2738c8 vim-X11-9.1.083-9.el10_2.12.aarch64.rpm de3a1655f08e36b50e763133998c3f3e55f8357e537f34d562f675215cc52d62 ALSA-2026:49211 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () Bug Fix(es) and Enhancement(s): * [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [almalinux-10.2.z] (JIRA:AlmaLinux-185669) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-10.2.z] (JIRA:AlmaLinux-212063) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.42.1.el10_2.aarch64.rpm 34b298d06c265111672bc4aa9287ca0c8382c0dde3333df710e994d526561605 kernel-64k-debug-devel-6.12.0-211.42.1.el10_2.aarch64.rpm 3983004a35e17f0438e2076201544d596b875fa06195ce1ed6e946d8023e07f1 rtla-6.12.0-211.42.1.el10_2.aarch64.rpm 3d921251f895d95604473c1b958f6b3fd17e1c0ddced6419c4479b967330b247 rv-6.12.0-211.42.1.el10_2.aarch64.rpm 4566155d0c2a63698144d9850f970e26b7f09132e0f3d417373212c3a80a35fe kernel-devel-matched-6.12.0-211.42.1.el10_2.aarch64.rpm 4d7b9fbf0d30eea459f26160506eb1419c05c6a3b533020e3e1a6980d4d5c8b9 python3-perf-6.12.0-211.42.1.el10_2.aarch64.rpm 5f65c0c216b9a8086535e642529639405edc6bc9b97f07245b604a59afa1c49f kernel-64k-devel-matched-6.12.0-211.42.1.el10_2.aarch64.rpm 74cb536199bcb7c51757302d9ca4f6418d2d087b166587f42868055d8faa7e7d perf-6.12.0-211.42.1.el10_2.aarch64.rpm 7d6f3bb8b23ac51f03b3bb5761c7913e162be246cfc269b4d513be606ce4a8e4 kernel-debug-devel-6.12.0-211.42.1.el10_2.aarch64.rpm 8c3b537ccd278abdbf356677bcd1ddf28e17b9021612531893263dc16758bf17 kernel-headers-6.12.0-211.42.1.el10_2.aarch64.rpm a8cfdb934ba62ce87fd349d9815a8946ad55b1c5e5a74def181982df2b2e1171 kernel-64k-devel-6.12.0-211.42.1.el10_2.aarch64.rpm ab6071577ab492e53f2a69fbc4bf99806c8e3dbf8d251e4fb1bef913e75796b4 kernel-debug-devel-matched-6.12.0-211.42.1.el10_2.aarch64.rpm b0f42dc6318dba5f4d48f5a01cbce48083dd40651428d6cc5b1aeddb0c87415e kernel-doc-6.12.0-211.42.1.el10_2.noarch.rpm bf419056c1f25a425baf0071c6b140681f7a5be5fb6970d09bdaddba8a9d6353 kernel-64k-debug-devel-matched-6.12.0-211.42.1.el10_2.aarch64.rpm c754eefe7d9027e6695ff1649d1eeb581765609777405af097106cea8376529b ALSA-2026:49508 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux (CVE-2026-5056) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.2.aarch64.rpm 3bb01f4ae696cc6f8b4d6a3d7ab204ab7abd030504585e4d82d93244633020fd gstreamer1-plugins-good-1.26.7-2.el10_2.2.aarch64.rpm 66be7d402db34ec3ac46f1240fc55c9fe9b0b2235310b1eccec71102ddd884a4 ALSA-2026:49514 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380) * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.3.aarch64.rpm 2d1ce3dcffe28252054022af52461c97c96a3aca23a30d17904a29abce015934 ALSA-2026:49523 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files. Security Fix(es): * perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size (CVE-2026-9538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-Archive-Tar-3.02-512.el10_2.2.noarch.rpm d2c6df33777b5bff8ce63f4a073d414a7c9afac6e1da152d7b5a41393951e548 ALSA-2026:49526 Copyright 2026 AlmaLinux OS 0 1 Important

osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default osbuild-composer-165.1-3.el10_2.1.alma.3.aarch64.rpm 954f666de69e01435f4ddc563bc02109abe9da1f496fad627ec2bc03a12a3447 osbuild-composer-worker-165.1-3.el10_2.1.alma.3.aarch64.rpm cbb7a995b66054ab226ae742fb86c13985d51c0b26b95cd1333caba0d94821db osbuild-composer-core-165.1-3.el10_2.1.alma.3.aarch64.rpm d03914881df18ac885947ef174a74f3d95edb20d3993a67c8b7cfb3ce95ec0dd ALSA-2026:49621 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default thunderbird-140.13.0-1.el10_2.alma.1.aarch64.rpm c3a5190baf6e19bd412014a2b39569f670f875bf12c217a5a24d720aca044fb9 ALSA-2026:49668 Copyright 2026 AlmaLinux OS 0 1 Moderate

p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files. Security Fix(es): * p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing (CVE-2026-13757) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default p11-kit-server-0.26.4-1.el10_2.aarch64.rpm 14336768dfa1cef4b3c6cee8bd259d88eb2cb719f0ae9d715c024c52c232036d p11-kit-devel-0.26.4-1.el10_2.aarch64.rpm 7c9fda1e3dfad5d1797ed50b587e6a9d06fa952930d89165dc0dc2f8b7c37486 ALSA-2026:49836 Copyright 2026 AlmaLinux OS 0 1 Important

ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets. Security Fix(es): * ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default ldns-1.8.3-18.el10_2.1.aarch64.rpm 82094e59548b876f97fc8f220aadda9ca8820f1a31886fc80efeaa29e3b57e12 ALSA-2026:49871 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214) * kernel: procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199) Bug Fix(es) and Enhancement(s): * [Lenovo] Graphics not working on T14 G7 Intel (Pantherlake) (JIRA:AlmaLinux-172832) * Possible regression with FM350GL [almalinux-10.2.z] (JIRA:AlmaLinux-184266) * [10.2 FEAT] CNB102: dpll: sync with upstream (JIRA:AlmaLinux-211011) * backport make module and modules-core provides use variant [almalinux-10.2.z] (JIRA:AlmaLinux-213965) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-headers-6.12.0-211.43.1.el10_2.aarch64.rpm 079b6ecf08428a23d67fc55d7c4a4d7523b8e65758e056ced49c0aec0d295b3c kernel-devel-matched-6.12.0-211.43.1.el10_2.aarch64.rpm 168e6df7ad350abc2c94fec5ba43dc4d068cd78bc20fa6d83fdf490a564ea1d3 kernel-doc-6.12.0-211.43.1.el10_2.noarch.rpm 1c74553d75296b52e5083e8873de03e04a8574cf085839e5ac3f4e2003a287ca kernel-64k-devel-matched-6.12.0-211.43.1.el10_2.aarch64.rpm 1d3afe3a28aa408c8c1fe48723632292e3cb5e06d0e3da25bc1067f159923990 kernel-devel-6.12.0-211.43.1.el10_2.aarch64.rpm 3d6fecea4a00501054f2f8e7fafc3410cb92e90b51128a31388e61a3ae4e0cae rtla-6.12.0-211.43.1.el10_2.aarch64.rpm 3f90f043996427514eb60d04811eaa67dc5be8897bb6157e7cc7a340dc29d606 python3-perf-6.12.0-211.43.1.el10_2.aarch64.rpm 6a03286462c9390ce8646a0b6f252c4bdbe8b82e242dc3b001d4b35ec9730f2e perf-6.12.0-211.43.1.el10_2.aarch64.rpm 7a09de17d4467ae6b42feeb86397409bc8d76f42b331e97f09204a1647652ac0 kernel-64k-devel-6.12.0-211.43.1.el10_2.aarch64.rpm 8e985a5bf1f3698b632fa5ac578bd30455508d4a75a5f84b08922c24e8c34421 kernel-debug-devel-6.12.0-211.43.1.el10_2.aarch64.rpm 8f2ac33dd8c439c330c07e135b963b3f61662a004593d74e88e8d00a1d6b9384 kernel-debug-devel-matched-6.12.0-211.43.1.el10_2.aarch64.rpm 99782ba28c89312c538eae1715cadd0e97291df98f7e8d9a05a78c380d31d922 kernel-64k-debug-devel-6.12.0-211.43.1.el10_2.aarch64.rpm c4fa0f2be24464bc18906e19fea6195a0f882e098704baf1f1c48d2d68bdb9ce rv-6.12.0-211.43.1.el10_2.aarch64.rpm c513f2a010e057fa7acad7f41ea7e564f2909b65a99012e46ab345fe4d524289 kernel-64k-debug-devel-matched-6.12.0-211.43.1.el10_2.aarch64.rpm f2132b27268387467d5fb7a744104e3c485b86a9fbeb3a43aaec734aebf457d0 ALSA-2026:49914 Copyright 2026 AlmaLinux OS 0 1 Low

php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.4.23 for CVE-2026-14355 in 10.2.z (JIRA:AlmaLinux-192616) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default php8.4-bcmath-8.4.23-1.el10_2.aarch64.rpm 0b648def0b58a08563e96e4f50a45766b10ab3a6b9e6b1ce6f0caf127b40b72c php8.4-fpm-8.4.23-1.el10_2.aarch64.rpm 18b416414bd8a85089acd6e72043b713a58356338a0b663da77b88f9b72d6ebb php8.4-snmp-8.4.23-1.el10_2.aarch64.rpm 190e199f0febd85c0da362d7bdc11ce690e7b89e4992d37f1369ea9bb256041b php8.4-embedded-8.4.23-1.el10_2.aarch64.rpm 1ec5401d750e1a01e0d81ed023da590a75bd3446aa008e1b1c189978add39650 php8.4-mysqlnd-8.4.23-1.el10_2.aarch64.rpm 28e8125ea2c3b0e7147f77d5720c167ac89e89fb7171563df387dfc64fe3433b php8.4-common-8.4.23-1.el10_2.aarch64.rpm 3b75958bbdc84477beb0620b7693f7299f0eb0384a7d761169555dc5dd93f488 php8.4-pdo-8.4.23-1.el10_2.aarch64.rpm 42812b1c7316a3e2fed685436d37e1f9438e7f3d206c5c4f0f5b2d81408ba007 php8.4-cli-8.4.23-1.el10_2.aarch64.rpm 544cfea16da81c407b4a59e2d640f04545b7c597fc96bb1214d2d51aa9bf2373 php8.4-opcache-8.4.23-1.el10_2.aarch64.rpm 58bbe476ef5f5868aab4cc650617ad566e3237cd5ef7017b25102a941a8c1f33 php8.4-gmp-8.4.23-1.el10_2.aarch64.rpm 5b15ecfc45f7216441c3b707eab68342c6fb61ebf06d77391d95ed56d133de56 php8.4-dbg-8.4.23-1.el10_2.aarch64.rpm 5b42d625550f8da14344edfb39861a1d5c839feaab92850c922f1d8d1eba4741 php8.4-pgsql-8.4.23-1.el10_2.aarch64.rpm 6134487d23fd0ffafd45eebedca2c3b6f127ee3e5c3bb6736d846f2abdbdb12d php8.4-dba-8.4.23-1.el10_2.aarch64.rpm 752caf0eaecf6488cfaddd9dc68ec38c624b480840080f1bc560156a84290a53 php8.4-odbc-8.4.23-1.el10_2.aarch64.rpm 785ba9519cf5cf879b5e9ff47a2c67d7edcb78f88c2aa651aba86091058d8a29 php8.4-mbstring-8.4.23-1.el10_2.aarch64.rpm 923a6b3ad957b2cbcf942fb7391e9889922e4d1bf813f63f87f043b242c523a1 php8.4-gd-8.4.23-1.el10_2.aarch64.rpm 95be3a73a4d0cb10a4d65a68e5d6892727a6bad40220871a49043be2402b4b15 php8.4-ldap-8.4.23-1.el10_2.aarch64.rpm aab788b03f6c28edf77b510cbd10848e0f8f416e9df0141bb15a8c50dbc5d627 php8.4-xml-8.4.23-1.el10_2.aarch64.rpm ae68159b41ca474f3777dad730807b8311b7d6d73721185d8c070931d7ca1576 php8.4-ffi-8.4.23-1.el10_2.aarch64.rpm d4558ee712c39c8bc976e4e1adf325fea30004a0adc079cbe736cbbd39bfa8a3 php8.4-soap-8.4.23-1.el10_2.aarch64.rpm d79ee132a68a2e7fe479ad806404d5d6bb59cbefabb0ce081e47fe95450db7e2 php8.4-process-8.4.23-1.el10_2.aarch64.rpm e9fc81b31182bf5b39364fd3272f33b185e7b656c13482b5e1a75f33f0198dec php8.4-enchant-8.4.23-1.el10_2.aarch64.rpm f4ec454d96a8dbf22b367e509fe396ff694e6524df1bb558b8f7ad02922fe313 php8.4-8.4.23-1.el10_2.aarch64.rpm f6fbf7bc0d1ca9a5e9b1ba403b82b6ae2aa8c53a154fd6598abdbda810fc8b8f php8.4-devel-8.4.23-1.el10_2.aarch64.rpm f7499db6ebe27927d9c9d3f0a8311dbc1b594b5f2a42304bc719ec0a805bda43 php8.4-intl-8.4.23-1.el10_2.aarch64.rpm ff29034fcb4d67ebb7f11d60ba9819d4f087da82921c632ad25896fa0ae1f93c ALSA-2026:50144 Copyright 2026 AlmaLinux OS 0 1 Moderate

libgcrypt security update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix(es): * Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libgcrypt-devel-1.11.0-7.el10_2.aarch64.rpm 0ec71cfef23a624d6e88846e68bd81e00635aa613d72e4ab90f64c005a8f292d ALSA-2026:50747 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding (CVE-2026-55827) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libwinpr-3.10.3-12.el10_2.7.aarch64.rpm 67c8094c88d6ce7613ceeb1968c9cd1d6a63b1429e4f438bf1fdfa975d1e845f freerdp-libs-3.10.3-12.el10_2.7.aarch64.rpm b8a250e93526468e516045ed040647a4c6520a847f502fee3cd7e2f05bb54bde freerdp-3.10.3-12.el10_2.7.aarch64.rpm df438eaa4878fb19c31337b3ccb2c09d0fd82ef53c92a73f040d23b092990d44 ALSA-2026:50773 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security, bug fix, and enhancement update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241) Bug Fix(es) and Enhancement(s): * ruby4.0: Rebase to the latest Ruby 4.0 release [almalinux-10.2.z] (JIRA:AlmaLinux-211310) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default ruby4.0-rubygem-mysql2-0.5.7-36.el10_2.aarch64.rpm 6e2bf05d760c6812499fd0a116046c8ae6a337df7a990ded72463c977894afb6 ruby4.0-4.0.6-36.el10_2.aarch64.rpm e176ec3f59a5409d2be7f3097664c96c40f20d426c5a3e1fa2b34d1a84c5fa77 ruby4.0-rubygem-pg-1.6.3-36.el10_2.aarch64.rpm e8f51d0d756c253dde61e694aaac5f976563b26b04d5fc4975c4306bb5a9886f ruby4.0-devel-4.0.6-36.el10_2.aarch64.rpm f93f75479436ecb8ce989d81e80c13b36f5ce4ce89b9d87e8eaa57afe7e12b8a ALSA-2026:50778 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241) Bug Fix(es) and Enhancement(s): * ruby: Rebase to the latest Ruby 3.3 release [almalinux-10.2.z] (JIRA:AlmaLinux-211300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rubygem-test-unit-3.6.1-14.el10_2.noarch.rpm 131dd8cdd912467ba1f8827ee2132e59e97772a0a19a34d30dd7839e793b2109 rubygem-io-console-0.7.1-14.el10_2.aarch64.rpm 1b2870e1012747ad23e7225b2d5c7967dc664b7b09e6e8c0c19d24a40c0919d9 rubygem-minitest-5.20.0-14.el10_2.noarch.rpm 21c1889fe2fe8b665fd8d07927f509fe6feeaf78754ab805c15679497e55be47 rubygem-bundler-2.5.22-14.el10_2.noarch.rpm 2351acfc5df3fcc5dde89c2945b1b2c2f82584566adf5020e0254e7f592cfebb ruby-devel-3.3.12-14.el10_2.aarch64.rpm 2e8d983d8628bb3decb8643d60a372b9f2da6f852c18474be95e85e31be260ad rubygem-racc-1.7.3-14.el10_2.aarch64.rpm 41727182d679ce3b192d2f40e3b114033828f2f3dbf551b6c587608436af7a70 rubygem-irb-1.13.1-14.el10_2.noarch.rpm 46613819af1fb9478b0e629651c46aa11e4464bb5c9cffee7e759d6786dec0bc rubygem-rdoc-6.6.3.1-14.el10_2.noarch.rpm 5c00d2550ead68020d3187766315cf476e673c256a3075d89c40e6868434b24e ruby-libs-3.3.12-14.el10_2.aarch64.rpm 5d6f80313b596034e72a04e72c5edac4b4a0fc18041f14bde28395cd941ad07c rubygem-psych-5.1.2-14.el10_2.aarch64.rpm 62197da2801406cd61424f7924d5e70c5f7a296d6096f274b640a7aee2b90f58 rubygem-rexml-3.4.4-14.el10_2.noarch.rpm 797e9b5def067ed1b4a076e585bd427d2faa3fa20db74f61c349ce54a17001bc ruby-bundled-gems-3.3.12-14.el10_2.aarch64.rpm 7a524b905c38fd5a289f8af66b1b0086ede1f57aae4c448daeb0d6306e1baa31 rubygems-devel-3.5.22-14.el10_2.noarch.rpm 7e994cc7820f22d4c3173560806e49845622523b1b6813aaaf17a3274d4dd035 rubygem-json-2.7.2-14.el10_2.aarch64.rpm bc0118992ed9e041f6ba673cf0e2d4d62628bbd7540e18b60574693bf2f9b8eb rubygem-rbs-3.4.0-14.el10_2.aarch64.rpm c196de80a63e0cb4c12c1372f22dcc3d84669865da0a36d6d3297936043fb323 rubygem-rake-13.1.0-14.el10_2.noarch.rpm c53bb678682a61e82cacd04f0a3d4f33c0e1d8dcad90c1eefd2d5de20caafebf rubygem-bigdecimal-3.1.5-14.el10_2.aarch64.rpm cbe8af53c49fb94ac46df121fc179adcac39a786af30fa504845a429ef464f68 ruby-3.3.12-14.el10_2.aarch64.rpm e5742df930b4ad2f82e486d95b22b32d5bf748162fa1346f0a24e65350425a61 rubygems-3.5.22-14.el10_2.noarch.rpm e614c319dddb353036831b3163c6c76c806a302b2d1b420f110dc3ac9779a8bd rubygem-rss-0.3.1-14.el10_2.noarch.rpm edcf8a577a06115a59a8a5e4d7f017b389372a4f7da251061524db691c1b5132 ruby-default-gems-3.3.12-14.el10_2.noarch.rpm eee30784ab9187664bab88713a780f0e03173777cb24eeeb2c65f08854146ff3 rubygem-power_assert-2.0.3-14.el10_2.noarch.rpm f635633eb2dfd48b67a65aa9e6a82eadfada6bc616d85081cdf4cc5bf73f08e4 rubygem-typeprof-0.21.9-14.el10_2.noarch.rpm f76ebecc0e4d4bec6ed47f476de014cea992d3b11812f607afaed01950bc5dc6 ALSA-2026:51075 Copyright 2026 AlmaLinux OS 0 1 Important

gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See <https://access.AlmaLinux.com/support/policy/gpsd-support> for more details. Security Fix(es): * gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution (CVE-2026-58459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-gpsd-3.26.1-3.el10_2.1.aarch64.rpm a03f1defb4c9fa792746544a307b11f0d3ad5cabdde1fdeb9ed9b44e0958f2fd gpsd-clients-3.26.1-3.el10_2.1.aarch64.rpm f1748b1318ac95cc99e0f387ebaeb9233ba86d43c5f93b3b56a74529862c1d45 gpsd-3.26.1-3.el10_2.1.aarch64.rpm fb7d4a5fc6886a60aa27551712459da9e4849597e684775ba97e28c30f121ba7 ALSA-2026:51295 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CVE-2026-43186) Bug Fix(es) and Enhancement(s): * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-10.2.z] (JIRA:AlmaLinux-186345) * ice: driver update 2026-06, part 2 [almalinux-10.2.z] (JIRA:AlmaLinux-193134) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-doc-6.12.0-211.44.1.el10_2.noarch.rpm 1c4aade5d5fb516248eb660f2819523377e9feca8b77c696901ba628dcc0602a kernel-64k-debug-devel-matched-6.12.0-211.44.1.el10_2.aarch64.rpm 225e07d3cda018e23ad29306b7c53f13861a725e1cb81df4b3e3660a0a3d7714 perf-6.12.0-211.44.1.el10_2.aarch64.rpm 32aa08e7734f460d2b57c75d6efff90e807924d33cd35002fa7f479c16d2af6f kernel-debug-devel-matched-6.12.0-211.44.1.el10_2.aarch64.rpm 33d15cbd48a771f8c7bb8937752e1df25457ce0fa67b894b765f21e3bfb1c15b kernel-64k-devel-6.12.0-211.44.1.el10_2.aarch64.rpm 4c3c82dbf70706ff948f49ee06ff01492ec877b1cef35fa886340b04421a5596 kernel-64k-debug-devel-6.12.0-211.44.1.el10_2.aarch64.rpm 5266461154c7a44e90c662af5e00ce527f61975a3b5fedd7c9aeb84ac0cfc570 kernel-debug-devel-6.12.0-211.44.1.el10_2.aarch64.rpm 584e93628dc931115cb89c330e4ae1e9211f97e96512fd1d1ac511b1688f7fa1 kernel-devel-matched-6.12.0-211.44.1.el10_2.aarch64.rpm 5bdbb83f8ef3b86b76ca37c0042458461d8a5a511b54fa581af5c3ebe0e88bfe kernel-devel-6.12.0-211.44.1.el10_2.aarch64.rpm 75316b33f8ef90e7c56f49fe553435073f15d8a36fc4c593beb40ad0ef30a79e kernel-headers-6.12.0-211.44.1.el10_2.aarch64.rpm 8ae3cc3df3e57e89179a27bbe7d685cd510445360ded87cc8b8c740a1321d6a4 python3-perf-6.12.0-211.44.1.el10_2.aarch64.rpm 9713ff9da781d6f13fac89dcf895d44b194912653c3ac7fd0bbbfebe0446ea00 rtla-6.12.0-211.44.1.el10_2.aarch64.rpm cf4664415067af87ec7d5c1ec1dbad7565065383984683d65a3dc335ef47ba12 rv-6.12.0-211.44.1.el10_2.aarch64.rpm d7d2d17c3e86da547426effd0202b87c4d01b379df804bc8a9dbcaf5cf99ddf7 kernel-64k-devel-matched-6.12.0-211.44.1.el10_2.aarch64.rpm e222721e9ca78e0d7badf9226f8ca9359668a4a573158fecdf6e561c2b4b6aa9 ALSA-2026:52675 Copyright 2026 AlmaLinux OS 0 1 Moderate

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default bsdtar-3.7.7-10.el10_2.aarch64.rpm 03134a893bb12ff67d35bcc244acfa7bede6422d2a488bfc6a86b01047472a7b libarchive-devel-3.7.7-10.el10_2.aarch64.rpm 90e87d9fff51859b1fbdf9fae6bbd0eaee4704a79426ba1be43177381a456f4c ALSA-2026:52841 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs-nodemon-3.1.14-3.el10_2.noarch.rpm 754dbb75c7096126fe89e0025ab2e31e63eda960fb77226c5e627a74feb18d21 ALSA-2026:53330 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fsnotify: Fix ordering of iput() and watched_objects decrement (CVE-2024-53143) * kernel: shmem: fix recovery on rename failures (CVE-2025-71072) * kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415) * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368) * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531) Bug Fix(es) and Enhancement(s): * Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-10.2.z] (JIRA:AlmaLinux-213035) * AlmaLinux10.0 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-10.2.z] (JIRA:AlmaLinux-222503) * AlmaLinux10.0 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-10.2.z] (JIRA:AlmaLinux-222505) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.46.1.el10_2.aarch64.rpm 0a17a168fbc566aa963f8dcd477572a6e5e644284134375ef5fe8ec31edca155 kernel-debug-devel-matched-6.12.0-211.46.1.el10_2.aarch64.rpm 44098716fa9493ef529cb979544fe7a12d020a4d3e907348237a64917e1d56b2 python3-perf-6.12.0-211.46.1.el10_2.aarch64.rpm 585c1c7b0c9668057a3be9088cd5655594a9b38498d5905354577f03596fca1f kernel-doc-6.12.0-211.46.1.el10_2.noarch.rpm 889073b12cc0ea295f2ca8fe44265cfc363bf64df9f9389e1236bf5667da86f5 rv-6.12.0-211.46.1.el10_2.aarch64.rpm a04e35f04032816f796c6a1d8cc72426355505220b0cd9a3e7e7ac7ab48de166 perf-6.12.0-211.46.1.el10_2.aarch64.rpm b4e9f53ea8d5c1a441869a5fe7dc111a6a17acf7c45c68f7cec880ea4ffb7211 kernel-64k-debug-devel-6.12.0-211.46.1.el10_2.aarch64.rpm b6196a49522b7700297301b86fef82e040da83517d878ed091400cde9a40d939 rtla-6.12.0-211.46.1.el10_2.aarch64.rpm b77c2a38266446f058fe4b83dcf501644a1373c5b03425a93dbe40834b513b63 kernel-devel-matched-6.12.0-211.46.1.el10_2.aarch64.rpm ba60bf9f843e60a8536aa9de087c33da9daf095cfc783b50323ebf8d7a951571 kernel-devel-6.12.0-211.46.1.el10_2.aarch64.rpm c45095577d7ea79792d96c8cdc81f69af8b43aa53af256cec2deb243c8e21f48 kernel-64k-debug-devel-matched-6.12.0-211.46.1.el10_2.aarch64.rpm c6fdae42e8a9cb5983ada307dcfbbb79501a5fe3f6613be2578be1c8d6a7e957 kernel-64k-devel-6.12.0-211.46.1.el10_2.aarch64.rpm d4320bd8a96e221fe0eae5259879e0994af34770a72915c2215c954bed6a6104 kernel-64k-devel-matched-6.12.0-211.46.1.el10_2.aarch64.rpm f68d3f58b66768b163a977e1fdb82cd6b670f29216dd9d90eb83a7820a9ec95b kernel-headers-6.12.0-211.46.1.el10_2.aarch64.rpm fbfc5cf4dd4f95747f1822dafb828768ae3e5dc9fc0d8638aaa04a1f6c099cf3 ALSA-2026:53435 Copyright 2026 AlmaLinux OS 0 1 Important

udisks2 security update

The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default udisks2-2.11.0-2.el10_2.1.alma.2.aarch64.rpm 24421a19130cf64be8c7c666d5d7ed3ebb937363f76a6c7790245ec2208a3555 udisks2-lsm-2.11.0-2.el10_2.1.alma.2.aarch64.rpm 4a8f0efe995b4b2f94944972ecc42df46e90a5e783f4a74511c97af2271aa731 libudisks2-2.11.0-2.el10_2.1.alma.2.aarch64.rpm 5bf60ddbfdd8ceba96ffc8e3579b6cf57b00eb8b78d20aa448db81c77eff8d94 udisks2-lvm2-2.11.0-2.el10_2.1.alma.2.aarch64.rpm 9e0d53531209172c6fc9f57850c1fc20614bdf5de8b6a1ea05d0e9ef322d05e7 udisks2-iscsi-2.11.0-2.el10_2.1.alma.2.aarch64.rpm b40c3c256af53b2bbce4bc3c3db829f7a6f2805998436c9c76d9414630d91581 ALSA-2026:53451 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.3.aarch64.rpm ce61dedc51b1152ac3081415b6153ed80a9a22addea6a302da461a007dd2aab3 gstreamer1-plugins-good-1.26.7-2.el10_2.3.aarch64.rpm e0218c48561d4073b3b4eadb7c616f26ea091eaeae426f596eff386ed5f611d5 ALSA-2026:53845 Copyright 2026 AlmaLinux OS 0 1 Important

iscsi-initiator-utils security, bug fix, and enhancement update

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks. Security Fix(es): * open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944) * open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943) Bug Fix(es) and Enhancement(s): * [FJ10.1 Bug]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [almalinux-10.2.z] (JIRA:AlmaLinux-191899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el10_2.2.aarch64.rpm 47c889eda97a74d986243fa5883ebabf8417a70d649c92b4be566f6f0e22fffd ALSA-2026:54178 Copyright 2026 AlmaLinux OS 0 1 Moderate

grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382) Bug Fix(es) and Enhancement(s): * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default grafana-10.2.6-28.el10_2.4.aarch64.rpm d44f8d15930e000611dccfed81a9580dabdcbbeb6e8eb8c50328855aeb0eceb2 grafana-selinux-10.2.6-28.el10_2.4.aarch64.rpm dfc4bd4882a03737d050aebce457aa23f5e2baf2dac1756a99c4e70b707c275c ALSA-2026:54343 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: perf/aux: Fix page UAF in map_range() (CVE-2026-64300) * kernel: af_unix: set gc_in_progress to true in unix_gc() (CVE-2026-53361) Bug Fix(es) and Enhancement(s): * netfilter: CVE backports for AlmaLinux 10.2.z (JIRA:AlmaLinux-185311) * tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-10.2.z] (JIRA:AlmaLinux-214436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-debug-devel-6.12.0-211.47.1.el10_2.aarch64.rpm 06d9722f4d9e89f93a5ee23a95bc625bf2382ba265b1dd184c1e772d5d016dc0 kernel-headers-6.12.0-211.47.1.el10_2.aarch64.rpm 1377acc5ad881d10e3ea55182b919573609c8a60742c2e53f1ea8ecc52beb384 python3-perf-6.12.0-211.47.1.el10_2.aarch64.rpm 30ddda561ab8310065c692629489d900c0f61545e588c3d4b5926e7d90b133ca kernel-64k-debug-devel-matched-6.12.0-211.47.1.el10_2.aarch64.rpm 61ca3fdabfebb104cb3278f03ed7b57e1fe01e99eba449b79f8920a33951ef68 perf-6.12.0-211.47.1.el10_2.aarch64.rpm 632015a978e9d308243f0769a2a4bd4a9e0e31be817e1e36e7229dbd943e17a9 kernel-debug-devel-6.12.0-211.47.1.el10_2.aarch64.rpm 81c27559acea4e388f04783a1e880b119eb4bc612cfbc353b768c2c5e878193d rtla-6.12.0-211.47.1.el10_2.aarch64.rpm 8327c9728e71536ef1d0a6d70354e5013be668617edbb9120b944ba5cc1f3aa6 kernel-debug-devel-matched-6.12.0-211.47.1.el10_2.aarch64.rpm b48fa7e8036d603766fa75ee98c2c577e965823cc41e23e66c840f53bb4a7b05 kernel-doc-6.12.0-211.47.1.el10_2.noarch.rpm b6ea785a24bb7a5f9f936164f09340cbc926d13f91290fde4caa9d611fc41c48 rv-6.12.0-211.47.1.el10_2.aarch64.rpm be8b52f232f4a42cfdec8e68fef146be97ec62186a2fb8cc2faf988ed5626c00 kernel-64k-devel-6.12.0-211.47.1.el10_2.aarch64.rpm c5877fb40b89bc9a64564c1e975fa1ec7515759a58f3540ecba93eb7fa11a74b kernel-devel-6.12.0-211.47.1.el10_2.aarch64.rpm d237f32c747758cd6f69e16386e7a9c287711f843971b58703b0f6d87500274a kernel-64k-devel-matched-6.12.0-211.47.1.el10_2.aarch64.rpm e0c6433b462b729cb2e3b1c6616a52db97019d4fb0d92630358046f591c317b6 kernel-devel-matched-6.12.0-211.47.1.el10_2.aarch64.rpm f793b507ea9f594ecffcecac593696c038973fbdbb7afc5d5237f77dbefd398c ALSA-2026:54486 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620) * FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621) * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default freerdp-libs-3.10.3-12.el10_2.8.aarch64.rpm 0cb124937e6d186599910ac7aae8074f9100ac1e53bb93f8dcd3b45e5351dd3b freerdp-3.10.3-12.el10_2.8.aarch64.rpm 4650cecde09e307c1dafce84d0138eb6e3116c21714729bc3878b93b8d4f2ff3 libwinpr-3.10.3-12.el10_2.8.aarch64.rpm bc41947dc0aeb51f1e50f99a9dba0e652b12ffca7187870268b664a26e419b95 ALSA-2026:54512 Copyright 2026 AlmaLinux OS 0 1 Moderate

gnome-remote-desktop security update

GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fix(es): * gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service (CVE-2026-18358) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gnome-remote-desktop-49.3-4.el10_2.aarch64.rpm 2921fa40e6f906a3e82b4ab7702c87ae2b4d44e3c2a0d55a95e26cbe30763b2f ALSA-2026:54541 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.130 Runtime version: 8.0.30 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-10.2.z] (JIRA:AlmaLinux-235472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default aspnetcore-runtime-8.0-8.0.30-1.el10_2.aarch64.rpm 14b623505e033ccb669ed385fdd4912dd6e45f6c3bb940282c873987e4066cb4 dotnet-hostfxr-8.0-8.0.30-1.el10_2.aarch64.rpm 1f68c537fbf8463fd5929db6e2c584e36c3e0c71c5bc8e2a138d18b145c9eb25 aspnetcore-targeting-pack-8.0-8.0.30-1.el10_2.aarch64.rpm 22bde6a81567c395af82533403cc97a8337d1e7027f575bd7d92a12e6c7abce3 dotnet-sdk-dbg-8.0-8.0.130-1.el10_2.aarch64.rpm 31ec42ee57d1f77c3f03d0d300c3cc001e70f0e09652451c58111598d7bacc56 dotnet-targeting-pack-8.0-8.0.30-1.el10_2.aarch64.rpm 3561cd94cf056712c5efc5583a1e77e120c3ab90aee1609b22e7db47e75bccd4 dotnet-sdk-8.0-8.0.130-1.el10_2.aarch64.rpm 4b0be8bba8ffc2f5ee1787b545242a1d36741faf20ef226f2ffadcd063ba9769 dotnet-templates-8.0-8.0.130-1.el10_2.aarch64.rpm 5913dd41b2c1e6fb53ae96181f20a2c0adec7893378504ba93f7ad3243d86cf1 dotnet-runtime-dbg-8.0-8.0.30-1.el10_2.aarch64.rpm 5e0856bb64c59a4c6f32a058beabcffe68b334c1fdfcf3650008b8893035c18b dotnet-apphost-pack-8.0-8.0.30-1.el10_2.aarch64.rpm 6a46a9c71baeb02e689a48727dee36320b012758960814199ce5315354939c3c aspnetcore-runtime-dbg-8.0-8.0.30-1.el10_2.aarch64.rpm d2ea8e7c18a9487c4f6415f3f22f148c3f7a4948f38a33aeffaae9d293107307 dotnet-runtime-8.0-8.0.30-1.el10_2.aarch64.rpm d4e12881d2de7c6556efea3d95b65768cf1bba3876aaf9f8535ca33b73995653 ALSA-2026:54576 Copyright 2026 AlmaLinux OS 0 1 Important

dracut security update

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dracut-live-107-9.el10_2.aarch64.rpm 18ef1b4d1a52d0ed9ffa28bc5822fb18f3bdafef33d94c51e6a3cfe0a3a5a4b8 dracut-caps-107-9.el10_2.aarch64.rpm b645bb057383c784fb1c1d1b096844b943f247546a112730d2768e2e60cdf9f0 ALSA-2026:54590 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.120 Runtime version: 9.0.19 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-10.2.z] (JIRA:AlmaLinux-235477) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default aspnetcore-targeting-pack-9.0-9.0.19-1.el10_2.aarch64.rpm 53875b8cbf1ae6045b9cded945f88c8f7f4be7a48828c7c26911bb96dd3669f4 dotnet-runtime-9.0-9.0.19-1.el10_2.aarch64.rpm 643bfba615c8e751dcc82a53daaae4b65fe4524b5e6c34ed1016166d792e159c dotnet-hostfxr-9.0-9.0.19-1.el10_2.aarch64.rpm 772f213fbe46beab817544c5f951228f9ef8dec9e0961408e61b91fb327c7ac1 dotnet-sdk-9.0-9.0.120-1.el10_2.aarch64.rpm 92d40eec71f92c54c0c9684e4b05fa77a0a6b57da4a9ebe31eb77d2703ca18ef aspnetcore-runtime-dbg-9.0-9.0.19-1.el10_2.aarch64.rpm a10cb48a6ea693acc1b80741ed4c1f991e27255817c00c2091c0d48d4e3cb0ea aspnetcore-runtime-9.0-9.0.19-1.el10_2.aarch64.rpm a28e308339b081e787117e4fcb9264dafc4dec581d500dd2d71efafce1c6d1ed dotnet-sdk-aot-9.0-9.0.120-1.el10_2.aarch64.rpm a41720b63515e120a5c4b51d414d094ece4cedbce62c53121146d3552c4c7df7 dotnet-runtime-dbg-9.0-9.0.19-1.el10_2.aarch64.rpm b1b57502c08b5308f0f80c352dcd6a156e1a6a9f63aeb8a021b919657272fe74 dotnet-templates-9.0-9.0.120-1.el10_2.aarch64.rpm c2dd9b8946f0bbdadab02d466766215edcf610b688e0fa2e1c06cd31f84dbeac netstandard-targeting-pack-2.1-9.0.120-1.el10_2.aarch64.rpm c7e46aa942c2d225dc75283fdc7712a27124e488854c97d49f32b53001d0b505 dotnet-apphost-pack-9.0-9.0.19-1.el10_2.aarch64.rpm e46e8f6d9f104e8d8c94ec251539750835f415550cbdb4610f661a2fd2a8891f dotnet-sdk-dbg-9.0-9.0.120-1.el10_2.aarch64.rpm ebe8c35978af10f5b4ccb164ab7c7fb5b08837fa21c1a07f0df07a43b95e391e dotnet-targeting-pack-9.0-9.0.19-1.el10_2.aarch64.rpm f102a808afdcdb7d0b3b57250e809a5fc8487b1690bf633f7c083ddbd8f6e68c ALSA-2026:54650 Copyright 2026 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libnghttp2-devel-1.68.0-3.el10_2.2.aarch64.rpm 77bc95780d78803ef8f5f42f580ed80944a66e879c5e8d5d13b8ff88e6d16436 ALSA-2026:55424 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default 389-ds-base-snmp-3.2.0-9.el10_2.aarch64.rpm 1614ba50ec72223d40e0c8fb858260855b9f573452c652b520b47124ed24a2af python3-lib389-3.2.0-9.el10_2.noarch.rpm 27cf3e06e99257f4c51c72088b1f9e5f48d590b294e516768385c0f484ac53a2 389-ds-base-3.2.0-9.el10_2.aarch64.rpm 4a8dd3fde6ef2a85e4863e0f96a5373530b21de0529dd0e2fde27165d8612c06 389-ds-base-libs-3.2.0-9.el10_2.aarch64.rpm 62a5e76842e95e60efc9902c80d50e66fb6458d5f05c6bcc86a56fc3fb03163a ALSA-2026:55432 Copyright 2026 AlmaLinux OS 0 1 Important

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.4.aarch64.rpm 891a2cd2f15edbcbe731726dd5a647faa3b0d7727fa5954d905287ad48e4fe9f ALSA-2026:55433 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.7.aarch64.rpm 2f8619523ff2d65eedd9cdb891769f7c595cb9a524f753fd8d59cad660c7e014 gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.aarch64.rpm 721bbba0f067ac8dc37033b70dd175730ceee44ba621034fe30e29a4a3b3d744 ALSA-2026:55434 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433) * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.5.aarch64.rpm a1fa46497d1310241888cd81beb7d4a8d88b860466d32446b51bea04f10fb0fb gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.5.aarch64.rpm e5f7c79f813dd03e18eafbf3532271fa92d448a1bd5312c9cb01d36e28ead608 ALSA-2026:55435 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL. Security Fix(es): * gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.2.aarch64.rpm 06bee9913332130808f3d673c597a625b92d6def3b5bbc99f71781fcc3dc88dc ALSA-2026:55437 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default bind-dnssec-utils-9.18.33-15.el10_2.10.aarch64.rpm 66b4318adbf0fc787471d55409532cff0485e09adcf0b1892790f6fa114851c8 bind-chroot-9.18.33-15.el10_2.10.aarch64.rpm 6fdac0fc0c986797863283705dcc31a7d91382a529db5f95e52f5ff9565c324c bind-utils-9.18.33-15.el10_2.10.aarch64.rpm cfc574740ee82a8fa55aef853cf6f3308448e93a6b911031e398e1e973b1c6f9 bind-license-9.18.33-15.el10_2.10.noarch.rpm e7269f3a04d0f19af0b01cb87ae997a2d63f8b901c3fbbbd06b2be1ac756d519 bind-libs-9.18.33-15.el10_2.10.aarch64.rpm f00ae9f038455fb68f1a0fe62a6d066fcc55a64c4f6ee7478bf171022f7ddbdf bind-9.18.33-15.el10_2.10.aarch64.rpm f11cba18f5b3021f6d369270dcd3f677403c9d74381fa9664cfc2b29c0891986 ALSA-2026:55448 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679) * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libXfont2-2.0.6-5.el10_2.3.aarch64.rpm bf986f9d14da7f869be28259df70799fa03d682f3778e08087f14ee8be621e4a ALSA-2026:55541 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs-22.23.1-6.el10_2.aarch64.rpm 04066b532b8828ca7825c8edd3c2db8e4022b3b292a1b01a4bc6e45e891985b8 nodejs-devel-22.23.1-6.el10_2.aarch64.rpm 081fb502f810304d9cfd46d300e377bf9efffb74005c04c8a54cd2b4430d3805 nodejs-npm-10.9.8-1.22.23.1.6.el10_2.aarch64.rpm 3e5649a5e0dd1b8d56a47412fe55b73e96be6e51ce4cd951987cc04ef950bc17 nodejs-libs-22.23.1-6.el10_2.aarch64.rpm 6a582967d11ffd10a365ad594763231e9e826eb19920e15741112d1a496a6bfe nodejs-full-i18n-22.23.1-6.el10_2.aarch64.rpm 72031ffa645716c6768e9c4efe56c7d8b71367aad7f9ea4e0b0957e74652a74c nodejs-docs-22.23.1-6.el10_2.noarch.rpm a4cf7db461223295f0f82718617815510079e00e6e5e5f79921d8490e5169df3 ALSA-2026:55617 Copyright 2026 AlmaLinux OS 0 1 Important

pcp security update

Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fix(es): * PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524) * PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526) * PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527) * PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default pcp-pmda-sendmail-7.0.3-5.el10_2.aarch64.rpm 026e569f73232f43f99296ba15b58e6ec64c502a58b07ac60986bdc93b3022ca pcp-pmda-ds389log-7.0.3-5.el10_2.aarch64.rpm 038b101d5067a6a5f60dce2ba61774e1cb694d7cdbe27a98d89b92f7741cf4f9 pcp-pmda-gpsd-7.0.3-5.el10_2.aarch64.rpm 04ed57e13d7e95389783c7932a837905c7702fc07959377b7e0da6561e7ebeb6 pcp-export-pcp2influxdb-7.0.3-5.el10_2.aarch64.rpm 09fbedb83b9129d312dad32b44ee148ae92db17824c019979d8861700de8f595 pcp-pmda-nfsclient-7.0.3-5.el10_2.aarch64.rpm 0a0a496084a774142afd97a83f31efd858cbdba3588dd220af877f3303e1150b pcp-pmda-news-7.0.3-5.el10_2.aarch64.rpm 12510fce34784ef206e484bc9124f72b5e1626257e552d2182ab34d6830764ae pcp-pmda-statsd-7.0.3-5.el10_2.aarch64.rpm 194c1c3ef440fac480021c8d5f38fbea97e2d8e0cd1dd3fc2b8dfc23cdece4ec pcp-pmda-rabbitmq-7.0.3-5.el10_2.aarch64.rpm 1c2c8380652ff4b6dc182412ea610c43d4701d1a123aa3a633f3f001af4fe9de pcp-import-sar2pcp-7.0.3-5.el10_2.aarch64.rpm 1d2d553f3cc6ad4673112d5505174c3167f4832cfb1e2b1a868883f244dd2986 pcp-pmda-openmetrics-7.0.3-5.el10_2.aarch64.rpm 1e8aefabcc469bf2a57327de3b1e7b5318ff8038cc6490820a2626571063d45b pcp-export-pcp2spark-7.0.3-5.el10_2.aarch64.rpm 21861d46fddb461d2908df86ba031d00403a8ee7a4fb0f9c5d64159af8350fd1 pcp-selinux-7.0.3-5.el10_2.aarch64.rpm 260fe07b0e4a3e5a0143ee316d349eaeb84ba5cbc70eecb45c402830f32e958d pcp-import-mrtg2pcp-7.0.3-5.el10_2.aarch64.rpm 297ddec6aa96055bdcd80728daf0eecb728b7b221bc8fd856e45108fb27fc818 pcp-pmda-named-7.0.3-5.el10_2.aarch64.rpm 2e45935140b83bb5884ed7c67ab0c82a95aa8aa36fe93ebe3c9b02e948eec609 pcp-pmda-unbound-7.0.3-5.el10_2.aarch64.rpm 2f01d54f1877a396390f227e5c9b1f8d4ffdcea94cffa252aeeb2cf8a6c6e4bd pcp-pmda-gpfs-7.0.3-5.el10_2.aarch64.rpm 2f7a7ed31d1b80d2d4b7530deb5574507b94719fb02bca7c7432d80da2cf976a pcp-pmda-apache-7.0.3-5.el10_2.aarch64.rpm 2fcebb91fc22f7d735af1453895826cac3fc0a5960ca68ccc2de8c43a642bca1 pcp-pmda-oracle-7.0.3-5.el10_2.aarch64.rpm 31bfc1c987235279f7e09edd40d570d0cb5f267109ed6dbafe3808a901356712 pcp-export-pcp2opentelemetry-7.0.3-5.el10_2.aarch64.rpm 3580c0a57a8f70b90ad8a703c05ed9b4d5f29282731ccc8fcd4f9dc4defd0014 pcp-pmda-mailq-7.0.3-5.el10_2.aarch64.rpm 37ea1512d44201935c530605ded89613354ff4bf226871351c9513930e871f4f pcp-pmda-nginx-7.0.3-5.el10_2.aarch64.rpm 39b54117b2564b8829f3eb5f1f813455d2d7dff86cc13c05feef092e6ea174bd pcp-pmda-docker-7.0.3-5.el10_2.aarch64.rpm 3b2e3d3bef969d34fba9edb92db8f82d96a5c6445ac4d1004f3f74b49faba865 pcp-pmda-memcache-7.0.3-5.el10_2.aarch64.rpm 3c9902df8479009c51d1d4fc9e80cee1ec3503971459aa7a061a5f50ff7ee391 pcp-pmda-trace-7.0.3-5.el10_2.aarch64.rpm 44ce12ebd3672fee6aa88772da2213e9a5c22a48e5fcf2f4a778f82cb2442580 pcp-import-pmseries-7.0.3-5.el10_2.aarch64.rpm 4523fb16ee5529a461db6636eaae9ed8d8e13a029a8d0146dcd134d2d4c24684 pcp-pmda-bcc-7.0.3-5.el10_2.aarch64.rpm 4af82c3d268dd31068afeb19f85c53e5ad3028f5f0f5df3313adff472cbc4fa5 pcp-pmda-denki-7.0.3-5.el10_2.aarch64.rpm 4dada052e57735aad8436185588eeab588d4ace9e2ed0fbafd6c339feda6be8d pcp-pmda-mic-7.0.3-5.el10_2.aarch64.rpm 4fc22cf766e8228bb19c007cc0944f86d71eafecfde2be8d0b27221f309db4ab pcp-pmda-weblog-7.0.3-5.el10_2.aarch64.rpm 518ad0aeb89d50abde2d1b5ea3c7e1b83131e5433ffbc6aa738373846245572a pcp-pmda-hacluster-7.0.3-5.el10_2.aarch64.rpm 51fabb51011b9b8507d14e11b3c55ae4f47492c2c51c76905689474cc56718d4 pcp-pmda-bpf-7.0.3-5.el10_2.aarch64.rpm 52929de227a9d444d4cc5e8a5fd51c751cefc6a2240692310de94b0ad6274f79 pcp-export-pcp2json-7.0.3-5.el10_2.aarch64.rpm 54e42c89a013477332a9da7f6b68bf88cf5d19dc1b7cde26b020a0031cbe65be pcp-pmda-mysql-7.0.3-5.el10_2.aarch64.rpm 55d30a96be908c32112234f2879fbbaf088e64b0195e63955a43aaf82e4af265 pcp-pmda-lustre-7.0.3-5.el10_2.aarch64.rpm 55f24074c8c5bc4ba80193819930558008105886a9a034890f54e76c9929fc95 pcp-pmda-dbping-7.0.3-5.el10_2.aarch64.rpm 56255aee45aa8f82809216247a9104cdbffe574a3b361820478a7ee4ccee898c pcp-pmda-pdns-7.0.3-5.el10_2.aarch64.rpm 56e36b2b03b9f70865419f6335e3dc05a2d2488f15f2072a3e8ec7404194ff9b pcp-pmda-uwsgi-7.0.3-5.el10_2.aarch64.rpm 5713f3559adc111c67cb0519bdb21adc5d1b8226a2b738924b92b9cd564fb2d6 pcp-pmda-cisco-7.0.3-5.el10_2.aarch64.rpm 5a83c8815bbb7939cb927bce967a7a1ab1e84ff08780c99c967b56fe87bf4479 pcp-export-pcp2elasticsearch-7.0.3-5.el10_2.aarch64.rpm 5c4a9041e0ca3b06e2a1b1d528176e5325ddec5f8ef38ed4c89dd6abed6a18b9 pcp-pmda-perfevent-7.0.3-5.el10_2.aarch64.rpm 5ec27f13d128f2a1958850361e02d62ab4469a2855acfcf672b5f607840c2c65 pcp-pmda-elasticsearch-7.0.3-5.el10_2.aarch64.rpm 5f60c00aede4b65eed981533b6df99644f56a351a6c68d0cfe2271eda09873e1 pcp-pmda-rocestat-7.0.3-5.el10_2.aarch64.rpm 61750907ffb40ded7046a3a8db761138809cea81ce4d3d5d3e33c3ea64ec36a1 pcp-export-pcp2xml-7.0.3-5.el10_2.aarch64.rpm 61d2f82a284b93cd613c070b41b347d0c8a598af6f160b11ac45e6bfc387f65d pcp-libs-devel-7.0.3-5.el10_2.aarch64.rpm 67a071656f8723b63da4ca2a649785a2b083160c404663e30542e970cc213653 pcp-pmda-slurm-7.0.3-5.el10_2.aarch64.rpm 69867a8a53157b36fb9fb3974c1aa8d4b6ab590c9aa82b02c653518a7d774ab3 pcp-gui-7.0.3-5.el10_2.aarch64.rpm 6d0c866562ff8d2fc105b82e50e786d6233e2b858b2f03e24f57c4ec262c3782 pcp-pmda-smart-7.0.3-5.el10_2.aarch64.rpm 70da74c681d9f9864e8a9ee07b9cd054c378f78e5a35222cef178625c9c48fb1 pcp-export-pcp2openmetrics-7.0.3-5.el10_2.aarch64.rpm 74941b7f202e79daa073d8e238f3ca8bf8d947e5b21e9f4922ce4f2fa48e97d1 pcp-pmda-nvidia-gpu-7.0.3-5.el10_2.aarch64.rpm 76236c4b1d63ac415e678c988a6cd31dcb6c184b16ebbcf3978b6d34e1079c85 pcp-system-tools-7.0.3-5.el10_2.aarch64.rpm 766952ab888d5ec7152f7228391aaa4b6b9ed09eada58d006472df2764f05cc7 python3-pcp-7.0.3-5.el10_2.aarch64.rpm 76776e5c2ed1fe6f9e5fbc70f9ec551b817457419760b5bc247044dc43f40763 pcp-pmda-redis-7.0.3-5.el10_2.aarch64.rpm 7c31d5887456eaddd052fc845bdad44fd609bde823df7b06b65c19ccafd6adb4 pcp-zeroconf-7.0.3-5.el10_2.aarch64.rpm 7d80420fd8c099c13c13d3a14a376ec8bb9978ab1b58c626aa9d7103f0592bc5 pcp-pmda-haproxy-7.0.3-5.el10_2.aarch64.rpm 7dc1eb2451f39bfe2141cc273740fe611098d9fc6c8e8279bc0406fec2902533 pcp-pmda-hdb-7.0.3-5.el10_2.aarch64.rpm 80338f5d45222cdccd86e342e25a66c5c00f37f702362007e15a16650c6e4757 pcp-pmda-logger-7.0.3-5.el10_2.aarch64.rpm 8129483b9d43735e39fd6249f6eaf6a50a595a2dcf4284c0cadc6a278232bee6 pcp-import-collectl2pcp-7.0.3-5.el10_2.aarch64.rpm 82defb8b2cab7ae03db4e5a6549c5ed8b6546a5366d1640c56e9bd4daeeca39f pcp-pmda-sockets-7.0.3-5.el10_2.aarch64.rpm 835dc4f0e7ac5f63a37908559e8573077786345d6932dfcc4e6c49e4337b0f6d pcp-pmda-farm-7.0.3-5.el10_2.aarch64.rpm 83eae49181c4d62933b343b35dc8fe1cbbcf67a4c094a4e098ad9c9db3fce245 pcp-pmda-zswap-7.0.3-5.el10_2.aarch64.rpm 85171695b1b90a04b460f491eb2215dc5c1a03614ad42052be22be0629748de8 pcp-pmda-lustrecomm-7.0.3-5.el10_2.aarch64.rpm 8547fe73a9f9906e6d23bcd6459117bd9cc35aca9a096f0be9f806b0c3e00cf5 pcp-pmda-zimbra-7.0.3-5.el10_2.aarch64.rpm 8d2a7d6e3c7bd8728fbb2f3a6ba0300ff3e1424baa234989b918582088af0d7f pcp-conf-7.0.3-5.el10_2.aarch64.rpm 8dba20a6981bdc5a30cabfac80a343ed8ecfe09a9e3e2f799483117fa75131b3 pcp-pmda-gluster-7.0.3-5.el10_2.aarch64.rpm 8e11c4f6a9cdecda1a02c7e9a13dbade68cd58a9be4675b9690929133eafe2e2 pcp-pmda-summary-7.0.3-5.el10_2.aarch64.rpm 90af599f6e6ea011ad283416e68323ba51e4cb094f58c5a6aef5dc00417a0e07 perl-PCP-PMDA-7.0.3-5.el10_2.aarch64.rpm 91145508253aef4ab464a9d614d332afb9ea956f219f327c76c87ddcb533977d perl-PCP-MMV-7.0.3-5.el10_2.aarch64.rpm 91bb413b2ed7a669239152a83e2d921a4cb3d21ce44327389461b4bfef605bc1 pcp-pmda-bash-7.0.3-5.el10_2.aarch64.rpm 9246a6d837a3361a2c83f9f06b5f9c5aab722603c74417c64cf66d66c7b0872b pcp-doc-7.0.3-5.el10_2.noarch.rpm 94a7dc3f75afab71ce735dd038541108a4e6b18e03790db4d1e46bbc272ecb1d pcp-import-ganglia2pcp-7.0.3-5.el10_2.aarch64.rpm 9799b460e3f36c03ab450bf9db7ddb0b019b83386266a402cb8efff8e7876d78 pcp-pmda-bonding-7.0.3-5.el10_2.aarch64.rpm 995b877a0fd63ba50e1ae134b80c0e55c753bc5e05b6f5ecbed241ec57e7ed70 pcp-pmda-libvirt-7.0.3-5.el10_2.aarch64.rpm 9a4157c8c0c14d2ba0100023b02a91cb2b59e7f6f6ba57324e904a80ccaf5591 pcp-import-iostat2pcp-7.0.3-5.el10_2.aarch64.rpm 9fd427e5b4156c1550fb6755f05f03ccea920289dec400a703fff408eb472934 pcp-pmda-mounts-7.0.3-5.el10_2.aarch64.rpm a33c5bfd22b5516c408c80d4d451bc2075a9fd5d88c78ba2d92ba62eba54a027 pcp-7.0.3-5.el10_2.aarch64.rpm a74a4439dddd89190c0d3e0cac55328bce1bc745eb2df86fde95fdc0fddd0454 pcp-pmda-lio-7.0.3-5.el10_2.aarch64.rpm a8a3d89c85a7dce0a8b8fcaa02b5ba932bca555e2017a352c2e3bcb045fc4830 pcp-pmda-lmsensors-7.0.3-5.el10_2.aarch64.rpm a9b0f88f4f529938c98df306390aa2a49b83579c8997c55a5b6dcd5230c76a9d pcp-import-benchmarks-7.0.3-5.el10_2.aarch64.rpm af365bd7abbccbebbbdf66798c1d0474ed61e6d1f4c7c6cb91565e831e73148e pcp-pmda-netcheck-7.0.3-5.el10_2.aarch64.rpm b3ef03890c333628ed92038b09eb26c1d2bd6d86e86f07828641fca323b21291 perl-PCP-LogSummary-7.0.3-5.el10_2.aarch64.rpm b9179140632962dce705760a9ba2e1f1f8b1d9805b07539f8ecb0a36a65bf4e3 pcp-pmda-podman-7.0.3-5.el10_2.aarch64.rpm bb309850d2d3fa8588d36462d100ab4e4a925efa7ae728b77e4137f7cf6d5b43 pcp-pmda-amdgpu-7.0.3-5.el10_2.aarch64.rpm be4a015b9d9ca2dd471bca36269dc3f8ff20d868686f10a34eae2c765f5f49cc pcp-pmda-dm-7.0.3-5.el10_2.aarch64.rpm bec5ee42f9f47e1e6b0bef653de753430cee461b6547fe22d7082b8fdc38d1ed pcp-geolocate-7.0.3-5.el10_2.aarch64.rpm c08d8545d93662532a4b34876dcc42597ae31c64382ef14fa6aa5f41aca63952 pcp-pmda-bind2-7.0.3-5.el10_2.aarch64.rpm c286ac8e5df2ff16a2223f6faf864b5753e6bb736f173300f568fa22d915a514 pcp-pmda-ds389-7.0.3-5.el10_2.aarch64.rpm c40c68906f5e467f9f504ee004de877a021dcab808e4c40fa48240c52ee951a0 pcp-export-pcp2graphite-7.0.3-5.el10_2.aarch64.rpm c5a3d6762bfa062aa80058ea98e3832004edf5bfac9968fd3869cfb7099e9edb pcp-pmda-shping-7.0.3-5.el10_2.aarch64.rpm c5e27e259f03bcc30ebe8e867b5182f2e77e401890dc939b4a82126f7a097a01 pcp-pmda-opentelemetry-7.0.3-5.el10_2.aarch64.rpm d8b0b5d1e28d6cc92f6c1694ae622788db9969ff22320de4cd341f78c67df3c9 pcp-pmda-netfilter-7.0.3-5.el10_2.aarch64.rpm d939f6a89d0bf03e6e042eac5025337ef185463ecd908279a679d462ea566cbe pcp-pmda-samba-7.0.3-5.el10_2.aarch64.rpm db7674916a74c19a6a2d91366084ab237875413821582b94c670ab1816a4b74c pcp-pmda-postgresql-7.0.3-5.el10_2.aarch64.rpm dbe358f6b31b8623467130c8289114a9ee4065f57af12bf0f01c4e169bad79a8 pcp-pmda-bpftrace-7.0.3-5.el10_2.aarch64.rpm deeae0dd715f6fafb6a9c6a8d4dd98d39bfbbbe63f59f21a27d30b3226b5c069 pcp-pmda-mongodb-7.0.3-5.el10_2.aarch64.rpm e0e04351eb4434c4b517b24fc9b8a62a3995f4e8dd7665eaa009b71ada6f576f pcp-libs-7.0.3-5.el10_2.aarch64.rpm e3b3c270d1087161c669392ead74cbac622c646d82448a64d2d694bf0c329a36 pcp-pmda-roomtemp-7.0.3-5.el10_2.aarch64.rpm e6bebb165c5e0e9e724f1cc9a3ec3fffe4d807f8bf3aae17446d34e97cd2d2df pcp-export-zabbix-agent-7.0.3-5.el10_2.aarch64.rpm ea5f5b3a593a599df4ea71248513b794894b79440c5b5375c55fd973302b04db pcp-pmda-activemq-7.0.3-5.el10_2.aarch64.rpm ee0863146f7c0b4cf9cecddeb5e9702f75c4b507552d48d9fc68890cc907e875 pcp-pmda-cifs-7.0.3-5.el10_2.aarch64.rpm ee9868965f548de267559d802c3ab210f08bb39dd56101df42c09bbd667853ed pcp-pmda-postfix-7.0.3-5.el10_2.aarch64.rpm f3890e879fd321d2ca76a4a5824bcd27b60aeaebad4b60efcdcee11435ce0907 pcp-export-pcp2zabbix-7.0.3-5.el10_2.aarch64.rpm f63f57c70b999a68075311fa8486f0c2cc3877583132f5684f05c4110b5bcb7e pcp-pmda-rsyslog-7.0.3-5.el10_2.aarch64.rpm f6dd1305d8290a47ce7f19853aa8fe088c776ef79d22ae8a09edffb84e79f56d pcp-devel-7.0.3-5.el10_2.aarch64.rpm f95e439a7a256e5ced348930f9bf982a9173eee65e9acc875fc241afc44c9d40 pcp-pmda-systemd-7.0.3-5.el10_2.aarch64.rpm fab44e20f2b7a8001598b378b8ca34c51c360d0955a92cf7734815fe7f47bfc1 perl-PCP-LogImport-7.0.3-5.el10_2.aarch64.rpm fbcd4427443a095e90d76ee57700ea62c9ea35202a972f1fb93646f38215208b pcp-pmda-openvswitch-7.0.3-5.el10_2.aarch64.rpm fbf66db66e4762ead69be14e7885ca8ea6e26c92b9b70337fef8170dbdc634e1 pcp-pmda-infiniband-7.0.3-5.el10_2.aarch64.rpm fc471078e6d448cba2241be396776f4932851487ee29da1123e15aae8684db39 pcp-pmda-snmp-7.0.3-5.el10_2.aarch64.rpm fe3b16b8c21a857927c9d71d3e498873fd5b4c253914277602a534d5ae4293f2 ALSA-2026:55679 Copyright 2026 AlmaLinux OS 0 1 Important

haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fix(es): * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204) * haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default haproxy-3.0.5-6.el10_2.2.aarch64.rpm d9295cc2a61e85ee59a4f02c87e92a43dc8504cf0768aa8423f1fbe15f7c6d0c ALSA-2026:55787 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default java-21-openjdk-javadoc-21.0.12.1.1-1.2.el10.alma.1.aarch64.rpm 041458bc0c0fdee0843015c972614a3223267e1395a95ca39b6a0ca37bd6af7b java-21-openjdk-devel-21.0.12.1.1-1.2.el10.alma.1.aarch64.rpm 12245417bd0d01d6209b20611377237bcb838f28bcdec6e6bbe8ee92a7937a5f java-21-openjdk-javadoc-zip-21.0.12.1.1-1.2.el10.alma.1.aarch64.rpm 329b6243074a57bb87ea4d414a3c8a3e3d1bf685c486475fa3cd304af80d5179 java-21-openjdk-jmods-21.0.12.1.1-1.2.el10.alma.1.aarch64.rpm 6be5cd666ddf4ae185f847ed452112aa6bb07ae95f069a02a8795ed575a7419a java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.aarch64.rpm 7e7899ae75ac21990f7f496dfe98645bab2b952733d62fdb69ad41e46d56142e java-21-openjdk-headless-21.0.12.1.1-1.2.el10.alma.1.aarch64.rpm d18ba692e091a6d6d83bfac166d45d2cb16cf946b19f8ee9348dfa2177e27743 java-21-openjdk-static-libs-21.0.12.1.1-1.2.el10.alma.1.aarch64.rpm ed1a66339a023cd6b91160cf6a9915b4c7ad0be01829a5ea96a9da2ede406994 java-21-openjdk-demo-21.0.12.1.1-1.2.el10.alma.1.aarch64.rpm f72ab3d8155fb58f783c69e2e6db159cfd598420c4baba3829c92c80b8d41d8d java-21-openjdk-src-21.0.12.1.1-1.2.el10.alma.1.aarch64.rpm faaac8b2f5b7846e920a8fa46be2221373d6e4f1ff94935d033a22cac234f0c6 ALSA-2026:55798 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Improve font loading (CVE-2026-70906) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default java-25-openjdk-src-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm 1ca36d0dd9bc7e77e88aa0d6872cde113e1999b4b906a4cd7538549556b64346 java-25-openjdk-javadoc-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm 246772c47aa7bf47a7d2a1259f2c9d371cb5e30c1689129884d2edce0a0fae58 java-25-openjdk-devel-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm 343630f2b1ac4afa5e02de6cbf328616ed202bffab74e9f921123142f4aee7f3 java-25-openjdk-jmods-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm 3b05a51bf53f33b533535d57cfa0995ec5c1a1efedbace0e18b81cd7126f9bba java-25-openjdk-demo-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm 5c7e01b18aad6090b39f09beb826f75423d4a7ae06deeac00d072e89606e8bff java-25-openjdk-crypto-adapter-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm 8679046dccdd6758c5d1e47e631945aa3f80452da9743a341298eeac6e6b0d81 java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm 9635aa43a825b9e9686f211587f24a636b83ba99fa76cdf4f4c414a5d7d48961 java-25-openjdk-static-libs-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm a9a07a071b87fb07f27e40187093ef7a55faf478cae88d581dc270dde8116247 java-25-openjdk-javadoc-zip-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm be7db33df9ddeab4e5614e7eb2c6b6ff6bb589b435f3a30109d2c1910eee169d java-25-openjdk-headless-25.0.4.1.1-1.1.el10.alma.1.aarch64.rpm e549db3fbc2926d27150a86f02956ff0c26691b4f7003eeee2117e2bad1dd916 ALSA-2026:55855 Copyright 2026 AlmaLinux OS 0 1 Important

libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842) * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843) * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844) * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845) * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846) * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847) * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848) * libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849) * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850) * libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851) * libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libssh-devel-0.12.0-3.el10_2.aarch64.rpm 142fad30e98dc27dc7e7f71391326a207e449309717cc1bacfad2b63f5a7ab18 ALSA-2026:55858 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.111 Runtime version: 10.0.11 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-10.2.z] (JIRA:AlmaLinux-235482) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-templates-10.0-10.0.111-1.el10_2.aarch64.rpm 11e1252b3fe45cf55ff7025c09ab1ccc19396338bd8af511524a5981dc8c3bb9 dotnet-host-10.0.11-1.el10_2.aarch64.rpm 1a50d3ca1a13375d792a193659078fdf517c95e1ec3fd3a1b2a4369137daf545 aspnetcore-targeting-pack-10.0-10.0.11-1.el10_2.aarch64.rpm 27355e30cb9c901087e582232169bcc0dd3254cf1b5ca5eff44babe1a0089c38 dotnet-apphost-pack-10.0-10.0.11-1.el10_2.aarch64.rpm 585b76e8ab2230bce706efd60ab7a595ab27356aa9c989326b1d9af89143276d dotnet-sdk-aot-10.0-10.0.111-1.el10_2.aarch64.rpm 6eee7ed65086a1b67291a6167a7fda01a3b81bf58851baa3701253cce9455b33 dotnet-runtime-10.0-10.0.11-1.el10_2.aarch64.rpm 6fcdbbf5036abf9beed12fc9634fcf07c2fb8b268071ad7be1db97a8478572a6 dotnet-targeting-pack-10.0-10.0.11-1.el10_2.aarch64.rpm 70b2a6f4b533d582a207f81103e25d10fe380259f2768268822f69cae2e3bd4e dotnet-sdk-10.0-10.0.111-1.el10_2.aarch64.rpm 72732d5d2d0551356fa348c7318ec8f69d8ac1812cb18cd14611bf6bfd316722 dotnet-sdk-dbg-10.0-10.0.111-1.el10_2.aarch64.rpm aceca5b11718904dfa30b9e4ac26a169a2e59206b6e05b8e66c269389907f771 dotnet-hostfxr-10.0-10.0.11-1.el10_2.aarch64.rpm c611df009036667d4197b0ba12c8ba2ec07de23560c60b877ee66e38f6bcd127 aspnetcore-runtime-dbg-10.0-10.0.11-1.el10_2.aarch64.rpm d4562111b60f98924068d14b0e4ab6a2ca87f67f4ad2f359343ea1bc31aaa274 aspnetcore-runtime-10.0-10.0.11-1.el10_2.aarch64.rpm ed4f6fe60330bff81e642d521f0865e6e7ad6ff56ed7da338f5fdb079d48bb92 dotnet-runtime-dbg-10.0-10.0.11-1.el10_2.aarch64.rpm f41cda88d459152005440b7474bf203f00e947c91145a0e914a752534c921575 ALSA-2026:55892 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default unbound-utils-1.24.2-7.el10_2.4.aarch64.rpm 2d2cad288615eac319ba5b1acd1868894afcfca93518df101a45117daa186215 unbound-anchor-1.24.2-7.el10_2.4.aarch64.rpm 97c6980a6a7fac3d6822686b40b863d1c607a3cb1e19fdabdc9ff028b4384337 python3-unbound-1.24.2-7.el10_2.4.aarch64.rpm aed736edcfdc8d553698bed0f174b9753d09f7a8a5406707168eb09afd05f56f unbound-dracut-1.24.2-7.el10_2.4.aarch64.rpm c2351f47822d8467851df22738d3477f947ef37d416e838c06c5958ffdba59b6 unbound-libs-1.24.2-7.el10_2.4.aarch64.rpm c490d4c3522a2179ad5d94eef7103f69750b1acc2d0f5b5ff8e045c0f89a4608 unbound-1.24.2-7.el10_2.4.aarch64.rpm c62c1676cec0a00cfe95fe94f0fc7c80a9314c32325034a9184e4c7a039220fe ALSA-2026:56007 Copyright 2026 AlmaLinux OS 0 1 Important

mysql8.4 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: Performance Schema unspecified vulnerability (CPU Jul 2026) (CVE-2026-61081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47064) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47012) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60331) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60190) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60177) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-60145) * mysql: DDL unspecified vulnerability (CPU Jul 2026) (CVE-2026-46936) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60186) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60315) * mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026) (CVE-2026-61096) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60163) * mysql: InnoDB unspecified vulnerability (CPU Jul 2026) (CVE-2026-47052) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60188) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60184) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60185) * mysql: JSON unspecified vulnerability (CPU Jul 2026) (CVE-2026-61109) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60191) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-61094) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60178) * mysql: Group Replication GCS unspecified vulnerability (CPU Jul 2026) (CVE-2026-60332) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60189) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60747) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-47023) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60183) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60316) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60187) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60585) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60182) Bug Fix(es) and Enhancement(s): * [tracker] Rebase MySQL to 8.4.11 (JIRA:AlmaLinux-188044) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mysql8.4-server-8.4.11-1.el10_2.alma.1.aarch64.rpm 1e155cf3ad05674412e2f993cf446984de91ecfb594c3fb6d2f07d0b7fbbb24e mysql8.4-errmsg-8.4.11-1.el10_2.alma.1.noarch.rpm 363b90f121ea2698cc9695f9f3309d5ffa0b6afbaa96304878cd6e0f4729dc7e mysql8.4-libs-8.4.11-1.el10_2.alma.1.aarch64.rpm 7a4cee3dbc2887388ce39ea2a3bce5a34ddc94529b959d83ae646ce3726faa1a mysql8.4-common-8.4.11-1.el10_2.alma.1.noarch.rpm c88645f04b3cebf77c1371c06af54dbc511288a9c7e60b32a1b8566680f797db mysql8.4-8.4.11-1.el10_2.alma.1.aarch64.rpm ed85f9ca4d0d926c0054a52ba5ad0684d7b7fbc8e02037f2b55bc5e020aeb268 ALSA-2026:56965 Copyright 2026 AlmaLinux OS 0 1 Moderate

libcupsfilters security update

Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications. Security Fix(es): * libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611) * libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libcupsfilters-2.0.0-13.el10_2.aarch64.rpm 650495fc44c0f4e05c0c8f3d1a67ece6b91aa52c4db1633f2ba8231493362ae7 ALSA-2026:56969 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:AlmaLinux-223949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default php8.4-ffi-8.4.24-1.el10_2.aarch64.rpm 0366040347103e3710453c8b5566b9ad3c7a827a492b8ff3922011e52d002bf7 php8.4-dba-8.4.24-1.el10_2.aarch64.rpm 07fbdfef17e12846027e0b9beb21e40df3e4e8084f36bf45d0dd7cd93d66d625 php8.4-opcache-8.4.24-1.el10_2.aarch64.rpm 0ec393c87d924b5bde8f4f2b5139736a000edecf6ab1c0abfe52b63c9983cf31 php8.4-xml-8.4.24-1.el10_2.aarch64.rpm 11c315bd1048bb8c4a20d1743d85467fcd7ef00649a28fff7a38345881f21a5a php8.4-common-8.4.24-1.el10_2.aarch64.rpm 1b9c87e85cde29419d154a5c10ab3018738475030445e66d694156ade2c6c6ae php8.4-intl-8.4.24-1.el10_2.aarch64.rpm 25de89ca0da6d0ccb1d3c4c2d1456ba07b5c0fdd2c1a2b4aa03e51a8a35e8510 php8.4-embedded-8.4.24-1.el10_2.aarch64.rpm 293f3941da59b39b6a781719c4e7bf6745ee1c1d0f712a8e4f6c6a6ef18b542b php8.4-fpm-8.4.24-1.el10_2.aarch64.rpm 2bb8df2a52ccd484c7c8e627036efe65d438e3f7a85b553e3567f540a1509e5d php8.4-mbstring-8.4.24-1.el10_2.aarch64.rpm 32fb092a20891e4b619a2b96bbd26aafe292deecb4e89a606da8e22ce96da75e php8.4-devel-8.4.24-1.el10_2.aarch64.rpm 34ff6b30df9cc5b7ed5cc9606e4e0d09416fd3f51f4286520028334f3e9e779b php8.4-soap-8.4.24-1.el10_2.aarch64.rpm 3fb42c889e6b13a46b74ec0292e05b6efdac2dd8be236d902acaf511449dfe7c php8.4-dbg-8.4.24-1.el10_2.aarch64.rpm 4e020a04940b256b3ea3a8d58a996ec5abfcdafeff202681e8138592f6565f11 php8.4-snmp-8.4.24-1.el10_2.aarch64.rpm 52451262dd77db9516f555f83922c6f7406454cd23f7138e02cdd2257693e5b6 php8.4-enchant-8.4.24-1.el10_2.aarch64.rpm 70cb3d02657595765bf711ae4c17481686ddd1b987523f6626837a6dd72b32cd php8.4-pgsql-8.4.24-1.el10_2.aarch64.rpm 8d0d36ac02065c417708634ec3b1ffaec33110ea11ac8741417adbd3e994918e php8.4-pdo-8.4.24-1.el10_2.aarch64.rpm 96e7644604b20a3e7e8a69ed26eda5afaab028b63af5f8aefc294d9998c2def9 php8.4-odbc-8.4.24-1.el10_2.aarch64.rpm 9be67dcd838fce95938c1839d46fe5390b8d916e1f2573ea02d5dd9e5aeaa2b2 php8.4-bcmath-8.4.24-1.el10_2.aarch64.rpm 9fd5a02fab64da032eb1def74b31d94e1a4acd73bf29ecf6abbaedff83e4c989 php8.4-ldap-8.4.24-1.el10_2.aarch64.rpm b6e57027d78cd4fdf09087bd191609552fd24a8ceb620b823662b0a3df4fabd7 php8.4-8.4.24-1.el10_2.aarch64.rpm bcabfc18782164cd60513fcc3b1be5e0f162e27dd3ed160d1ac8a88838cbc869 php8.4-process-8.4.24-1.el10_2.aarch64.rpm ca5fef94f9522cacbeb5b48af3ae229657f3d49fa98ef5f6513df87d5e50e6e0 php8.4-cli-8.4.24-1.el10_2.aarch64.rpm ce9168ee302b590e452242ef437f03cf3e8acab3fa32afbd8c33d1bf9ed09197 php8.4-gmp-8.4.24-1.el10_2.aarch64.rpm cfd9a7caef2b4bcab7cd85498823d755cde894ec45a5c11ffd5b871a40fe4680 php8.4-gd-8.4.24-1.el10_2.aarch64.rpm d11654cba3ebd5f585cef4cacac45dd9596e9bc8b2a27ee8203437f10103ad3f php8.4-mysqlnd-8.4.24-1.el10_2.aarch64.rpm d36b051a55b2cbde7c97d7dbf8c81c7a1589461143c74dac782389429210e9a1 ALSA-2026:56971 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Date-Manip security update

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time. Security Fix(es): * perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-Date-Manip-6.94-5.el10_2.1.noarch.rpm 10d103055b714ff49d9c99838b44a6ae39437022daa8f3446516cf8eca19f1d6 ALSA-2026:57015 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010) * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011) * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012) * glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015) * GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering (CVE-2026-15588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.21.aarch64.rpm 8a351a42694bdb6bd8c8f663ab65a7425c46dd247c531cd72eaee838c504f398 glib2-devel-2.80.4-12.el10_2.21.aarch64.rpm c624fb70d208c37669bcdc7d038e4b58f0d9460b3e9ab517237fd8c675da5de8 ALSA-2026:57126 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.2.aarch64.rpm 15015f4482bdc52efa73db6c5ac8ba3dc0174805246d90b333ffa5068b4390cd ALSA-2026:57148 Copyright 2026 AlmaLinux OS 0 1 Important

ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. Security Fix(es): * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default ansible-test-2.16.16-2.el10_2.1.noarch.rpm 278ed7a9b385cb985f51b9a6e708b16d47cae71cb98ba0d3c8d13b7c71d3f0de ansible-core-2.16.16-2.el10_2.1.noarch.rpm 9e56e424dbf2c5ad2a45a0dfbe4d711e036865c0a60139679f71bec6f32d2897 ALSA-2026:57251 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878) * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185) * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991) * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379) * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386) * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560) * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388) Bug Fix(es) and Enhancement(s): * CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:AlmaLinux-223954) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z] (JIRA:AlmaLinux-224545) * cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459) * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z] (JIRA:AlmaLinux-235812) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.49.1.el10_2.aarch64.rpm 10c7bc50d649f7ab10467766fa50bdda7085cf262b3b27a4d3f45812dc90ada0 kernel-doc-6.12.0-211.49.1.el10_2.noarch.rpm 246731a322c2c865a9e626b9c0be133018206f6db8652c48453d46fdc34459d6 python3-perf-6.12.0-211.49.1.el10_2.aarch64.rpm 3be8f633c39061d0f4de82cf14f5611cf991187ea01a9178ecbc97adc7540eb5 kernel-64k-devel-6.12.0-211.49.1.el10_2.aarch64.rpm 3ff57faca12952c74eae1673313cba0b7ff5cbf1bea9632dda650c19171137ad kernel-64k-devel-matched-6.12.0-211.49.1.el10_2.aarch64.rpm 437bfd4b7868be91d3b6456156f9a066cb5903da5b549bbfc3ab0812797b12b3 kernel-64k-debug-devel-6.12.0-211.49.1.el10_2.aarch64.rpm 53869d594ccab3571dc8253b6680b54916bfb0b8f5fdfa028449253d5a95d0dc rtla-6.12.0-211.49.1.el10_2.aarch64.rpm 59cea1e9f807d7b9d2439638d73035b5a07645db519f4d18d7c4ae9d5d4b590f rv-6.12.0-211.49.1.el10_2.aarch64.rpm 61b597489c8c614b929efadc7c16b91b7078c431dfbb32179ea63aac0301ba98 kernel-devel-matched-6.12.0-211.49.1.el10_2.aarch64.rpm 69796f0a7ec2fe9469945db1b64504c7207fd750a6929ecc50937413c7ecf535 kernel-devel-6.12.0-211.49.1.el10_2.aarch64.rpm 9c238e7f4424f8bbd6a6465b981907ec8a0ece3d052dfb4a60dda5a78e34a682 kernel-64k-debug-devel-matched-6.12.0-211.49.1.el10_2.aarch64.rpm b0f8235d22b757ab73688ba9f3a69e35fc2ca5dabae75eb13a1c7546b1d5586e kernel-debug-devel-6.12.0-211.49.1.el10_2.aarch64.rpm b2d009ef8968570ffeb6e4ac1166b747116e70e2b4103e51094605dab9ba9a82 perf-6.12.0-211.49.1.el10_2.aarch64.rpm c8149217301a62fb0ced9797c23e87f2687b7fc4df49048e20ef01fcfeee5928 kernel-headers-6.12.0-211.49.1.el10_2.aarch64.rpm cd97e79d80054b25814f76217bd494c6dc8c75c4a8065a42643d7ba95e4e52dd ALSA-2026:57596 Copyright 2026 AlmaLinux OS 0 1 Important

mrtg security update

The Multi Router Traffic Grapher (MRTG) monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic. Security Fix(es): * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation (CVE-2026-72694) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mrtg-selinux-2.17.10-12.el10_2.1.noarch.rpm d7555e699b1e01e77cb85e1fbe4038f3f7826311959865d40f4c38eed8aa6134 mrtg-2.17.10-12.el10_2.1.aarch64.rpm ec79bacc19870521cfc9bd0913b407a0527a0c8610c4e847d3916cede0ce8419 ALSA-2026:58571 Copyright 2026 AlmaLinux OS 0 1 Moderate

qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914) Bug Fix(es) and Enhancement(s): * qemu-kvm hung during drain after double pause [almalinux-10.2.z] (JIRA:AlmaLinux-190702) * qemu-img create/convert fails on target block device with 4k sector size [almalinux-10.2.z] (JIRA:AlmaLinux-207389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default qemu-pr-helper-10.1.0-16.el10_2.5.alma.1.aarch64.rpm 0bc5531f143385791971179cd54c6a1c77eca85072af320dbde7c8c54ef47fb4 qemu-kvm-block-rbd-10.1.0-16.el10_2.5.alma.1.aarch64.rpm 1ddfdad21bf3723eb5314b2fc337f4308876bb55198af475d526c3b1f4229ecb qemu-kvm-core-10.1.0-16.el10_2.5.alma.1.aarch64.rpm 2f376fb151aeeecba5a9b225d0e644d07569536fce9267d8bf206196316fd0c9 qemu-kvm-common-10.1.0-16.el10_2.5.alma.1.aarch64.rpm 52f87452baf392eb992f2ab33df35f47f559df22e7e60eb258c48090f504a4f4 qemu-kvm-device-usb-host-10.1.0-16.el10_2.5.alma.1.aarch64.rpm 62b3c352364f1818d235bbdd4e42890e6ebbdca44506da32c894e33cd343d64a qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.5.alma.1.aarch64.rpm 7e10bacf591a57cc250bee4dfc55d7d14ef860c4c4a9f7340cdd00d2ec2129dd qemu-img-10.1.0-16.el10_2.5.alma.1.aarch64.rpm a198f47d0703a1a332eee3d19c055ca1f3c313e678a340fb8b719deac8d3e907 qemu-kvm-tools-10.1.0-16.el10_2.5.alma.1.aarch64.rpm a7fef5a210b58753aea0025ae4e81d3d33158e17efd6389e8e2f5eee9e508ea7 qemu-kvm-block-blkio-10.1.0-16.el10_2.5.alma.1.aarch64.rpm b31d985a0c8e4696a34e19f9a6300fdb882032de2cbdbc3953f4826624d3b55e qemu-kvm-docs-10.1.0-16.el10_2.5.alma.1.aarch64.rpm c49a4cce767e29fed4bab5dad378a0a1f0204298f46550ab746912d5ab73b7b4 qemu-kvm-10.1.0-16.el10_2.5.alma.1.aarch64.rpm c4fe484966c42816046affe812950549f47cf334963057c6bfbb90b79f6a581d qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.5.alma.1.aarch64.rpm c59dc8dc5b6594335555d125b222deab46adbafd17e58a27f20163c6228e658b qemu-kvm-audio-pa-10.1.0-16.el10_2.5.alma.1.aarch64.rpm d692852fe8609ddd0b42b8c69e511206de8a52084d46b533a10adb5ea276757c qemu-guest-agent-10.1.0-16.el10_2.5.alma.1.aarch64.rpm d9d617e01c383aca4a4a46fa990bc485e6984526fcc82cf9a4dd7e3da4fc0f56 qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.5.alma.1.aarch64.rpm df455ad05e7a4350bdbac1b044ac5ac4ece275b63737464ae2766d57c657a8a8 qemu-kvm-block-curl-10.1.0-16.el10_2.5.alma.1.aarch64.rpm f6a6171d77fb6b000c207f48f536c5a0d451825b25a516631652cba5540cf3b6 ALSA-2026:58819 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch.rpm 0b5823d155438be9e50559a2b2516af1f168e0c86471037562a2f1a8b8cc92f1 nodejs24-devel-24.18.0-5.el10_2.aarch64.rpm 3b7039ec9cc453d2b69835b04be13b3b504143c954aaf295dd5648fb85a72354 nodejs24-24.18.0-5.el10_2.aarch64.rpm 45a941bee15b368528bebb27a4fc4bf429f47c5a22bd23983cd3c57d4dbe617b nodejs24-libs-24.18.0-5.el10_2.aarch64.rpm 9c26d6d75a7c517c93705da59dc2e4e714d1c239597cc675157a3a128fbdb17a nodejs24-full-i18n-24.18.0-5.el10_2.aarch64.rpm c4fae0e893afce044f42ba648b0561cdae2b1064819246d3dd057b56820f3249 nodejs24-docs-24.18.0-5.el10_2.noarch.rpm f376c79686cb878dbaf4e4b6b47534b7dad0ad97bbd2d659ad2f239bdb1d023c ALSA-2026:58899 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component (CVE-2026-74983) * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-74943) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component (CVE-2026-74941) * firefox: Privilege escalation in the Shell Integration component (CVE-2026-74965) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-74946) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-74949) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-74940) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-74969) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component (CVE-2026-74967) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-74944) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default firefox-140.14.0-1.el10_2.aarch64.rpm b7806cf514a2cb23373e2a21a2f9a494a5763172a1eb455a4f62d5076afd0886 ALSA-2026:58902 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-tkinter-3.12.14-1.el10_2.aarch64.rpm 13b8c93542c4dd0a85473742b5bca21435fdd93d7ed68e77d1de29e953b057ee python-unversioned-command-3.12.14-1.el10_2.noarch.rpm 432002d2f2d16400a23c31dbfa20b3800372adba8054dfdfcb8877898640e6a9 python3-devel-3.12.14-1.el10_2.aarch64.rpm aa62573ea1fd2fa387fc07ef60607e03406415f74ffe311bcb52fe109bfe156a ALSA-2026:58927 Copyright 2026 AlmaLinux OS 0 1 Important

sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default sqlite-3.46.1-6.el10_2.aarch64.rpm 1a8fa785179c7a1cb9542b60f479ed66c87e21ade11145c3999910772a792caf sqlite-devel-3.46.1-6.el10_2.aarch64.rpm 8310015493a3114f342b37db03d33c805de32c68b5ec234bab7a12377c6cf71a ALSA-2026:58928 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3.14-tkinter-3.14.7-2.el10_2.aarch64.rpm 6b56c3bf948b7af07ce9f05166850decc8300495eaf9aef37e56338d93a58d13 python3.14-devel-3.14.7-2.el10_2.aarch64.rpm 76f2f6df968bf2c197769735a5aa26608d83916af9d5a665b8c82c5d00731617 python3.14-libs-3.14.7-2.el10_2.aarch64.rpm ae7dbc120cdc07ef726c25dbac844c7e1f143c4a269294c80c722ae549c18236 python3.14-3.14.7-2.el10_2.aarch64.rpm c12e2b503f609bdd0f9e0ac50bd0e59b18d38c052391bfd10bd636e9bf0aa92e ALSA-2026:59097 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-base-tools-1.26.7-2.el10_2.1.aarch64.rpm b1409a02384f3c44914651f020e676bb2c217bd304517688597102db55b6044b gstreamer1-plugins-base-1.26.7-2.el10_2.1.aarch64.rpm cf9c6ef9610f554fbc0457c69ae51ecd23f10ed26942efaf835fdcb7ebf79bb5 gstreamer1-plugins-base-devel-1.26.7-2.el10_2.1.aarch64.rpm feaf42342e152ea9a85265f51a723cb5d4473ae1bab6db6a0beca60f4e89026d ALSA-2026:59133 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296) * gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.7.aarch64.rpm 233f2246500ae505e9cd163b8b8c104afc0fcbb4e729102a68c8a41242353326 gstreamer1-plugins-good-1.26.7-2.el10_2.7.aarch64.rpm 40981e65d5f8114a3396e04ca26fa72b291bf910a68b26802cefd883f9a95cef ALSA-2026:59220 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nginx-all-modules-1.26.3-6.el10_2.6.noarch.rpm 0ee1da66b42d7a7309fa3e289c5fb632caccf67d24aeab9708c03be35a50dd93 nginx-1.26.3-6.el10_2.6.aarch64.rpm 6583c9ab3974b4b133ff0ad04c7236c9fdf6b7254ddbb6c46c2bae7d13ab07a6 nginx-filesystem-1.26.3-6.el10_2.6.noarch.rpm 6a4302dfb7471b2cc3f0c8e4f7944909387b627464c4efe14fde80d576b946c0 nginx-mod-http-image-filter-1.26.3-6.el10_2.6.aarch64.rpm 724f1db7227b760ed4844d187f080c141988d22cc3c5f458be9c8c99faf56d7b nginx-mod-mail-1.26.3-6.el10_2.6.aarch64.rpm 837b2bc170472f848aa898caf4ded5781bf477aeec8a0accd460d0f9089bbda2 nginx-mod-http-xslt-filter-1.26.3-6.el10_2.6.aarch64.rpm c54266077c11a1ed2d413555754e01bd01d1109ded570283705f7296568b8045 nginx-mod-stream-1.26.3-6.el10_2.6.aarch64.rpm d5fcff822f60f2baf02eea54c9742d890d35f659efbac85724c112332339f151 nginx-mod-http-perl-1.26.3-6.el10_2.6.aarch64.rpm e2797c67ca3993ca8e664fbc326d0610b7eaf311d27ccd499fa8c2f257941541 nginx-core-1.26.3-6.el10_2.6.aarch64.rpm fb84b8028a6d75137ac7cd6687b0e2ca12307009632b7000152eb73a6b9cca73 ALSA-2026:59243 Copyright 2026 AlmaLinux OS 0 1 Important

python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-pyasn1-modules-0.6.2-1.el10_2.1.noarch.rpm 05edb19dae2edc37e82548abae6af2808fd01ad0c9fb7d6e914cb343e2182e02 python3-pyasn1-0.6.2-1.el10_2.1.noarch.rpm 5a44c6804ccdde9b93b518b3d47f1187e4ee407ae6a058b986bc2fa52399e8bc ALSA-2026:59372 Copyright 2026 AlmaLinux OS 0 1 Moderate

assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing (either with JUnit or TestNG). Security Fix(es): * assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default assertj-core-3.24.2-9.el10_2.1.noarch.rpm 2001c3bdd1cac076d06f46697038efbcaea5ed8fff25714109166daf9b16ee5c ALSA-2026:59379 Copyright 2026 AlmaLinux OS 0 1 Moderate

pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default pam-devel-1.6.1-9.el10_2.1.aarch64.rpm dc86a5ee281d73f61eaac743fd28b8f3832d495c7ecb4eaa9cea88c9ce923ef1 ALSA-2026:59380 Copyright 2026 AlmaLinux OS 0 1 Moderate

attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fix(es): * attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libattr-devel-2.6.0-1.el10_2.aarch64.rpm b6629f41cdbf0130ea03eaea93ca98e4fa9c0e4b2241937b555638a8be9a3cda ALSA-2026:59972 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.8.aarch64.rpm 5a6d4f0c9e63beee6cf7c611303f8b7e37d63f68c0a8720adfc0ca7ebaf31ca7 gstreamer1-plugins-good-1.26.7-2.el10_2.8.aarch64.rpm c0935a5b6e436480ddf8f70e3f09e327bb26c257ae79f5501b4d66f9341bed74 ALSA-2026:59997 Copyright 2026 AlmaLinux OS 0 1 Moderate

polkit security update

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fix(es): * polkit: Polkit: Denial of Service via unbounded input processing through standard input (CVE-2026-4897) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default polkit-docs-125-4.el10_2.1.noarch.rpm 305e34938bffb0db90d5a6ec9e239162450d0c39bf641873dcc7b0598bf2930e polkit-devel-125-4.el10_2.1.aarch64.rpm 925b97fa2631fb243243606d743ab1f9711feddd76b86d96ef10dc0ac68ff689 ALSA-2026:60004 Copyright 2026 AlmaLinux OS 0 1 Low

httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mod_session-2.4.63-13.el10_2.6.aarch64.rpm 05ea8783a6ae6770ebc3bd254eb828758cdfa1023e7fb281ad67fdac093e60ed httpd-2.4.63-13.el10_2.6.aarch64.rpm 198c66452f481c3d6101a4099990df9ee6485ab35f72655f3ca5af1fe7d9128e httpd-filesystem-2.4.63-13.el10_2.6.noarch.rpm 2d887c9658de80e5f018347a72ff0e89acbb079bbd7a748b53ca6594ecae718a mod_ldap-2.4.63-13.el10_2.6.aarch64.rpm 4ecc7a48b3e111f4a016dbf5337cc77ecc8865172fb1b456be3f91bf38e848aa httpd-devel-2.4.63-13.el10_2.6.aarch64.rpm 57cfe372e635bd50ba0b39e448403c87c6a1269d7345a1fdaa70b0881247bdda httpd-manual-2.4.63-13.el10_2.6.noarch.rpm 69567bdd1024b64882fe35313f7a8f2549cab4b9a577ea66ad31608c30f9ff84 httpd-core-2.4.63-13.el10_2.6.aarch64.rpm 6c8ead4b871f20855d02e72e3bef0ad42cd0246b88767a4196daf0ab58ffcfe8 mod_lua-2.4.63-13.el10_2.6.aarch64.rpm 8dab8b4cca2423c47eed9b84ff69b0691ba43213cedcc94df8b6439dc0201de9 mod_proxy_html-2.4.63-13.el10_2.6.aarch64.rpm 91fc6dc1080c5c6c8cf5cbc4166dc0dc077f6c63d9eeccb3fddd10dd34aa1316 httpd-tools-2.4.63-13.el10_2.6.aarch64.rpm 944b1862bcf6257090cfefa5cd00b37a90d1031c852480d14f91077882a08e14 mod_ssl-2.4.63-13.el10_2.6.aarch64.rpm c0216e3b0c6b8b2f5959eb3cdf4ca3e90d138906aee15f5aabcc0bb63b7e43b7 ALSA-2026:60306 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.7+1 [almalinux-10.2.z] (JIRA:AlmaLinux-246423) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default golang-misc-1.26.7-1.el10_2.alma.1.noarch.rpm 1923dd6592518a5d2f4e4eef0ff7f7bf3b611a49230e03cd40caa092e84f83c5 golang-tests-1.26.7-1.el10_2.alma.1.noarch.rpm 2cd7fa5d945a940c336d1817cb06f166edf8869a955ca3e7b5638d0f77886aea golang-docs-1.26.7-1.el10_2.alma.1.noarch.rpm 36167694db02b79aff2148f3934c8d4bd287c3615d93d5a40f6356796ff2e299 golang-race-1.26.7-1.el10_2.alma.1.aarch64.rpm 4ddd8a303ee6bbe7390d18b514f40da8a7faff9966d8c5676653986059b753f8 go-toolset-1.26.7-1.el10_2.alma.1.aarch64.rpm 662797f2fed959ab8066c0859c88efb3f1a3d861460aa624ca37bc6efc7ce470 golang-bin-1.26.7-1.el10_2.alma.1.aarch64.rpm 7194157827a7ea2047adee4864a0eb7aef1e42fbad49313a4f974e4cb2b0b371 golang-1.26.7-1.el10_2.alma.1.aarch64.rpm 8fe1a12c99c3de63d57f3009bf6832f2e0e7d71e59b612fc6e4df35021c849a2 golang-src-1.26.7-1.el10_2.alma.1.noarch.rpm db81e8b2dcb9cce76b60048edd375ec23e8fb6a055cbceb28ee21bb48274cc6e ALSA-2026:60394 Copyright 2026 AlmaLinux OS 0 1 Moderate

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.3.aarch64.rpm d144af93e209777b6224329dc10ccd53db2a9246f75df0750567f1af97b8e4d0 ALSA-2026:61241 Copyright 2026 AlmaLinux OS 0 1 Moderate

pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: RAOP RTSP NULL Deref (CVE-2026-14324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default pipewire-1.4.11-1.el10_2.1.aarch64.rpm 3db94a8329bb6be3ccc0b85215739d27b7ce6730976bfcb5f748a4925ea094a4 pipewire-jack-audio-connection-kit-devel-1.4.11-1.el10_2.1.aarch64.rpm 549eb5ba6d7bd05c35f550048ec6fa0a2ae67906a5d3d37e11a4935032617a8d pipewire-jack-audio-connection-kit-libs-1.4.11-1.el10_2.1.aarch64.rpm 735a9881abf4632b94fac57b2be0fc327a6cf7732b2f8319ddb6c8a9a90a84c2 pipewire-devel-1.4.11-1.el10_2.1.aarch64.rpm 7b1bba02850f23e276540b55bcd289f2fccc655dfe307789904d3f21fa829493 pipewire-pulseaudio-1.4.11-1.el10_2.1.aarch64.rpm 8dfdc648264c86dd8c5b2b9218f4c58271e5cf61155a86a66dd48d475566f534 pipewire-jack-audio-connection-kit-1.4.11-1.el10_2.1.aarch64.rpm 985c30087fe7ecea67de571e3d6ecac4bf2c72501b538db64b01ecec8cd53b55 pipewire-gstreamer-1.4.11-1.el10_2.1.aarch64.rpm c8611317482f4e8447b46228bae6521e28c01c5b1c76d86471371d246d2371ec pipewire-plugin-libcamera-1.4.11-1.el10_2.1.aarch64.rpm d0c27fe2e96fbddef544ffcab938672cae77e1a1a6eb3665e3eb6929d6ec5cfe pipewire-utils-1.4.11-1.el10_2.1.aarch64.rpm df7c10055d0573936bd94145c1edf0e28d443478ec36d4dc070a58a17bd9c51b pipewire-libs-1.4.11-1.el10_2.1.aarch64.rpm efe81313c9ad9caeff3871c95481ec0df4fd4ea10ddcc090d0c9a4e4da87f267 pipewire-alsa-1.4.11-1.el10_2.1.aarch64.rpm f3427dc227839d4bed8b97cca0a51519f6ffdedfc5fabfd505d6ef0f3a26930d pipewire-module-x11-1.4.11-1.el10_2.1.aarch64.rpm fb8ef4ff0f0047b6311b9b1b3894eb1d8df03337696a741d4b6478639e1984fa ALSA-2026:61376 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs-devel-22.23.2-1.el10_2.aarch64.rpm 0ee79a30a7f54534b545e12899b8a72adfc5c292b58797b97bee3c05767527e4 nodejs-npm-10.9.8-1.22.23.2.1.el10_2.aarch64.rpm 0fdc5d65743c63e24cf4d64deb6e1e04cdb23bc4bd13e7dfd3ae44486c627089 nodejs-libs-22.23.2-1.el10_2.aarch64.rpm 368bec944957ed098a1294837dc64b59da2c014f4424894d868eda82d7dc4ba5 nodejs-22.23.2-1.el10_2.aarch64.rpm 54cb1e531e0689552f1cbf24e4467235735cd17a36662530dcfc975380cbde2e nodejs-full-i18n-22.23.2-1.el10_2.aarch64.rpm ba03ef2ba9701c6de06854e5ae481fe1365e6aa975f79dea6d8e8fe94c6a79cd nodejs-docs-22.23.2-1.el10_2.noarch.rpm c9f5cc58213b857b0d4326ca1f1f1fd1cda4ecc64776646fcfb759c191300495 ALSA-2026:61377 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-220543) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs24-libs-24.19.0-1.el10_2.aarch64.rpm 34a6cf42990495249d66818c842f8c03456cee0abdb615b0be0ef40edb6d53a1 nodejs24-full-i18n-24.19.0-1.el10_2.aarch64.rpm a90547976a5037c77eb830971a2fcdcd81cc83c48707b85c5079b0d1e52b56b6 nodejs24-npm-11.17.0-1.24.19.0.1.el10_2.noarch.rpm afa3166dc5e00f1d8df5f85611a54b62dab8bd37e034efff70b640de418fbf6d nodejs24-docs-24.19.0-1.el10_2.noarch.rpm d3d3383f8710db59beae06da2be66237d330acc7d4a195352659f94e3a452149 nodejs24-devel-24.19.0-1.el10_2.aarch64.rpm da4255bcb6d7d9e4abd0f20c064d1c2ffa6d8e5b4d9ee9a913a76ad2f856ab2e nodejs24-24.19.0-1.el10_2.aarch64.rpm ec7f6bbb7313eaf3bd036ead15bc1ac6647d332db621af028f37764ad66e0bc9 ALSA-2026:61378 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297) * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301) * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288) * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291) * FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296) * FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304) * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298) * FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242) * FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241) * FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652) * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194) * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633) * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.10.aarch64.rpm 703995f0950bfbb048588418a9cebf4a79423f8b8613a1bd79d0a4139a6cc94b freerdp-libs-3.10.3-12.el10_2.10.aarch64.rpm 7339b7e0b905d8d3cc694cc691570fc20ef4f275975883807f2b9f09129ab292 libwinpr-3.10.3-12.el10_2.10.aarch64.rpm f8deed69d056b0427b804c8d7fddc733a2333046852cf50ee8f250006dbae68c ALSA-2026:61680 Copyright 2026 AlmaLinux OS 0 1 Important

iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (CVE-2026-71217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default iperf3-3.17.1-6.el10_2.1.aarch64.rpm fee89832989a12016d46564674a5a9cc9795d69f58f8988f3d38baf76742b49f ALSA-2026:61887 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454) * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) * kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418) * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) * kernel: ceph: give up on paths longer than PATH_MAX (CVE-2024-53685) * kernel: ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419) * kernel: ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408) Bug Fix(es) and Enhancement(s): * AlmaLinux 10: s390: Revert support for DCACHE_WORD_ACCESS [almalinux-10.2.z] (JIRA:AlmaLinux-188180) * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-10.2.z] (JIRA:AlmaLinux-193043) * ss core dumped when there is an SCTP session [almalinux-10.2.z] (JIRA:AlmaLinux-212393) * [AlmaLinux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-218627) * AlmaLinux10.0 - s390/pfault: Fix virtual vs physical address confusion [almalinux-10.2.z] (JIRA:AlmaLinux-222507) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rtla-6.12.0-211.50.1.el10_2.aarch64.rpm 02ec475cf5aaa0d9b2f31faa192128c6a4b1225cd73112b3cde4f72a78b7419d kernel-devel-6.12.0-211.50.1.el10_2.aarch64.rpm 2c360c6b4b59933fc6b6aacbe839f4eebb4752eb735bbe65ce68e50aea11c79e rv-6.12.0-211.50.1.el10_2.aarch64.rpm 4a898fc72d88f8814ea432e9aba105562edc5b775533b9fea421f74a2b8177ac kernel-debug-devel-6.12.0-211.50.1.el10_2.aarch64.rpm 5df290658c0d2d0bd58e2fc82c9c61a6d95e2696d5f9371ffad60cb7e72dbb04 kernel-devel-matched-6.12.0-211.50.1.el10_2.aarch64.rpm 7d92fb6b065166174531a131fb070ae186907f9c5df1c4698dac558f657d5d8a perf-6.12.0-211.50.1.el10_2.aarch64.rpm 7e58a3258c2f4adc7baebf3bbd89fb6b1f8bba00fd9e9f86f02df8453c73f34c kernel-64k-debug-devel-6.12.0-211.50.1.el10_2.aarch64.rpm 819fcd11a23b4325a42d42a38bb5b79ca5311b83eb041a6a57747356c08892c7 kernel-debug-devel-matched-6.12.0-211.50.1.el10_2.aarch64.rpm bd356d12f9dab4ddd3b48d731ddd8c14d473a33937073d82e9548fa22c857a00 kernel-64k-debug-devel-matched-6.12.0-211.50.1.el10_2.aarch64.rpm dba7f2d34f6e5a37a31d578ee820d2b202ab75b28a44b3347e828abb19b43bc3 kernel-64k-devel-matched-6.12.0-211.50.1.el10_2.aarch64.rpm eb55e72b9e05fcbb4f1fe4e9a8716eca07dfd2c1709e0a84bf0ea0381af30a83 kernel-doc-6.12.0-211.50.1.el10_2.noarch.rpm eb72790272f507b41af75641e41929887bd00929b6c72f25db62b73df90181d8 kernel-64k-devel-6.12.0-211.50.1.el10_2.aarch64.rpm f51d52f17ba7edd76e8c0f0242f8a7651d5d55ed85e6cf5565d77567c8f89dc9 python3-perf-6.12.0-211.50.1.el10_2.aarch64.rpm f98a985b9067311e7d655b62b8920ea1a30de95ae9516442a2f3c100f2299fc2 kernel-headers-6.12.0-211.50.1.el10_2.aarch64.rpm fef07948a612a30f70305c1fd3021e675f7217f36c2e819cf825c970110c85e2 ALSA-2026:62142 Copyright 2026 AlmaLinux OS 0 1 Moderate

wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fix(es): * wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption (CVE-2026-58471) * wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute (CVE-2026-58472) Bug Fix(es) and Enhancement(s): * wget async unsafe code in signal handler context [almalinux-10.2.z] (JIRA:AlmaLinux-220498) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default wget-1.24.5-8.el10_2.aarch64.rpm 33d89e817d5ca24c5e4d0f8b9191aa06c6ef66a20f92561a6f2645e02ccb06ac ALSA-2026:62577 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default go-fdo-client-1.0.0-4.el10_2.7.aarch64.rpm 4924dd4a84e7431cd830f6e65c70bad37dff009a69cdb4cca86909f4ee969a7c ALSA-2026:62578 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default go-fdo-server-rendezvous-1.0.1-2.el10_2.4.noarch.rpm 0211aa299091abf4cfdbbe76f87520827c571e8db4a3770fdd0349a146e1d8c0 go-fdo-server-1.0.1-2.el10_2.4.aarch64.rpm 3fd37c6ce57f687d65f8c5afbf821e09b7239db12c17992ffb04dc3ab7ec8621 go-fdo-server-manufacturer-1.0.1-2.el10_2.4.noarch.rpm 84881985faeb5b98d8a5aa9bcdf5c151015a891734684a6dfae3071d412b6e96 go-fdo-server-owner-1.0.1-2.el10_2.4.noarch.rpm df71d99ab263c33a04002cecffd3691380cb99ec2d02cac000f9c35a6af35a83 ALSA-2026:62614 Copyright 2026 AlmaLinux OS 0 1 Important

php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.3.33 for CVE-2026-17543 and CVE-2026-7260 in 10.2.z (JIRA:AlmaLinux-223946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default php-snmp-8.3.33-1.el10_2.aarch64.rpm 0aed38e26b4e053f9548fe8d96a0de3d0d98fa0dd75ff53413ef4762915980c5 php-common-8.3.33-1.el10_2.aarch64.rpm 0d3e124a17a26e01c28ec181e6ef3df0fd80fbf8ade68a1c93a68421a5cc2fd1 php-xml-8.3.33-1.el10_2.aarch64.rpm 104ce5e943e7791c6ad11c5262733e2e239b455c4e454bf217c91b8932f70429 php-process-8.3.33-1.el10_2.aarch64.rpm 2277ab0b550821ea7031e0c87ce41f18c22e5ce059438ef64051694fe374d5aa php-embedded-8.3.33-1.el10_2.aarch64.rpm 22e3f9d82abcef43bd561624900de5c5f527473e44e9e579192adc8bcb60bf6e php-fpm-8.3.33-1.el10_2.aarch64.rpm 2d532d1704ef708d0eb5fa7fc5f76fcb6abd659e47db1d7c490da40e3731e439 php-dbg-8.3.33-1.el10_2.aarch64.rpm 34f76c0e2b8ede41785bec62de0e1d5b39415c37e9f855ed7e7f4729294920a3 php-odbc-8.3.33-1.el10_2.aarch64.rpm 4196b735f5bfdcb7060cf2c79b5ff9704b8360109779adcc52f2a464e53c6956 php-pdo-8.3.33-1.el10_2.aarch64.rpm 4a36e260aebc62cde6bdd4b713e1017c99bbb85227bbeb4ce2d28e374de2d0f9 php-pgsql-8.3.33-1.el10_2.aarch64.rpm 4d3cbe7d79003e13db4a83b6099e0b0e9ef7a62d074e2d8b6a11b7ed452feacf php-ldap-8.3.33-1.el10_2.aarch64.rpm 7c46704638ad479673baceb69a41b2e475605cfa1e8da92e4582de2b58c8dd92 php-soap-8.3.33-1.el10_2.aarch64.rpm 9fa66a8b35b00105337d00640621bad72b0d37e7019385088a27917e0eddb6e7 php-intl-8.3.33-1.el10_2.aarch64.rpm b0d3e40328fc35e027468bf325fec24d835d373808585f2e736cafa4b933bf67 php-dba-8.3.33-1.el10_2.aarch64.rpm bc0225ebe5b2691a399a69e316f70216c6edc02bdbf818d0652b316c001ae233 php-cli-8.3.33-1.el10_2.aarch64.rpm c7fd45b1f6186edcf712b0f8144a1fd0323f7bb7de9607c8020d214da71ad83f php-devel-8.3.33-1.el10_2.aarch64.rpm ce3cdfe1b9c807ef98514a9e90585559d2936958188a8cbc7fafc891e5844877 php-8.3.33-1.el10_2.aarch64.rpm d0e83510699cd91bfeeb73c3eada5ff13ef8f2237b5cbc375ea4f83b5b7b34fc php-gmp-8.3.33-1.el10_2.aarch64.rpm d3235249cea98479d1795b6a2b63f729094471ae582e7adf1fd93e6f324781de php-enchant-8.3.33-1.el10_2.aarch64.rpm d574156b406886fd938b0bdd060334ea3aa735c92498fe4e3d7a05fa3c2a7991 php-mysqlnd-8.3.33-1.el10_2.aarch64.rpm d644652849c0b30185aaaa972106451d8781fae8679b99e411aa33d535c9e3b6 php-gd-8.3.33-1.el10_2.aarch64.rpm da5de42798b63448002209a3993b75c4a3db6ba788b29544507d54b00090593e php-opcache-8.3.33-1.el10_2.aarch64.rpm df87233b486d3e3e440acead63c86ce6c4a1eb05c8279dc0a76d2140338b7a0f php-bcmath-8.3.33-1.el10_2.aarch64.rpm ea5733ab38f974b6ea2554f2fdeb50938692354d0e28ed46850f679ccca46b18 php-mbstring-8.3.33-1.el10_2.aarch64.rpm f5ddae806e5d1ae1cfaaef1933d16e967c35ae9a8f67badac363d33e722ea553 php-ffi-8.3.33-1.el10_2.aarch64.rpm fd110eeac16f3177fac75b7f727a23c6fdc3c69e16b9d871f7b3fe46b7443a3b ALSA-2026:62631 Copyright 2026 AlmaLinux OS 0 1 Important

golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default ipp-usb-0.9.27-7.el10_2.3.aarch64.rpm 9d24f8bb01144e65e82e32a078f6ea9b09bdcbaf8fe9da866ebcfa6ed19056e8 ALSA-2026:63022 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default grafana-selinux-10.2.6-28.el10_2.5.aarch64.rpm 7f196888ac72fba3281b39d9f563f4d7e032f4263ec060fb2b762187f5d5b5ed grafana-10.2.6-28.el10_2.5.aarch64.rpm 90dbee124f568b825f0c76fa3af854360f8e307313962d083bffb693e6a97be4 ALSA-2026:63119 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default grafana-pcp-5.3.0-8.el10_2.1.aarch64.rpm e0ab7c490c4806c3a937ffa5553df06e809921816ca8972325393458b356ae78 ALSA-2026:63128 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073) * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808) * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824) * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145) * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.51.1.el10_2.aarch64.rpm 0d57407b08133f6d2f3feb6f58c6a634fec5b7698e71533e3b6b2c173503e8a1 kernel-64k-devel-matched-6.12.0-211.51.1.el10_2.aarch64.rpm 0f0117a4787aa77c67bed5b92c1a29b5425664a982a42c37456bfe052a111a89 kernel-doc-6.12.0-211.51.1.el10_2.noarch.rpm 2e6e4a832d51991724a1696b6c38060e1abc354ca0d461f7a161f2499a8db46f perf-6.12.0-211.51.1.el10_2.aarch64.rpm 3447200754b658f6cbf91d81a10cf4d89587e3b0324a347ccabf3d661a28162a kernel-devel-matched-6.12.0-211.51.1.el10_2.aarch64.rpm 63699ab7527379a1299fd14b4edd02430d7d6fda90e1b79e4f78e7c962bda47f python3-perf-6.12.0-211.51.1.el10_2.aarch64.rpm 6964d9d782f1b72519f88b041ba1c9cf80a2e30f4c6bf6ac3d1ebd6bb22f84b1 kernel-64k-debug-devel-matched-6.12.0-211.51.1.el10_2.aarch64.rpm 71848366ea4d2a266d83f8e09e770b12eb4b6eca8a1f4be118c6de56d9abf474 kernel-64k-debug-devel-6.12.0-211.51.1.el10_2.aarch64.rpm 72fc1208065304f508f55923d61914bd18c35085ae43126bb7d8a907544e5e90 rtla-6.12.0-211.51.1.el10_2.aarch64.rpm 780c3de7e8bae50b4dca486ac38ab5d2868315d1841c0d2cdecf6e5382d5bbba rv-6.12.0-211.51.1.el10_2.aarch64.rpm 86ecbbf2612297476fe7191483fcfbfd493c9e98ea36b82142b2b44e08ae5800 kernel-debug-devel-matched-6.12.0-211.51.1.el10_2.aarch64.rpm 8bf05dd36c306526af31a62698184e6162c74e2764cc02a473db0d58d5983f35 kernel-headers-6.12.0-211.51.1.el10_2.aarch64.rpm 9de783c2c29a35a507b52d740e91b5c38c41cede960220de7727b756aa1c5057 kernel-64k-devel-6.12.0-211.51.1.el10_2.aarch64.rpm e82a0779a93395898a14a153c1525c9338b15951e418166483f6ceadc7f939aa kernel-devel-6.12.0-211.51.1.el10_2.aarch64.rpm fa3d86ac2d81d9bfceb251b200888419dfe3e650baccaad756e836a95fac57ca ALSA-2026:63332 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default buildah-tests-1.43.1-5.el10_2.aarch64.rpm 59ccabb6809f3ea5ab6bf3c6e7c0558b9b47c2ef4fd6aef8be1a67798f4b0314 buildah-1.43.1-5.el10_2.aarch64.rpm 7490c37b83ff60253fd8d85d515fe29f3edd59bd002273361a6385c5cd85cdb9 ALSA-2026:64777 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default buildah-tests-1.43.1-6.el10_2.aarch64.rpm 3087dd7b55119e3c0f723ea9d260303352d5825682c15f28ce2362d7c281784e buildah-1.43.1-6.el10_2.aarch64.rpm d952db7c65b35d177b6e0782c7df473657e748fd6d66ad01b1bf50aa9d3b3ad5 ALSA-2026:64785 Copyright 2026 AlmaLinux OS 0 1 Critical

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) * 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701) Bug Fix(es) and Enhancement(s): * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-10.2.z] (JIRA:AlmaLinux-244470) * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-10.2.z] (JIRA:AlmaLinux-248770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default 389-ds-base-libs-3.2.0-10.el10_2.aarch64.rpm 13ac9df2009fe04c2d3b2cee0fe1707300a5a6d05ebb8cd827cd9aaa7246e26f 389-ds-base-3.2.0-10.el10_2.aarch64.rpm 29ddde3ffba68417234cc4bf71503d73cad02a0dc426f9f6413dac48e1f9e860 python3-lib389-3.2.0-10.el10_2.noarch.rpm 307a5e67b7efa8839b6753d9a1070e7d39a56a06e6b646f7e9121a21f6a89d52 389-ds-base-snmp-3.2.0-10.el10_2.aarch64.rpm 4ea19b89cd1ec1a8b2141cd1f9a6553393c59c2adfb1bfa11a451e6481553ee8 ALSA-2026:64787 Copyright 2026 AlmaLinux OS 0 1 Moderate

xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fix(es): * xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default xz-lzma-compat-5.6.2-4.el10_2.1.aarch64.rpm 6f4a1b4fad201e4e93f3b8b3b379957dd95902b736bf4426b2dc871385d613f5 xz-devel-5.6.2-4.el10_2.1.aarch64.rpm 882198396cc1979261b25f5bd332549b44d2bdbe9c969d4e998d7ca31a3cb9b2 ALSA-2026:64788 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.7.aarch64.rpm bdc912e8e9c70a67b81b87ca06d75706e176ec84ef96838903b2c6668aed99b2 ALSA-2026:64796 Copyright 2026 AlmaLinux OS 0 1 Important

valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373) * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639) * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684) Bug Fix(es) and Enhancement(s): * [Tracker] Rebase valkey to 8.0.10 (JIRA:AlmaLinux-216776) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default valkey-8.0.11-1.el10_2.aarch64.rpm a27198fd7ba85b1bcfe365155f1682141d2dcda7304da62ea4f7e61a274a8ccf valkey-devel-8.0.11-1.el10_2.aarch64.rpm fc7cf85013436b84f400a2b7ed5397f9969e7f19168afcf24931e81605547650 ALSA-2026:64799 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.22.aarch64.rpm 33cb47f71d26e46074007deceadc6da0f21b64ed9a3f3bb75dfb2b31ea4b6668 glib2-devel-2.80.4-12.el10_2.22.aarch64.rpm 3d5ff1cadad0a93c9047a2e93d832dd300e8a6a4f50ff9f9f00e43c3b1c7bc56 ALSA-2026:64810 Copyright 2026 AlmaLinux OS 0 1 Moderate

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking (CVE-2026-50219) * expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow (CVE-2026-56132) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.3.aarch64.rpm 91dbc116abe33628ad9b1861c7d433bca7819f00ecb2a444105ab5c292578fc2 ALSA-2026:64818 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default skopeo-tests-1.22.2-5.el10_2.aarch64.rpm 5d6729d99ffd6a18ca2308ce09c7ed55a91a1c93ebb5d873e87a55095bafe165 skopeo-1.22.2-5.el10_2.aarch64.rpm a1b34bdc63a82584e642f77b0db420f60ca51171406cd4116974593ada3c52d7 ALSA-2026:65116 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default opentelemetry-collector-0.152.1-2.el10_2.aarch64.rpm cf94ec4cff1f34a54a86e37227b95f639774affc9ee1ca94f3cf40cab9a8e377 ALSA-2026:65159 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default thunderbird-140.14.0-1.el10_2.alma.1.aarch64.rpm de27eb11919de036ba56f28e88493379aefc7a4bc57e2a6eff950950336b4d6a ALSA-2026:65162 Copyright 2026 AlmaLinux OS 0 1 Important

gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See <https://access.AlmaLinux.com/support/policy/gpsd-support> for more details. Security Fix(es): * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gpsd-clients-3.26.1-3.el10_2.2.aarch64.rpm 0eb982b8925ccf1276c193678d47b10f14cf55124cebc2669903542ceaa848ba python3-gpsd-3.26.1-3.el10_2.2.aarch64.rpm 754d9d3f3bb210fd584d5f8abb8be11a318ec4fdee6fb2b71061845a6ace4126 gpsd-3.26.1-3.el10_2.2.aarch64.rpm 937483ecca31381e198c2d57bee3f6becde729ba3e5b58345f3588e03c47d157 ALSA-2026:65334 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182) * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947) * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944) * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946) * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117) * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037) * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113) * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042) * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051) * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255) * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515) * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307) * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193) * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) Bug Fix(es) and Enhancement(s): * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [almalinux-10.2.z] (JIRA:AlmaLinux-193027) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rtla-6.12.0-211.53.1.el10_2.aarch64.rpm 0e591eb78057bf3fb7e2e4b3803bbc3c5375ad8e85128e2093b55ce5b8b30f71 kernel-64k-devel-6.12.0-211.53.1.el10_2.aarch64.rpm 109d0b96c2b9602064cafa2e321b9d8946e602cd18223ebad97f52dae138f6f9 rv-6.12.0-211.53.1.el10_2.aarch64.rpm 10b28c90fe9ca4db4cc14b7c7168c609794520749ab809a55a5ab52183be7e95 perf-6.12.0-211.53.1.el10_2.aarch64.rpm 25435f1676dcef2114eee514557cea732fee5b9cdbe21eb24c31951fc10df381 kernel-debug-devel-6.12.0-211.53.1.el10_2.aarch64.rpm 282f9db8350e74ce81d4bbe10257a08846e3c9a8db4b02094851203ee7ff5364 python3-perf-6.12.0-211.53.1.el10_2.aarch64.rpm 4035c3323148a5cf0aa629d50997c16bbe50db32b1d22aa1e804b91ee46d7a01 kernel-devel-matched-6.12.0-211.53.1.el10_2.aarch64.rpm 5213b9d4f7871b9bc23f3bf43abbc91a88535a83cdc290d98fedbc1cd13b78ca kernel-doc-6.12.0-211.53.1.el10_2.noarch.rpm 695853f20bc714f3bd01366c739f95984ef9c54dd00ee1004b69189f11177cf7 kernel-debug-devel-matched-6.12.0-211.53.1.el10_2.aarch64.rpm 6fd7070998443bc1ccf2d975a476644cd97e0d5b516eee1797cd342bab790367 kernel-64k-devel-matched-6.12.0-211.53.1.el10_2.aarch64.rpm 8c4518a8dfce01aa777439f5d8f78f76b1c0583a51448ab3510bbd41c83a0b03 kernel-64k-debug-devel-6.12.0-211.53.1.el10_2.aarch64.rpm a35067f3e0eeb049f2295c1b524dc64e88d159eef3afb17db2fde49ff302d495 kernel-headers-6.12.0-211.53.1.el10_2.aarch64.rpm d9856b00a72d5414e593fdbfe976db04255a501c3a9fc9b5bc2d3ce9bc663cf2 kernel-64k-debug-devel-matched-6.12.0-211.53.1.el10_2.aarch64.rpm e7a24c31b1a8a0e452f2badf6c617661abd2bd767ff26562020f50cd80247aa8 kernel-devel-6.12.0-211.53.1.el10_2.aarch64.rpm f9d64792b02d1f46f97c8c1b6650d1df218607c5d1d5d1ae176f7938d55bd643 ALSA-2026:65816 Copyright 2026 AlmaLinux OS 0 1 Important

qt6-qt5compat security update

Qt6 - Qt 5 Compatibility Libraries. Security Fix(es): * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default qt6-qt5compat-devel-6.10.1-1.el10_2.1.aarch64.rpm 162cb8fc9008c44b590e21deb60d8f1beca466a654f62c2b0687d6cd3c1fd0f7 qt6-qt5compat-6.10.1-1.el10_2.1.aarch64.rpm ef5bdf52b2ac194bfe4ae2ca014f3bf7022c4388450c95ddde942d6e3d96873d ALSA-2026:65887 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-19546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.4.aarch64.rpm b83865bbf0b1610d95c0582844dddf9b734cea051f3ed0667cfffe2f8d85fee4 ALSA-2026:65899 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile. Security Fix(es): * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postgis-3.5.3-4.el10_2.1.aarch64.rpm 00ed673f8451a70f58bfa7bba5343cca4bf202f4ef0adf5b858e18391b2a255b postgis-docs-3.5.3-4.el10_2.1.aarch64.rpm 4a68d903a9a308726a3b00e851f92cf6b70092c89dabd0afb844d45c798a68b9 postgis-upgrade-3.5.3-4.el10_2.1.aarch64.rpm 5a5fac3cc43ece602260686e9f8d2300d44c8d9363271f6d61bb03db23e2c2ac postgis-client-3.5.3-4.el10_2.1.aarch64.rpm 60cc4ef898a17e0c9e7e7d0de652ef6b493dd83fb2458177dc5e58c40e596d78 postgis-utils-3.5.3-4.el10_2.1.aarch64.rpm 802698eb177cda1aa1ca9198933234833b8b592a2118c8256fe91a8910ae9220 ALSA-2026:66336 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420) * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859) * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892) * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857) * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076) * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072) * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078) * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default vim-enhanced-9.1.083-9.el10_2.20.aarch64.rpm 39ce4a8afbcb6d44748c20d771af316d689900a36b13a3c8f5d251a9ae5f6699 vim-X11-9.1.083-9.el10_2.20.aarch64.rpm 4f12442656d2d4756f2b510f18d419f9e26c00bc9a9c9bde9f9f2ebdba96be1f xxd-9.1.083-9.el10_2.20.aarch64.rpm 806126718fa29bbb4ef357c213fdb32a7314a9c77cee11287a7a26a68c4ce817 vim-common-9.1.083-9.el10_2.20.aarch64.rpm a9d0480154b480a96092fbe13e75f4dbe947f6a58a3d098147ef4f7a8506b0fe ALSA-2026:66349 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway (CVE-2026-55193) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.11.aarch64.rpm 446a652b283f7bac0266d5a8eeba94436219496175d692853ea6b3ddec5fe611 libwinpr-3.10.3-12.el10_2.11.aarch64.rpm 5986fa6a8f866654bc888e1ad36158bc9d693614320ffb8eae7d07158c828832 freerdp-libs-3.10.3-12.el10_2.11.aarch64.rpm 6b5a0a9a1a2a1a226bc753b590ff4d296623d2d96b1b6c41e78d394aa2384630 ALSA-2026:66355 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-devel-matched-6.12.0-211.54.1.el10_2.aarch64.rpm 08963f4d96e08858a27134d31591594c7cd9e25787b7df3c40ddbffda3f2f885 python3-perf-6.12.0-211.54.1.el10_2.aarch64.rpm 29baf68e89bc73cd3bf8c1ff1344288829064a6d617eb19cec602cbf6c0085f6 kernel-debug-devel-6.12.0-211.54.1.el10_2.aarch64.rpm 34f2dcd59b97a1df62218777aa4d1cb7d2d62754692865fd5dc7249172fe7c9d kernel-devel-6.12.0-211.54.1.el10_2.aarch64.rpm 42ce5ffd44566e53a41a29e57275eb7888826ec26bc51516025faab2012a8017 kernel-headers-6.12.0-211.54.1.el10_2.aarch64.rpm 6d587f7058ca4d551120e9dc5371367b9a97a633f893c067e314ecf06b0fa7d1 kernel-doc-6.12.0-211.54.1.el10_2.noarch.rpm 7211c764f3e75c59e014b6650c3e0ec6f19553aef6819b3853a7c4b27ea7a704 perf-6.12.0-211.54.1.el10_2.aarch64.rpm 7b3b8d9a460e8da362d33bd3c49b2571a7c9b373a6442a34de9a6134c21f6868 kernel-debug-devel-matched-6.12.0-211.54.1.el10_2.aarch64.rpm 8110f1e39b3b325230d2ce7dd4ef5573496d6236cf4a85a57f949ca3d7b7c6d2 kernel-64k-devel-6.12.0-211.54.1.el10_2.aarch64.rpm 81222cc4fa9a4a4fbb5cf4a16c23542f88ac8cb8f48658e306e3bac1edfb353b rtla-6.12.0-211.54.1.el10_2.aarch64.rpm 916cfd57a8930d75af68f16fb7f6417c452afe4aad061245fcbd99f96a1903c9 kernel-64k-debug-devel-matched-6.12.0-211.54.1.el10_2.aarch64.rpm a5016b5e612f329c1f129117e7b54ed1876ff246ea7883e9f7725a232f901000 rv-6.12.0-211.54.1.el10_2.aarch64.rpm ae0252737a4ba51bbc0cb44751d49dbdd593ac0633dc3543b801c2f80fdaa867 kernel-devel-matched-6.12.0-211.54.1.el10_2.aarch64.rpm f675e624a4fe8d3276c9d3b883651a0fd0311c802aa40998609f39a705144879 kernel-64k-debug-devel-6.12.0-211.54.1.el10_2.aarch64.rpm fb56e52f917f3ac7b9b664c34175c0e07e6051615387d30d71f0f442f5fef7b2 ALSA-2026:66392 Copyright 2026 AlmaLinux OS 0 1 Moderate

apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fix(es): * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501) * apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506) * apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327) * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default apr-util-1.6.3-23.el10_2.1.aarch64.rpm 12a67814329594a9af92400c477ab38748f1ad05ce93506c0bc0586ca5059502 apr-util-odbc-1.6.3-23.el10_2.1.aarch64.rpm 3deb5ea27a4ebf4a63112792517294cbd199b2c45e7c0495f241f974c5c6b429 apr-util-lmdb-1.6.3-23.el10_2.1.aarch64.rpm 5af1b9178dc4683b5b4383974b5f67f7ad8fc571e196c8dd56324827ec8ba03e apr-util-pgsql-1.6.3-23.el10_2.1.aarch64.rpm 853602fcdadbd5c2bc7dcd523e00d7ea80d03119553e386e94822c07086e89fa apr-util-openssl-1.6.3-23.el10_2.1.aarch64.rpm 858b0ead7edb3f0c698b0b2bb6d6feb9340fab47cbacd18044627774a7730bf1 apr-util-devel-1.6.3-23.el10_2.1.aarch64.rpm c0e28250afee44d5a9c5c7d0c58d46d3c4066f9eeb321cad91a7a41eba851b54 apr-util-sqlite-1.6.3-23.el10_2.1.aarch64.rpm d26e3f9ff377dcc61c49a7b4409563d2d59ff1485fa0fcc4a58a914c2cb8247f apr-util-ldap-1.6.3-23.el10_2.1.aarch64.rpm d34943dea9e06261ae5e27ee9738604d3e5a91b2c2575fa2185cc27d72aacdc0 apr-util-mysql-1.6.3-23.el10_2.1.aarch64.rpm e7434cd10bc10cb0c11e8676422d53099d6bc453acf475104a3691e2a29090c9 ALSA-2026:66432 Copyright 2026 AlmaLinux OS 0 1 Important

osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default osbuild-composer-core-165.1-5.el10_2.alma.1.aarch64.rpm 053b41a97a2fa83fcdda793444eed56cce066493ce50588362e64ea00cbade12 osbuild-composer-165.1-5.el10_2.alma.1.aarch64.rpm 62f26eb922c5d07bb9413e11bb5ba9f9a71152892e88b332ca503ef0b9d3220b osbuild-composer-worker-165.1-5.el10_2.alma.1.aarch64.rpm 69b5098870e83cebb11fac23b400a692c62774bbce94b31887fb77e8eff47868 ALSA-2026:66460 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header (CVE-2026-85150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gstreamer1-plugins-base-devel-1.26.7-2.el10_2.2.aarch64.rpm 75d6ad9ff82ecdb700d6a201dcb957e91d292477d05fd477d8bc8c26b3e9e754 gstreamer1-plugins-base-tools-1.26.7-2.el10_2.2.aarch64.rpm d371eed7cb74c6dc185a8b6d7bd2d93348a12912d52163a80018670ac86c071b gstreamer1-plugins-base-1.26.7-2.el10_2.2.aarch64.rpm f53a71c63a4db6dc8273df6d9c0202f0092f8da4ba68a7375d9a5f45c3f63303 ALSA-2026:67129 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default firefox-140.15.0-1.el10_2.aarch64.rpm 262c4a4221d1e895ba3d71dd7c995f67fc87b4818fb057172cd9e149c39e96a6 ALSA-2026:67147 Copyright 2026 AlmaLinux OS 0 1 Important

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853) * tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-tornado-6.5.8-0.el10_2.1.aarch64.rpm 7de3767eabe2c5bf48b0e113f5aa38a23fc874ed8bb96e39c74850f3a21dc291 ALSA-2026:67154 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456) * openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798) * openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072) * openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076) * openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457) * openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874) * openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073) * openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074) * openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075) Bug Fix(es) and Enhancement(s): * openssl: HollowByte remote memory-exhaustion DoS fix may be missing [AlmaLinux 10.2.z] (JIRA:AlmaLinux-212362) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssl-perl-3.5.8-1.el10_2.alma.1.aarch64.rpm bcb3cbd1884c21c5d27c5cb3010349f43dd77f78388a6e064220d248826c20da openssl-devel-3.5.8-1.el10_2.alma.1.aarch64.rpm dd8ee71e2f7d5c58717b19709ecf1f5cd8324060dd49cca0dbd2e160ac3d3572 ALSA-2026:67156 Copyright 2026 AlmaLinux OS 0 1 Moderate

perl security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es): * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-I18N-LangTags-0.45-515.el10_2.noarch.rpm 069d8a8848580110635885e2c251c7423daaed882265d3fe5c2f4465f09dd325 perl-Sys-Hostname-1.25-515.el10_2.aarch64.rpm 0a0a4be91e2055cf4505e33020f5980af74c4dc8a34fedcd6af6ae24cfc82235 perl-Hash-Util-0.32-515.el10_2.aarch64.rpm 0a7062968938aaf7fb0dc2f2432546929a84d5c83cf307c5115c0ee550386768 perl-vmsish-1.04-515.el10_2.noarch.rpm 114d1690b48e176ae300aa8758eb208c31d1b490b24d8ee9e87ba6f5d21cc209 perl-User-pwent-1.05-515.el10_2.noarch.rpm 116856c6ec904a94c4b9e26465c0f24d542f6ac279c1065c986de45686011ec0 perl-devel-5.40.2-515.el10_2.aarch64.rpm 14d4ddafe55134e2c40f620277fe2e9e7f92bf8f12d49a2f2b4c9d5fae4fc4ca perl-Search-Dict-1.07-515.el10_2.noarch.rpm 1a7a937662f78d99a2dc924c7f668c42980aca692656cf16a5a5d1e21e6a4315 perl-AutoLoader-5.74-515.el10_2.noarch.rpm 1b540d06f1b3584f80113b6c546b8864cd617dffbb8513045b03d7132e826012 perl-I18N-Langinfo-0.24-515.el10_2.aarch64.rpm 1d9e867b6e3fbc94c9cc1005038100b6e7185e1a1f29ae293d33d391f6befc7f perl-File-Basename-2.86-515.el10_2.noarch.rpm 20a9f2b8c608e5b9882e2d7cc64546b067e53ccd2148bbfee2b72c0bfae4b16b perl-mro-1.29-515.el10_2.aarch64.rpm 299d2596cebdf6b60d6d86e5f30429439a2d3b3eaad6647cfad4c7a2cb65b00c perl-ExtUtils-Miniperl-1.14-515.el10_2.noarch.rpm 2b7283b3c5536e3fd89917266b3465b22de4dfbf604834e918ccc589888a8a26 perl-Thread-Semaphore-2.13-515.el10_2.noarch.rpm 2d138bc731d07a757d3301cd9d65f224ad3c2a96be63b1b60cd24e1c3ddfd0e5 perl-IPC-Open3-1.22-515.el10_2.noarch.rpm 2fe04d10b167fa28ece32046dc240d5132475190736ac8dda602198c8b51e0ae perl-FileCache-1.10-515.el10_2.noarch.rpm 30820f41d03438df0a89b8dea91241e253b67eacf1cf81d8fff01551dd83ab5e perl-Net-1.04-515.el10_2.noarch.rpm 32c8b627ee7e2970b1dabfa3c1024adbd59dd604b26059aa8c2dd768f3843337 perl-Thread-3.05-515.el10_2.noarch.rpm 342387b69d0d36619df2041b925e664c5a207142020f6c17137a4ef5e7f9f184 perl-Term-ReadLine-1.17-515.el10_2.noarch.rpm 41bde263dee0557bb68f9f1d2baa8d57c8d3df3fba08a5d94ecdde225220d3b2 perl-Unicode-UCD-0.78-515.el10_2.noarch.rpm 4307fa601ecd6edee189194d08a35b90113a9dc2e1e1c6a6a66195ec18e8d8ce perl-Text-Abbrev-1.02-515.el10_2.noarch.rpm 43665b451f519dbeb4b8a05f066cc6481f8b6c143cf3e594852598a3a6b222ee perl-File-Compare-1.100.800-515.el10_2.noarch.rpm 4812e8816160f70feaec391bd210415bca4a44a5155b126c3fb1ef14674b80d2 perl-Getopt-Std-1.14-515.el10_2.noarch.rpm 49e8e4357d64fff7c22f72bda9bbab91c9393e87d6b40473e2f3e03a651d79ad perl-SelfLoader-1.27-515.el10_2.noarch.rpm 4d9f02c0fedb9b29b19bc90d97045e6d723657d1f214c7e2f2490390a781c3a3 perl-IO-1.55-515.el10_2.aarch64.rpm 4e5ae4f09808e570cdcd0c04f520b80eecd42cf1d8ede04de964fbbb081ebd00 perl-File-Copy-2.41-515.el10_2.noarch.rpm 52be131ea7d5f9df8f083bcaadde9c8b8cf8165b5dbba326c37eee56e9525871 perl-FindBin-1.54-515.el10_2.noarch.rpm 541141d26cff39e511d41ad2e104dbedff7ae004eb7b60a75f1d264f0da639e7 perl-Memoize-1.16-515.el10_2.noarch.rpm 568f92b74173236bcdb6ffd602c20f30d5ce36ddc15a9ef60bdd9531791e5d38 perl-interpreter-5.40.2-515.el10_2.aarch64.rpm 56b32580dd5f2bd6aabde67758890a09f48495a8693a83633255590db51ab119 perl-File-DosGlob-1.12-515.el10_2.aarch64.rpm 57770f3d8fcffb0ea0b4e009241c471d85418c780468b09294f2a765ad0a2522 perl-Dumpvalue-2.27-515.el10_2.noarch.rpm 5c387af29496631904e0e4512b0042204cdfe1760561da0a1a7779cd1b9432c1 perl-filetest-1.03-515.el10_2.noarch.rpm 5ea84443d067654a9188b0fbdea88de0a413a87cca469418d8a7a2c81a63eb47 perl-Module-Loaded-0.08-515.el10_2.noarch.rpm 5ec1d001a8904f13be93731dc3ee10d52fea7b19718e01dde887e892f9d59e9b perl-Time-1.04-515.el10_2.noarch.rpm 648dff6e0b21d2c42534adf498ff6f73ddc53f26c65c64ad56180a18d42fc119 perl-I18N-Collate-1.02-515.el10_2.noarch.rpm 680f8b26caf1903d88f8d96263ad903bc239369406b6895e6bc27ed923fbae59 perl-Symbol-1.09-515.el10_2.noarch.rpm 6812dec84019716837e33bae8700473e5b2e874091c1a288a8dbb1726153c5c2 perl-ExtUtils-Embed-1.35-515.el10_2.noarch.rpm 68dcc2966462f39ae38c5ebcae4c337dc9e0b06c3ea981844a143d3995c06753 perl-AutoSplit-5.74-515.el10_2.noarch.rpm 6b59cf08fb7286fb3f4198e45cd3d4f5006406267051a10617fb5304cd5266d1 perl-DynaLoader-1.56-515.el10_2.aarch64.rpm 6c63a74ec8194c328ca2396b615da2adace95aa6f423c1d71d53f859db4b434c perl-doc-5.40.2-515.el10_2.noarch.rpm 6cad19426ac95604a5cd8d62f8a8ffb5a38b8e8d807a982102a412825683beb8 perl-libs-5.40.2-515.el10_2.aarch64.rpm 6fda6a46419145c51701248f49031b932ef24a75021bbfffea54170c4dae2949 perl-Safe-2.46-515.el10_2.noarch.rpm 72689b14d3ed67db6d8a591e812f40b77b791b19725266586057351632e00fd1 perl-Config-Extensions-0.03-515.el10_2.noarch.rpm 735ba0cc433b5cf1e24d38cde1b3370a929cb3d7e9d19a4191862d988e7e06f2 perl-overloading-0.02-515.el10_2.noarch.rpm 7696783c9ba2e5642cd1a30e303621daf02bf97a44f97abb2711b7d17befd20b perl-Attribute-Handlers-1.03-515.el10_2.noarch.rpm 77b3940fa81302f640a8fc18a554e27c5a3788da8a3c05b1f3e1bc3d75795a37 perl-SelectSaver-1.02-515.el10_2.noarch.rpm 7b99d763a3936e28b58fa9304fed7b558d8c71ad7e808a5751f3969dac867a76 perl-ExtUtils-Constant-0.25-515.el10_2.noarch.rpm 873bb09b54d407b9bf5ff9c9e00e0c0053f12ca3a38e094acf6fe08c2101501e perl-Tie-File-1.09-515.el10_2.noarch.rpm 8a33b58207a8349608b744f83eb4dc94995c8d4315559c15ba26bfd0793fac03 perl-B-1.89-515.el10_2.aarch64.rpm 8b9cf479d8b5888a95e8abc987ef252d09baae97312a79b046060a50bc701b9c perl-Math-Complex-1.62-515.el10_2.noarch.rpm 8dc64964e85a19776cd9190076559c2f76282a5d55cc10f9dcdfe14dae924e30 perl-vars-1.05-515.el10_2.noarch.rpm 93da3932faa665745d14ccf5a9ddd860f562d08fbe184619cd4a7b8b274fe012 perl-NDBM_File-1.17-515.el10_2.aarch64.rpm 989c0a7456bab192415e25e18688852a75871d04d2f66b27ec11adfcca215772 perl-GDBM_File-1.24-515.el10_2.aarch64.rpm 9914eae9d9181518f66e879219114cbf3ffdfb91028f59b329f3ed22020403b8 perl-base-2.27-515.el10_2.noarch.rpm 9be41847f8862fdbf8b1e5c6e81cd416a80f62bffde4ab2cddf02837e9ce25ff perl-Devel-SelfStubber-1.06-515.el10_2.noarch.rpm 9bf0cebe98e3c5d7c7391fc556d152673f3f4ac637e62559e72f00322c9665ae perl-DBM_Filter-0.06-515.el10_2.noarch.rpm 9c44ff926043c1465c2b3f769f5d460af437848027936af2885671f71c45b6c3 perl-utils-5.40.2-515.el10_2.noarch.rpm 9cf990e411b795dac07fb0e455ab88d72d70095974d3606451d554b1a89ed148 perl-subs-1.04-515.el10_2.noarch.rpm a45bb41b5f9be010da79ffbb237a445e115026b6a66594ff029d7993071754f8 perl-Tie-Memoize-1.1-515.el10_2.noarch.rpm a59eb6b1ae8899f296df3fcf49cd61046571493289821a2c792002f2a31c4027 perl-English-1.11-515.el10_2.noarch.rpm a81d60d0b8acf592731701a57479d115867187afff5573bd5a82fe8b130972a1 perl-Devel-Peek-1.34-515.el10_2.aarch64.rpm a9d45bf2a19103841d46d665ebf37bdb387e0456a11575e9a264a0e29f451246 perl-Hash-Util-FieldHash-1.27-515.el10_2.aarch64.rpm aaae01bacd203c64df110c7fb68251b3797d114782af470bc2b8ef576fc5611e perl-Pod-Functions-1.14-515.el10_2.noarch.rpm ac655c5595560dcb46f735702ea26b21b12051be8238ba0d5e0a38ab6f6b598d perl-Locale-Maketext-Simple-0.21-515.el10_2.noarch.rpm ae46f3e2dc6318944c86ec74827ce3532cdb6a197c6944b69e880923c4c65136 perl-Opcode-1.65-515.el10_2.aarch64.rpm aef813c80160064f0a8fb077d8c369e6c96dfc4626c9a1e710a88b7dfa6b6a57 perl-less-0.03-515.el10_2.noarch.rpm aff27fa71a37ec8dd7133ac6cfe955671da4baaa92fd1ce496e7930d188a4556 perl-POSIX-2.20-515.el10_2.aarch64.rpm b5a948abcd4b0a1ce906a96de90ee1db256d3248392968439cff9c753be46161 perl-libnetcfg-5.40.2-515.el10_2.noarch.rpm b6dd427dc290c38944e15a0c841f529374558fd9cc21cdb584dd0c8fe7bf32f7 perl-Benchmark-1.25-515.el10_2.noarch.rpm b7973b40a45771d3dfd56138ebae057d2fbaf20fda1998e379b0210fd9be01a1 perl-encoding-warnings-0.14-515.el10_2.noarch.rpm b8ecd57b3ebe7a0915a2932be16e7cefb2daa9d9c21ab1bc51e41bc4b14f252f perl-5.40.2-515.el10_2.aarch64.rpm b9cee31a15b41ba2209263b0ad6a186c8709ebf36974aea50996a14d7190a3a3 perl-NEXT-0.69-515.el10_2.noarch.rpm b9d74ebb73608e7ae8a41f1845f6ddffbde82b348053bf57d772c4cf1298e2f4 perl-deprecate-0.04-515.el10_2.noarch.rpm c05f4aa40a78c4f09380639cbcbbbd486d773026ea9acccf16495fcdb03be30f perl-Test-1.31-515.el10_2.noarch.rpm c070ca356ba1f71ae941a4b48c70eb6eea140fb8851e89fe70b444e7c15c5a25 perl-locale-1.12-515.el10_2.noarch.rpm c17fc22826e6adf2289f1e63d4d28f43d7938df26a23fabca9f891cd7a93313e perl-ODBM_File-1.18-515.el10_2.aarch64.rpm c2feba06842302b3d79e32377bd64bc42eac980470d7afe4363a31849f135685 perl-sigtrap-1.10-515.el10_2.noarch.rpm c4a150e1b3c392d2bb8602ece64c0a1216c248abcea67c2a9379cb46a1911ce8 perl-DirHandle-1.05-515.el10_2.noarch.rpm c74ec5ab698006562d3ebd6b4dcbd879c336390d3e5cca29cb4cce85b85b5a7d perl-diagnostics-1.40-515.el10_2.noarch.rpm c8f1dc682cb1f2bf17efbda24578b0e02926b13a3e818a6d145dd4265d6ece39 perl-autouse-1.11-515.el10_2.noarch.rpm c92493fe5c4a3219b4b5313325c3ff68fc3d174cbe86b442e42cb89e470aac60 perl-blib-1.07-515.el10_2.noarch.rpm cc2a05ecd7afe0c7472aafc23a4ebe0fc7d88f744f8db7f22c533cb55779d38a perl-Pod-Html-1.35-515.el10_2.noarch.rpm cde6d99dc6bedf83080168ce89ab7278dbae79370c09def2315c05a847acf9dc perl-File-Find-1.44-515.el10_2.noarch.rpm d2938662e54a406e838d0dd5c4ea5832760add3e33b8ef1251185069975d53a6 perl-overload-1.37-515.el10_2.noarch.rpm d3c7074b151fa50dc7404bf110e451f8a9847525e8e29fd17009086ae4ebb2e4 perl-if-0.61.000-515.el10_2.noarch.rpm d81719bd35a08f147b531c2c7251abb2fdd658f32d157ad322f18d5db317b398 perl-Time-Piece-1.3401-515.el10_2.aarch64.rpm e3a2f0cb2d876be19ee41cf599b0c04cba8d797dabd054c02b558a8cd9eee7f0 perl-lib-0.65-515.el10_2.aarch64.rpm e57d01df82a99384d1cad5492494e2634c3fdfa1754fe0988ff9521ede96a231 perl-fields-2.27-515.el10_2.noarch.rpm e70d012a4965534f70adb38c3bada5c20cbb42fc8ab2e8b685cba1d6ae51ac75 perl-Tie-4.6-515.el10_2.noarch.rpm e7694d6af15a4e0a27f0f2619e94bf0671e47509e7b2fadd52f4f6e193ada11c perl-Errno-1.38-515.el10_2.aarch64.rpm ef0c42ff86bf23bf0ea740d7365bb2680727c5c8fc613368448567835c855593 perl-open-1.13-515.el10_2.noarch.rpm ef32423ccb9fb8aadb65d75956ca93b17f2d48ad869a00265d5b18e074f9e67d perl-sort-2.05-515.el10_2.noarch.rpm f00ca350e4e5d6843b1ed839dabd26abfce7f303dffa9b76559b86b7160eef9c perl-Fcntl-1.18-515.el10_2.aarch64.rpm f14f7b9997cea96e7ec7a16971e4655ba3596fdadf04f0cac914e0d28d2d3f6f perl-File-stat-1.14-515.el10_2.noarch.rpm f31ab167489a383653e674718b8132503908c89658587c11e60a45911165c658 perl-Class-Struct-0.68-515.el10_2.noarch.rpm f67705171349b9de0f487263220dbf6cb9e59eb628540da756ce686222c81324 perl-Term-Complete-1.403-515.el10_2.noarch.rpm f79ccfdef83bcc3d0425411387915ed8065e98f2ceb6fe02965034b5ade87dbc perl-debugger-1.60-515.el10_2.noarch.rpm fb02e587b5524c489f54e76bb0796c696e9a08765198c33a0f44aa81847457a2 perl-FileHandle-2.05-515.el10_2.noarch.rpm fb1ce05e33fb4e041f6807b80f5895d12700cc578bc662ee3681533d04d61e27 perl-macros-5.40.2-515.el10_2.noarch.rpm fc7b48c861b581799e1c2bfb69697896fbacdd6dc84be691b3671b469cbd76bc perl-meta-notation-5.40.2-515.el10_2.noarch.rpm fe5a31ee08cb8e227798d7a83e589736648047ac72ce10ce68043d70bf3bd8f0 perl-ph-5.40.2-515.el10_2.aarch64.rpm feb84908e79d966c8c74c1a607a00cf461955757739615873c08c31100dcc5d9 ALSA-2026:67166 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile. Security Fix(es): * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postgresql18-postgis-client-3.5.3-1.el10_2.1.aarch64.rpm 03256d1c44213b1d2a3d8614e53038c445eaac6f575c7d604a2d77b6bf68e7bd postgresql18-postgis-utils-3.5.3-1.el10_2.1.aarch64.rpm 2bd35c05cb98c76cf9c4632f1c3f5f5cf4ecd1bb32140427d1997e9c309e8bff postgresql18-postgis-docs-3.5.3-1.el10_2.1.aarch64.rpm 39a3396cbd1397eae9aeb251b3d54be1c14fa592c5d19244cc26af0e5311d8a8 postgresql18-postgis-3.5.3-1.el10_2.1.aarch64.rpm b246d2170812b233bc59da17764dbf9df43b0023106b9324695ff2296d24ea62 postgresql18-postgis-upgrade-3.5.3-1.el10_2.1.aarch64.rpm f156018d2e7fe3c80336eacb6eb112ff880af84fef371859663dbd5e4fc4d052 ALSA-2026:67280 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476) * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postgresql18-private-devel-18.6-1.el10_2.aarch64.rpm 0da63811ff68187a814beefb896a0470f4ee6ab06c1e0c012b7cf814e8983ead postgresql18-upgrade-devel-18.6-1.el10_2.aarch64.rpm 1c38a7a2ff5d496d6be7eacd31ca9112e8e14a6320cea66c0fbd876856b60773 postgresql18-server-18.6-1.el10_2.aarch64.rpm 5515cfe31fbda5a9e31e6c99a75e3414702536be4c675bf09eee762e5395c6a3 postgresql18-test-18.6-1.el10_2.aarch64.rpm 623c5f2a41201d0865355768edf3af978791f6b2535015dba721b158e0911e88 postgresql18-plperl-18.6-1.el10_2.aarch64.rpm 649ffea8a8ec258b0d52146a97deabf5093c30d68f238d7fcf743987667f1b50 postgresql18-private-libs-18.6-1.el10_2.aarch64.rpm 874f155f9931a6ba7b70b607092502a7ab2f0dc7fb5618c13f05fb978353a0b0 postgresql18-18.6-1.el10_2.aarch64.rpm 99d148f498a7eae39d482a9e8176b454027ebe4ee16826b3a181b7df6d071874 postgresql18-contrib-18.6-1.el10_2.aarch64.rpm 9a9bc34bf3f09fb82686a3b915da87a8498ff8ee9a6fd03712d3b32ad28816e1 postgresql18-upgrade-18.6-1.el10_2.aarch64.rpm c5213f49c713f6bb263d7caf3d071a4370d28b5cf99499cbc86e41397a3d8880 postgresql18-plpython3-18.6-1.el10_2.aarch64.rpm c5fa787f799f70a981bf4fed2e36f3923a3da182d4d19cf1be4ddcfa7f5ae88a postgresql18-static-18.6-1.el10_2.aarch64.rpm d28ab65fbe49ad4c96464cef9818f13fb5552bb4e4b2eee30e2e9d5a0b66eee4 postgresql18-docs-18.6-1.el10_2.aarch64.rpm d2fcc9cfc5d5d0ec1f4e1d0cfbaa42d3ad6b61a65d19e57263240eb30ad52d9a postgresql18-server-devel-18.6-1.el10_2.aarch64.rpm f01315fcbecf1076bfdba0e46730d67763e5cbb94edada32b7682c43c7c9c1e2 ALSA-2026:67286 Copyright 2026 AlmaLinux OS 0 1 Important

rust security update

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator. Security Fix(es): * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server (CVE-2026-53587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rust-std-static-wasm32-unknown-unknown-1.92.0-2.el10_2.alma.1.noarch.rpm 0138e6cca138e3a8bd6140d713af45cad285722fdf927f02ee745a5170eaaf11 rust-debugger-common-1.92.0-2.el10_2.alma.1.noarch.rpm 066364c3cf81426f4483e19c67d727520f30fb4946106f8163cb8d7ef1b57c3e rust-toolset-1.92.0-2.el10_2.alma.1.noarch.rpm 076c2a9168005bc63f127403b7ba6ed47e6888351515f4e711c7257770e7a693 rust-toolset-srpm-macros-1.92.0-2.el10_2.alma.1.noarch.rpm 0ceeb326c7211eeb9140d0ea6d45b8d21a41469f24b87463f3b664fe7fd67c4d clippy-1.92.0-2.el10_2.alma.1.aarch64.rpm 33ee9a61ae80026b8bf5cc0acfd7f02c5d207b757c94394a648ab2f381995344 rust-gdb-1.92.0-2.el10_2.alma.1.noarch.rpm 36416c11e35f5a7ed2f73b8fd1e17ac9c268d87e61a02b736141c00f43e837d0 rust-src-1.92.0-2.el10_2.alma.1.noarch.rpm 3a191c97568b6ef7689a8161ad1e6f84a2c0b0d8d589b9b2c435126799f2afce rust-1.92.0-2.el10_2.alma.1.aarch64.rpm 4cff696b24e856af25ca780fc9f3460ec58214aea25c2fe128daec3efcdfdcab rust-doc-1.92.0-2.el10_2.alma.1.aarch64.rpm 5d135acc0cc98208dbb52878859287f8b2693651552653d1982924b28904ff89 rust-std-static-wasm32-wasip1-1.92.0-2.el10_2.alma.1.noarch.rpm 6b59c9879cc5f8495b5c0dd0629cda1e72584f6b770fba245605007f4c8b070b rust-std-static-1.92.0-2.el10_2.alma.1.aarch64.rpm aec40af8c71ee17bd86b9a65fabedc1fa06503a60140cf24144579cff927020a rust-lldb-1.92.0-2.el10_2.alma.1.noarch.rpm b5fd5f65f431e4ce5bf5b35b1763ab998bd818db537d321ba792bf0a1f0ed29c cargo-1.92.0-2.el10_2.alma.1.aarch64.rpm cbb9e1200a9c76ed54fd9730fb93cd64116c6145d5853c6c5c4f509d6c96f980 rustfmt-1.92.0-2.el10_2.alma.1.aarch64.rpm cc382a11000076f04978d435d8eb0e4d7dede5077f839773ea186a09b95faed9 rust-analyzer-1.92.0-2.el10_2.alma.1.aarch64.rpm ceb6c88b550f220b712f0bf1201115679c318528880564b5b1b4ccf232ef79a2 ALSA-2026:67314 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nginx-mod-mail-1.26.3-6.el10_2.7.aarch64.rpm 253d6492288bedbe0a00cdcd50929b1f620fc258957084cdc5fa874aba790316 nginx-core-1.26.3-6.el10_2.7.aarch64.rpm 284f182bae6069fcf5ab979c31609656aeeac9c031d999d96391570ecc570564 nginx-mod-http-perl-1.26.3-6.el10_2.7.aarch64.rpm 333fa73b3b00c564f6101cf4dde357c038d01cbe7ed7f038a30d03f8c1483bb2 nginx-1.26.3-6.el10_2.7.aarch64.rpm 3a9bb802a6c465e8a48b4ed6f142a191d54828b324ec058b7001b61df54c417a nginx-mod-stream-1.26.3-6.el10_2.7.aarch64.rpm 63113909f4443a60e45ee90966590686acb974628ab2bd4f1dc6584651d837d9 nginx-mod-http-image-filter-1.26.3-6.el10_2.7.aarch64.rpm 87eb1dfd6a032560cdc24eec30888074ad3569784b838e8650add85641f51b55 nginx-filesystem-1.26.3-6.el10_2.7.noarch.rpm 9e02356ee55819abf5dd9f44929c35a20fae932d02ce8934f7cf4b184f83edfa nginx-mod-http-xslt-filter-1.26.3-6.el10_2.7.aarch64.rpm a223930faadb8c017a853b13694acdbf18ebf732818c3154382e9a3b55ea8335 nginx-all-modules-1.26.3-6.el10_2.7.noarch.rpm c401bf9f42c3bc11357a0635ba27b08076df988c187958490043e82bcf9ca248 ALSA-2026:67463 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460) * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454) * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789) * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790) * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458) * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464) * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803) * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784) * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463) * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452) * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791) * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795) * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456) * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793) * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453) * rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455) * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457) * rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461) * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802) * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785) * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783) Bug Fix(es) and Enhancement(s): * Rebase rsync to version 3.5.0 in AlmaLinux10 (JIRA:AlmaLinux-246094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rsync-daemon-3.5.0-3.el10_2.noarch.rpm d9eeb4e538648566b7bc50ebdf47325f2158a1f110be3d5a1451d1dbf7b786e9 rsync-rrsync-3.5.0-3.el10_2.noarch.rpm f379c5d18d7e720110d224d854c2e2796f7af861e7e3c5b78903eaadc9caa299 ALSA-2026:67471 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149) * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539) * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131) * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361) * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111) * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) Bug Fix(es) and Enhancement(s): * [almalinux-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:AlmaLinux-245035) * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:AlmaLinux-255233) * [AlmaLinux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255348) * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [AlmaLinux-10.2.z] (JIRA:AlmaLinux-256731) * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:AlmaLinux-256890) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rv-6.12.0-211.55.1.el10_2.aarch64.rpm 27bc52fcfe8ead238a979597599e56814d6d665ebd5db2df3abc427a02b4e31a kernel-64k-devel-matched-6.12.0-211.55.1.el10_2.aarch64.rpm 281597a958c135a395f0099622c4c11a029157dbab21af7891233c981044aa66 python3-perf-6.12.0-211.55.1.el10_2.aarch64.rpm 3d55074b26c09ac1b689b5914fce42b997546782be819f62b5af0fb1f3113c06 kernel-doc-6.12.0-211.55.1.el10_2.noarch.rpm 417f2ca88de88049f750692aed24d02c1aae2bdedac4761c6e14342603e41806 rtla-6.12.0-211.55.1.el10_2.aarch64.rpm 8a0dc88e244043b597b378cbeaa111013b33b69f8ed507afe6c5ce6b60dccf13 kernel-debug-devel-6.12.0-211.55.1.el10_2.aarch64.rpm 8c83c29e715ac0d191ba40d03be80c90d4f71fb6423f469fe8f57a3e05093d50 kernel-devel-matched-6.12.0-211.55.1.el10_2.aarch64.rpm 8cae190f09845ceed6d6e38387649c99149ebe72b03398f4c373875cfbc8c599 kernel-devel-6.12.0-211.55.1.el10_2.aarch64.rpm 90c8331c702053c81b2970104ffedd377fc78844e1b86591b4f840185d59000e kernel-headers-6.12.0-211.55.1.el10_2.aarch64.rpm b19079cc903cfb6de172d82babe5be228ccc433e8a32933b3c91fbf86b316f15 perf-6.12.0-211.55.1.el10_2.aarch64.rpm beda34735777574612e2c41c7e163b0adc4dcfe7c4da975ab96a758f782db34b kernel-64k-devel-6.12.0-211.55.1.el10_2.aarch64.rpm bf2d977d14609a5ce2c5da6552b34efa24dc41c6d975ac9267d5cf920c9d16c5 kernel-debug-devel-matched-6.12.0-211.55.1.el10_2.aarch64.rpm c4607a9fa3b06a45f49b8b270adb89597d670157cd19d989eb5c3da0ab0f115d kernel-64k-debug-devel-matched-6.12.0-211.55.1.el10_2.aarch64.rpm cef460609e1e2a8be46c3e21d871870bc7fef0d8772a9207491a44e5a2e3ff0f kernel-64k-debug-devel-6.12.0-211.55.1.el10_2.aarch64.rpm ed8f7dbab792bf0365225997338f14aec70759b3630b240b0636b5d7dcbf7558 ALSA-2026:67525 Copyright 2026 AlmaLinux OS 0 1 Moderate

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.131 Runtime version: 8.0.31 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.131 and Runtime 8.0.31 [almalinux-10.2.z] (JIRA:AlmaLinux-252248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-apphost-pack-8.0-8.0.31-1.el10_2.aarch64.rpm 0085a028b1bc134daa0513c45c5d6867d5ac58816f77936308b91f68490028ed aspnetcore-runtime-dbg-8.0-8.0.31-1.el10_2.aarch64.rpm 2c29d78356f4329ec846e82c48a65e0d72877fa780e365939dc10c75f0f0e7c5 dotnet-sdk-8.0-8.0.131-1.el10_2.aarch64.rpm 2fa789966e6ef6b745c4be1db55920bcdb4c59c185ff4f11dc1b9f5d39a161f6 dotnet-runtime-8.0-8.0.31-1.el10_2.aarch64.rpm 586526cdc12c94ba008dae2346c3aa78a25584bdd67cf6877a6b8040f7ec2b76 dotnet-sdk-dbg-8.0-8.0.131-1.el10_2.aarch64.rpm 66ebc64c84dedd7e1ebf94f565ae093fc251e13da6c4053c7542bea08488db57 aspnetcore-runtime-8.0-8.0.31-1.el10_2.aarch64.rpm 787d80887b84bc35ba1deea44a506e4f27151c940cdfb3c95dd67ddb70888487 dotnet-templates-8.0-8.0.131-1.el10_2.aarch64.rpm 8f80c4062673903974448f7c2bef2425bb0fa0d98c9764ecff43c2dfe62c8d8e dotnet-runtime-dbg-8.0-8.0.31-1.el10_2.aarch64.rpm 8fcf2048e4cc1ded694091a4061637fd749a1237591e804f03f6bce4c9b6812d aspnetcore-targeting-pack-8.0-8.0.31-1.el10_2.aarch64.rpm bba401c359891953d98e4447b3bdb767130240db3aff0b401cf5eda75def2f93 dotnet-hostfxr-8.0-8.0.31-1.el10_2.aarch64.rpm d31f968752000928eff1b6613bb2b7c36c7f702cbe01abf31584f59ec4f8a455 dotnet-targeting-pack-8.0-8.0.31-1.el10_2.aarch64.rpm e16f50dcd467341d72334217673467b37f0be348035ea6c4068da4cb7f9beb9d ALSA-2026:67528 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.121 Runtime version: 9.0.20 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.121 and Runtime 9.0.20 [almalinux-10.2.z] (JIRA:AlmaLinux-252279) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-targeting-pack-9.0-9.0.20-1.el10_2.aarch64.rpm 01b2df6cfd6470dc5b6095cbe9bfebe14af7ec8103aaf6be8a9bed66e0a6f770 aspnetcore-runtime-9.0-9.0.20-1.el10_2.aarch64.rpm 09c4127c34f2e4cfa91733cff831231047377f16a828487b751e7ec60dd69167 dotnet-hostfxr-9.0-9.0.20-1.el10_2.aarch64.rpm 1074445394ed4ee3b154a3f9cda18010437103fa4d16ea7e28ed69a1e2ba1bfe aspnetcore-runtime-dbg-9.0-9.0.20-1.el10_2.aarch64.rpm 260096241fe94411dcf5ab134317e85e337e8b0064c574446a68e25b723e8e50 dotnet-sdk-dbg-9.0-9.0.121-1.el10_2.aarch64.rpm 45f50c3c7c9146a6b6cf4963db503e9b91f04d9de611793afe490c8d0c70226d dotnet-sdk-9.0-9.0.121-1.el10_2.aarch64.rpm 6bc35269b2267efc0409f981405ed24763ee4a5e4c19a2de51d58c380ee40cc2 dotnet-runtime-dbg-9.0-9.0.20-1.el10_2.aarch64.rpm 80c8147f5153c5a3a034af4c3fff6535e00979a01bae047818119f57a8da9f55 dotnet-apphost-pack-9.0-9.0.20-1.el10_2.aarch64.rpm 8945cebbda7d64200abeda636f346ffae6e90010bbc555ad7ae41aad7fcde9e8 dotnet-runtime-9.0-9.0.20-1.el10_2.aarch64.rpm 9113ef7cc61062fdb9ef223a3a6922732fb2f88fb702d54555ac1552a759dda5 netstandard-targeting-pack-2.1-9.0.121-1.el10_2.aarch64.rpm ddddb8fb69e70874c515ccf59bc686a5aa35fb63f4681f66db7ee349b8618127 dotnet-templates-9.0-9.0.121-1.el10_2.aarch64.rpm e60c51c76603e68caf2c22502068e668e3ba03292f862513d23be807c161a0e9 dotnet-sdk-aot-9.0-9.0.121-1.el10_2.aarch64.rpm eb687a6394474e775fb3ab053efec8e0e19f50ad5e283c107d8b0183dfe2d3fc aspnetcore-targeting-pack-9.0-9.0.20-1.el10_2.aarch64.rpm f6560eca866f46720c56c4dabcf64047f7d783da31962d6ff5b7862fa6db63d2 ALSA-2026:67530 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.112 Runtime version: 10.0.12 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.112 and Runtime 10.0.12 [almalinux-10.2.z] (JIRA:AlmaLinux-252320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-runtime-10.0-10.0.12-1.el10_2.aarch64.rpm 0f6b33155700445e268f6bedbff90efe5be651fe115a911147bbd960585238b6 aspnetcore-runtime-dbg-10.0-10.0.12-1.el10_2.aarch64.rpm 191a8dc7dfcc926f41883a106298838068be723fb61c1b913a7f4f3bf207fc15 aspnetcore-targeting-pack-10.0-10.0.12-1.el10_2.aarch64.rpm 1f7245f01c9fdab8d47836b43b1cb5d365178ef230a4e54f8dfb4a0774931cb1 dotnet-host-10.0.12-1.el10_2.aarch64.rpm 2b2636ec9d747a9178813874e5fd549ab046417c1c0b0346a6a19cfc340ee276 dotnet-sdk-aot-10.0-10.0.112-1.el10_2.aarch64.rpm 6e41c610e1c9ac857321e8cf4318dbb71a37b2db8b34fe016be11037258f3103 dotnet-sdk-10.0-10.0.112-1.el10_2.aarch64.rpm 8c7a8fcbd3edf5af5d7f59e0a5bf90759fbb4639d47f15488d1fa5a43f083fdf dotnet-targeting-pack-10.0-10.0.12-1.el10_2.aarch64.rpm 8fd3a4297dfe09ecc121f6dfa48e0cffaf2052b90b0c2918c4b7c11bc86f1a6d dotnet-sdk-dbg-10.0-10.0.112-1.el10_2.aarch64.rpm 9952c6f0be1f9c52e645dcfa7c3a16806eb8b58b95d53b081f2fc41f85869072 dotnet-templates-10.0-10.0.112-1.el10_2.aarch64.rpm b6438d7ad52b28ff08223b627880dc9dd331b8dd9a6066a02c561fd8035bc76e dotnet-apphost-pack-10.0-10.0.12-1.el10_2.aarch64.rpm c5b4d8ba06dc90d694f66e10af9a4acb8b0663d56e910a565ca860f90e93c4a6 dotnet-hostfxr-10.0-10.0.12-1.el10_2.aarch64.rpm cdf75472bb67e76e9130d0b799184b8e26fce6ed7b217a738154021aa0444a22 aspnetcore-runtime-10.0-10.0.12-1.el10_2.aarch64.rpm e317e4481221669db5fc8a96792878bee7eee59a9b159c1ef51f9d5ea1fe8c7b dotnet-runtime-dbg-10.0-10.0.12-1.el10_2.aarch64.rpm ebec38fe9fdebbbea333079b300e3dfd38b12dc6ed3b9d9854d25d0aeb2fc2ec ALSA-2026:67584 Copyright 2026 AlmaLinux OS 0 1 Moderate

rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rsyslog-crypto-8.2510.0-5.el10_2.1.aarch64.rpm 0b7de62bb343b06ab20517a5e04842f9f008db3ce9239245225875b8f8ce25bb rsyslog-mmkubernetes-8.2510.0-5.el10_2.1.aarch64.rpm 2276886b183dc79c023d54ef27569d94613578e09e3e19f29274156065690fd4 rsyslog-mmaudit-8.2510.0-5.el10_2.1.aarch64.rpm 30d3f622eb7a7ac9fc0ded502b97d5f8e9d08dbfb26676c408a43fbbcbcad709 rsyslog-kafka-8.2510.0-5.el10_2.1.aarch64.rpm 338c291f5678011a116075169083ee4b07adffd0c3ecaa6e057bee60e48869de rsyslog-omamqp1-8.2510.0-5.el10_2.1.aarch64.rpm 367d42340222c493bb21796d113ff59bcf546b966908fb598db5a0c6df552fa9 rsyslog-mmnormalize-8.2510.0-5.el10_2.1.aarch64.rpm 37c561cc11ccffeeed3de6e27f528c689c6fb314a808c411bc2b4841a2e4e433 rsyslog-openssl-8.2510.0-5.el10_2.1.aarch64.rpm 4e799290f072e3b5fbe5c4cdcdaa145d69b4d78f0ced36438c4cb858194c8be5 rsyslog-mmjsonparse-8.2510.0-5.el10_2.1.aarch64.rpm 4f19e4c29d80b9eabb19ad1c109232d1d99e979a1474a221edc89cdabf94585b rsyslog-mysql-8.2510.0-5.el10_2.1.aarch64.rpm 56937cb6e6e519aae61e2f49c2ca5caec5f8694bd1827f97063e7eede141150d rsyslog-mmfields-8.2510.0-5.el10_2.1.aarch64.rpm 5ac61d96cfe38a986086080a5b5a816dac8825952f9130f4375ae4be82fea9b1 rsyslog-gnutls-8.2510.0-5.el10_2.1.aarch64.rpm 5aee87602c20f085a15e46692a8aa400715f2d77c2bd911daef77467517a28f0 rsyslog-doc-8.2510.0-5.el10_2.1.noarch.rpm 5eb376ccbd5574465d95f79c551faadf1b77b055b2e397074abdf8290145b706 rsyslog-snmp-8.2510.0-5.el10_2.1.aarch64.rpm 7f64312340f1f7ddb23d07b967f0b27d17a80f29d2c5c3dd9f861e8ad637cb3f rsyslog-8.2510.0-5.el10_2.1.aarch64.rpm a9555968b90d8d91d50a0542dda108e2ec45a26af37da188aa92fcd59e847b7b rsyslog-udpspoof-8.2510.0-5.el10_2.1.aarch64.rpm a9c7b54a0a11b64a2eea9a62bb1e4057bc662a8fa0f1300b73627f9054b371cb rsyslog-pgsql-8.2510.0-5.el10_2.1.aarch64.rpm c1a0619f6ebc4db50406ce651f7bd7572e92a2f86c19e6921f99f5eca5ec1658 rsyslog-mmsnmptrapd-8.2510.0-5.el10_2.1.aarch64.rpm c79a9660ac0e05bc62c44ea29406c9c15705aa12a7f17ddca91ea1073f32e6c0 rsyslog-elasticsearch-8.2510.0-5.el10_2.1.aarch64.rpm eaa122cbd418a715d6a4874ecaa5104f88a345244dcf3e6053a742d2d55ccecd rsyslog-gssapi-8.2510.0-5.el10_2.1.aarch64.rpm ee97656da0c9aa7c631b9f38621db71007357590089b084513d1cd7c3a0edcaf rsyslog-relp-8.2510.0-5.el10_2.1.aarch64.rpm f44f21d278bf1d4b1509435ae14e74822b83cd35535e21401c639a51b2b3d1b8 ALSA-2026:67872 Copyright 2026 AlmaLinux OS 0 1 Important

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default corosynclib-3.1.10-1.el10_2.2.aarch64.rpm 6286b4c8f928115dc9650a1a3db35fbe79a663bd60d9711335ffb3b3f8566123 ALSA-2026:67909 Copyright 2026 AlmaLinux OS 0 1 Important

libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fix(es): * libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383) * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387) * libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381) * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384) * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382) * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388) * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385) * libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libevent-devel-2.1.13-1.el10_2.aarch64.rpm 5918ff49b4a7fa05bfcf2069ba4e4067b7cdfe09999bf0483a88096fdcaea7be libevent-doc-2.1.13-1.el10_2.noarch.rpm 8f97e5ea7d9bd2f38f36ae5c546a1143c2438ea22193be05cfb08d3a9e3159b3 ALSA-2026:68235 Copyright 2026 AlmaLinux OS 0 1 Important

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service (CVE-2026-15709) * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation (CVE-2026-15711) * libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body upload (CVE-2026-85197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libsoup3-3.6.5-3.el10_2.14.aarch64.rpm 3213a067c7a317dc7cfbe812b5ee7fd6aba075c42b0d650de04f4c6ba240df6b libsoup3-devel-3.6.5-3.el10_2.14.aarch64.rpm 9e197aac5df885fbeb12d07f6c2fcc6ae84cf189e41b8b3994cc707ecaa68e59 ALSA-2026:68291 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default unbound-libs-1.24.2-7.el10_2.5.aarch64.rpm 39d4664e9c8eaa3389788f93445ce03a19551515b924e96e1423c686cf48b60f python3-unbound-1.24.2-7.el10_2.5.aarch64.rpm 6d0d3fab20377b03d0af3b11a17420ae7a43cec04051fc7d77943b42c37ebcf8 unbound-dracut-1.24.2-7.el10_2.5.aarch64.rpm 9cadbcc730d6ab4848887b641eca6835a00bee5880cc9eddc4a8ffd7cb3ca707 unbound-utils-1.24.2-7.el10_2.5.aarch64.rpm bca8094c3e35b4f169b05bee0ebf2f4647e156326a6bf26629129351fd3586c6 unbound-1.24.2-7.el10_2.5.aarch64.rpm ef61bb7fa5e9fdcf5aa971181bfe4efbde3bcdcff3705c675c62c45edb905066 unbound-anchor-1.24.2-7.el10_2.5.aarch64.rpm f55704763e1d76f373f9c0f78f7efda7ffad36a03889f206bfa0b7a48bea3215 ALSA-2026:68507 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007) * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923) * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176) * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175) * kernel: netfilter: handle unreadable frags (CVE-2026-64414) * kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456) * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200) * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143) * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128) * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102) Bug Fix(es) and Enhancement(s): * nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0) returns EBUSY [almalinux-10.2.z] (JIRA:AlmaLinux-239776) * AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-10.2.z] (JIRA:AlmaLinux-254105) * RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:AlmaLinux-255225) * RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:AlmaLinux-255516) * RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:AlmaLinux-255518) * RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:AlmaLinux-255519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-devel-matched-6.12.0-211.56.1.el10_2.aarch64.rpm 1009e82fd2979aaaf5bf765c5bd04ae35558a217d3cda9e2eac4c6b1858ff487 python3-perf-6.12.0-211.56.1.el10_2.aarch64.rpm 489d76aff38aeafcf0fec94cc7dce70f4e3fb7ab46506bbbb5dbe6a495e10dcc perf-6.12.0-211.56.1.el10_2.aarch64.rpm 4ccc2f901897077043da523c6281269b88ac8bb091dfc9836a5352c1f0b1fd8c kernel-debug-devel-6.12.0-211.56.1.el10_2.aarch64.rpm 4db07cae3e2dfedddc4488db2fdecc414d521aa529c3d37f25474d6e4305fe42 kernel-64k-debug-devel-matched-6.12.0-211.56.1.el10_2.aarch64.rpm 83578bac4443b822d745b53834f6887ec1c3243b46ab1af2d0c3bc2649eb6cb0 kernel-64k-devel-6.12.0-211.56.1.el10_2.aarch64.rpm 8613199ddd9caf2ce2304310add6ebb86a92c94bef16ed8c6fe19590e6cf800d kernel-headers-6.12.0-211.56.1.el10_2.aarch64.rpm 92b9fe6b4a64b14a17dfe2f5c2481218c0383818ea17a145bd193ade0586a99a kernel-debug-devel-matched-6.12.0-211.56.1.el10_2.aarch64.rpm 96daf77049c12f93d2a38b35430b4af3e5d49e194791331878a31e9a0cd5220b kernel-doc-6.12.0-211.56.1.el10_2.noarch.rpm 9ac495690b0f89bc57aec2d253ec27914f0238abd009f57c498b6a2668c73807 kernel-devel-6.12.0-211.56.1.el10_2.aarch64.rpm 9bf7bfb62e89cd636c9ad3f2193d91f6f79874a0223365fcc91279f161a468d4 kernel-devel-matched-6.12.0-211.56.1.el10_2.aarch64.rpm a3cf04e36e8df2d4bfbb52d66b3f60e62d1877033c4bc6f56f776270036ef2b6 kernel-64k-debug-devel-6.12.0-211.56.1.el10_2.aarch64.rpm b4ac55889b19b3ae39cd66fa0cfe6a8e88b0a54ebb8b3488938dfc016bd5220c rtla-6.12.0-211.56.1.el10_2.aarch64.rpm db697ad3e15a6a92da6dbe5d2fb521e25ceaab7dc7c2c810da659d8ab3578ff3 rv-6.12.0-211.56.1.el10_2.aarch64.rpm e9037f0cb048f968336c0815f0a7ad7aa672cd7eb0301d48803ec90e25d7186e ALSA-2026:68651 Copyright 2026 AlmaLinux OS 0 1 Moderate

tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default tomcat9-jsp-2.3-api-9.0.120-1.el10_2.alma.1.noarch.rpm 079235eb90790724bd53fa760599c4fabc2ca146f0df04dc03b825473f6929f0 tomcat9-el-3.0-api-9.0.120-1.el10_2.alma.1.noarch.rpm 127036aa147028de0c591c915f5913b3c80dbbbb60b91558081f3842befb9deb tomcat9-9.0.120-1.el10_2.alma.1.noarch.rpm 4345bedf4762f697d7820e4c40e33db6d512fbb7bb3aa1bb1736a9517eb26bb1 tomcat9-webapps-9.0.120-1.el10_2.alma.1.noarch.rpm 5438a76184cee45e329a47afa3263e09dfcd6150cbd0ff81c9aa64f29718fbaf tomcat9-admin-webapps-9.0.120-1.el10_2.alma.1.noarch.rpm 5abf8cce64844d9b8d793f656ee9059ff88d5778b36b2132610327becea70b50 tomcat9-docs-webapp-9.0.120-1.el10_2.alma.1.noarch.rpm 8f39945c344abb46ae48edaeeb08c9422248d21b0fa78a5168faae09fb3f81ef tomcat9-lib-9.0.120-1.el10_2.alma.1.noarch.rpm c47704f2da56adf112c8a1acc1d7fe27bb3e7896bbfcbcdff7dcc0673fda1877 tomcat9-servlet-4.0-api-9.0.120-1.el10_2.alma.1.noarch.rpm ddabae1dd27c35dd4cee5c1eae2a7f3dd9d8d1aa22810be1c19a7df07b7d56ed ALSA-2026:68692 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security, bug fix, and enhancement update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Policy bypass allows unauthorized program execution via execveat (CVE-2026-82474) Bug Fix(es) and Enhancement(s): * Use canonicalized path if user path contains ".." (JIRA:AlmaLinux-212546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-10.p2.el10_2.6.aarch64.rpm 69a79c3cb3c150ed8fcd40bd0db8569297342f211ab1c76b60664e5ba90c3615 ALSA-2026:69099 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-7.el10_2.8.aarch64.rpm b8f9242c332ac62bb26ef97b50d97a500e47a1c1e9c9d61783b26449e61cdcc8 ALSA-2026:69125 Copyright 2026 AlmaLinux OS 0 1 Important

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926) * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.6.aarch64.rpm 0b9e321b52def8c8435f0844d4b62d745a8dd40e455cb96fb5c73b3169bffed8 ALSA-2026:69129 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995) * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999) * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283) * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281) * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssh-askpass-9.9p1-27.el10_2.alma.1.aarch64.rpm 83b28f277e5090951c441d17c85f266b8bb0954ceaafb7f67205442f0c4da152 openssh-keysign-9.9p1-27.el10_2.alma.1.aarch64.rpm 9148e67468a2fb1bb7bfd66b12c41986625625554ef634831a55f940bcd75dec ALSA-2026:69259 Copyright 2026 AlmaLinux OS 0 1 Moderate

tomcat update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default tomcat-10.1.49-4.el10_2.alma.1.noarch.rpm 05f66cc8b41b005142502d651ba514eded6e74fadebc4bdc6c0d92950d6879df tomcat-lib-10.1.49-4.el10_2.alma.1.noarch.rpm 1ef407ca747b0004e12dfb23f976be66e723a1e587ab0958cba13bdb751f2505 tomcat-webapps-10.1.49-4.el10_2.alma.1.noarch.rpm 3039facea1830d6007abf1fdc9482c06d32fcb2fb13da8d1c71963066f81e351 tomcat-servlet-6.0-api-10.1.49-4.el10_2.alma.1.noarch.rpm 3b705c8b7203a1082a75a9137b187f792afaaf227daf36911e2dbeccf5e0f1b1 tomcat-el-5.0-api-10.1.49-4.el10_2.alma.1.noarch.rpm 4df179b81ca2db0f43fec568ccc75a8679fffe363fec2fb6561e4f02955b8ae7 tomcat-admin-webapps-10.1.49-4.el10_2.alma.1.noarch.rpm 7c7acfc2c6790f4c32d6cdaf0b0ebdfa664f793a282af54ec03f3852621bb52f tomcat-jsp-3.1-api-10.1.49-4.el10_2.alma.1.noarch.rpm a6fc4fb2bc554f7fe792d34fef93212e54a6708c02ec0a9ef3f40adf76158df1 tomcat-docs-webapp-10.1.49-4.el10_2.alma.1.noarch.rpm d77aa50850c7291ba9872ee696549bcb39f63510d6dcf156bfa5d47ae3113c12 ALSA-2026:69308 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.3.aarch64.rpm 4416f312e5238d7842c34fab7e5a6af67d43c5bdbd1ca584687b3fa95154081b ALSA-2026:69461 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031) * firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011) * firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028) * firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013) * firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012) * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014) * firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) * firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021) * firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008) * firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007) * firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029) * firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default firefox-140.16.0-1.el10_2.aarch64.rpm b661ccb7beb361bc8aa843b5c23e73c0e7399b8951fdfe4fc914315db212a82f ALSA-2026:69541 Copyright 2026 AlmaLinux OS 0 1 Important

rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rsyslog-openssl-8.2510.0-5.el10_2.2.aarch64.rpm 1f36b60a5e936a494c64a6f872a5665248bf375d70dd02f8f333a3da75a9121d rsyslog-mmjsonparse-8.2510.0-5.el10_2.2.aarch64.rpm 377e468067cf5630fc0bba2c795a1c94402d41a8c9cee30748ff5851d37fe246 rsyslog-mysql-8.2510.0-5.el10_2.2.aarch64.rpm 3af40aef6197a9d48ec189fc4505f53c4808256671c2af02bd29d57c5efc32a6 rsyslog-crypto-8.2510.0-5.el10_2.2.aarch64.rpm 3bcb49d3a4becd1ec4ac96f77510ac2a2ee115279a87e0032b745ff0f02a119f rsyslog-udpspoof-8.2510.0-5.el10_2.2.aarch64.rpm 50acc9a2ee9f74f3a9c396019c4a450aa6804bc572cbe0c37688958025a2264d rsyslog-mmaudit-8.2510.0-5.el10_2.2.aarch64.rpm 613bebb74ccaea773e9c5d35b3c7e9f8304d5bb295168a9adabde7650b6a24b1 rsyslog-kafka-8.2510.0-5.el10_2.2.aarch64.rpm 657a64e07b467b748e9ab4e8980f2f36bfd07b8b92fd25538482dbe0f67f280d rsyslog-gnutls-8.2510.0-5.el10_2.2.aarch64.rpm 84ce3cccd3b215c99723837ec40b0282f0cf0413313f673033fe2ed030c28ce1 rsyslog-relp-8.2510.0-5.el10_2.2.aarch64.rpm 84e4acb9f61fe23da43139ffdec7aebd7feabac49e32412c6cf99d614c6c701a rsyslog-elasticsearch-8.2510.0-5.el10_2.2.aarch64.rpm 86aeac847ad606eb37579eee1b9d422b56915aba38f6bd4fe95b85f566b28675 rsyslog-pgsql-8.2510.0-5.el10_2.2.aarch64.rpm a1ec00072d94d6b56e5fd989d21125eccf206d091e3b6d909f10a6f65866f41d rsyslog-mmfields-8.2510.0-5.el10_2.2.aarch64.rpm a356d6e940a3cdffc5eaa0527e5b7859d3212acc2423efcedb88c238596c1a63 rsyslog-8.2510.0-5.el10_2.2.aarch64.rpm a3e147075e2ce41eecbf44527f9965b8eb2db10f08d1c7c125adfee967efe88d rsyslog-snmp-8.2510.0-5.el10_2.2.aarch64.rpm c385f293a6097ed4dc186d7b651905cb7440ff212e30ebc100588e2e234446e4 rsyslog-doc-8.2510.0-5.el10_2.2.noarch.rpm d0db75ed47fc8d888cb8c7c423f927c07b67ef296633a799feaa348cac1a5e74 rsyslog-mmkubernetes-8.2510.0-5.el10_2.2.aarch64.rpm d5784dd4e4c7ffccfed1730eae2678f68041c144d68410522139edb1af1c3618 rsyslog-mmnormalize-8.2510.0-5.el10_2.2.aarch64.rpm dee68afb54cdab6aedc3029079e02be71f882b688d9a5336d4170c03fa93575a rsyslog-mmsnmptrapd-8.2510.0-5.el10_2.2.aarch64.rpm eb88e4540879fc2ccd6792d8061b25a57eb9d9af069262a4e47def17090d2b56 rsyslog-gssapi-8.2510.0-5.el10_2.2.aarch64.rpm f4fdcd37a1407674a5b3f6ff85a12cd5f360007f9b40f2331f5fe885fd6c6858 rsyslog-omamqp1-8.2510.0-5.el10_2.2.aarch64.rpm fdc971de536742687aba0791f9dbb240e6741d214fe20445dc54918e81645df9 ALSA-2026:69553 Copyright 2026 AlmaLinux OS 0 1 Low

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header (CVE-2026-15028) * libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default bsdtar-3.7.7-11.el10_2.aarch64.rpm 24f7766155b3e01bfa2872284520a59b0422db9aea74681ea450ff870455709c libarchive-devel-3.7.7-11.el10_2.aarch64.rpm 2ffab48a66c2eaf05ba64398638177da318530e2ae59301166c1d427c475eb77 ALSA-2026:70186 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default postgresql-plperl-16.15-1.el10_2.aarch64.rpm 17cffb2b5ff89c03aa6dea534385eb91b206f578ccace1f080d4c2e4d1eb9d46 postgresql-pltcl-16.15-1.el10_2.aarch64.rpm 36964d1d7600f7086b98a7ddf48074fcff960dadc4cd08d8d4b72c46bb982329 postgresql-private-devel-16.15-1.el10_2.aarch64.rpm 3992b9543cf61bd8193edbf29ce87f6737a72332ffbf492c0faac37dd4a0ce9f postgresql-upgrade-16.15-1.el10_2.aarch64.rpm 508633c21872d4fce187f07fa914a11081dc1616806ec219eaf20c2456efa686 postgresql-static-16.15-1.el10_2.aarch64.rpm 567a542098fcb160af6e106092fca3f7fa5c151a548c152d5994d0dbf52d3920 postgresql-test-16.15-1.el10_2.aarch64.rpm 5a4849edb92c3f83d44e6c17b628ab44201205a88ff7154edcdf4c34a6034b1b postgresql-server-devel-16.15-1.el10_2.aarch64.rpm 849cb5a277a1b57f332ff72de1f3911dfb640cf3fdffee1a43bf5344485301ae postgresql-private-libs-16.15-1.el10_2.aarch64.rpm 8f85d6617672ed928d9ca33b03a6ade831940084c15dc124896329bad9091f48 postgresql-upgrade-devel-16.15-1.el10_2.aarch64.rpm 932b5b74d3d3cda7a32bcc6b997b5c80150b6480053f67afd11e20ce90ceade4 postgresql-contrib-16.15-1.el10_2.aarch64.rpm a505c2d2644b0be48efd2d1cf688dea6dc54b56f7b9bd938323b9419e0422951 postgresql-docs-16.15-1.el10_2.aarch64.rpm c0f7d1ac0a14f01b6db10752ad89950c8e82e24992cd1e1596bba3b9c1c20db7 postgresql-16.15-1.el10_2.aarch64.rpm ccd5ea935adc75796b888c834e557f35e8b464c6fcaa5ee9834de457cc1e8744 postgresql-plpython3-16.15-1.el10_2.aarch64.rpm e0a8b095b518d7077795d3241be0e03b820f64706feef07dd3697309aac528cc postgresql-server-16.15-1.el10_2.aarch64.rpm e25d89f0e25bb0c32a4c2ee661e3a41406373804efe5248fe16efe7fb054efa4 ALSA-2026:70201 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * podman: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852) * podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730) * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default podman-5.8.2-9.el10_2.alma.1.aarch64.rpm 01121f16d5ad2f5da3608eb0dd4825ca927e77d0dca5130e0b1347d9e648628c podman-remote-5.8.2-9.el10_2.alma.1.aarch64.rpm af70314866593ac9649f0f793195805165ebc47522817d2cc27cfbea9e75ddad podman-docker-5.8.2-9.el10_2.alma.1.noarch.rpm f46c4a2f1c8d19490236bd31637b67ed406bf45d03eeaf0ed986334693a23e6a ALSA-2026:70498 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518) Bug Fix(es) and Enhancement(s): * Update kernel to use new certificate paths [almalinux-10.2.z] (JIRA:AlmaLinux-169478) * RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:AlmaLinux-255517) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.58.1.el10_2.aarch64.rpm 15a554ac944e477f972b61098287dca8420861eb5d239d166e7002e3e2ac21e5 kernel-doc-6.12.0-211.58.1.el10_2.noarch.rpm 2759cf0eebab0e931daf54293a7fa911cfd7d55cdb55ae2d2ad8d9f0fc021217 kernel-64k-devel-matched-6.12.0-211.58.1.el10_2.aarch64.rpm 3ffcdbac10c1cb1e5a59a040f27c61db30c3656e3954e3537382982df0218997 kernel-64k-debug-devel-matched-6.12.0-211.58.1.el10_2.aarch64.rpm 4ec8165b0e940c2e020c3a90c609bf53ba11dbb452cb839c0515bfc673278b9e rv-6.12.0-211.58.1.el10_2.aarch64.rpm 600d04dd1c5d12f7fde7af2686a2ba0f8a4fbcc1a425d000e08ae8a88b8cb947 kernel-devel-matched-6.12.0-211.58.1.el10_2.aarch64.rpm 655b6426cbc77a49e4b421fe69f80077df813c95b0ff32756f08dbdce4d7ae95 python3-perf-6.12.0-211.58.1.el10_2.aarch64.rpm 710204edfe49d011b3d299c9f24074d82b50226487fec6bb1a8a1968548372b7 kernel-headers-6.12.0-211.58.1.el10_2.aarch64.rpm 72d8ce3ecc2639df6dd529bba5d0632e5a3d2448317624afb08373d6d2f789b9 rtla-6.12.0-211.58.1.el10_2.aarch64.rpm 74931cde5f8dbb5f6da47ce2d10cabd8cf0b9eec369cb9beef4cd1e94743c063 perf-6.12.0-211.58.1.el10_2.aarch64.rpm 7938111bcb07d468866f70196e9917806aa241c2acf2c32db645d79aac81a3a3 kernel-64k-debug-devel-6.12.0-211.58.1.el10_2.aarch64.rpm 7a8a1853175f34e3f8789358cfd3ace00798dbe61e6b6b9374e13274ad486050 kernel-debug-devel-6.12.0-211.58.1.el10_2.aarch64.rpm 83a886b6722c9bacc764fb9306f14c4c1fbce85298f48ebe48aa30cf09d373cf kernel-debug-devel-matched-6.12.0-211.58.1.el10_2.aarch64.rpm ad09da2d694109c2d068ab6b6a0583d735acc0506dbca6f4fc7debff5194171c kernel-64k-devel-6.12.0-211.58.1.el10_2.aarch64.rpm b57f69abc7e4e2f1a6df9c337e814f00b7c3fc61d477a21ee1009644e51ec457 ALSA-2026:70753 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder (CVE-2026-73194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.6.aarch64.rpm dc8bdd88b3e90aefa390060ca99cf3748ffbb6038328e3e8cce6732630dd772f ALSA-2026:71233 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007) * kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) * kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831) * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802) * kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053) * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383) * kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564) * kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569) * kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844) * kernel: net: tun: bound receive headroom (CVE-2026-81000) * kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846) Bug Fix(es) and Enhancement(s): * kernel module .ko ELF files with non-zero sh_addr section addresses [almalinux-10.2.z] (JIRA:AlmaLinux-159298) * sctp: prevent peer transport count overflow [almalinux-10.2.z] (JIRA:AlmaLinux-216247) * [AlmaLinux 10] bnxt_en: RX queue restart failed: err=-95 [almalinux-10.2.z] (JIRA:AlmaLinux-247283) * RHIVOS - S32G: backport missing fixes to 10.2 (JIRA:AlmaLinux-259788) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.59.1.el10_2.aarch64.rpm 25cb2bff3ed6bfbf5aa21d6d7558b22e955bd784f73c3a9fef816a305ea15663 kernel-64k-devel-matched-6.12.0-211.59.1.el10_2.aarch64.rpm 29ba21ac4bdaac0064db8e6f8efb5094deda5747c52bfd59879fb942407a65f0 perf-6.12.0-211.59.1.el10_2.aarch64.rpm 2b1fc26f845a0e59d1e94bac8b46cc942faebec42069325069857eba7432bca7 kernel-debug-devel-6.12.0-211.59.1.el10_2.aarch64.rpm 4b25807bb692a1496f6784a1bb57ab3af2e1ba4cd7a60f35d66f0df5e019ff7f kernel-doc-6.12.0-211.59.1.el10_2.noarch.rpm 570136fba25a6b0e607b32762ab0b5f9a1bf9803cf7c18d367189ed301f9afbc kernel-64k-debug-devel-matched-6.12.0-211.59.1.el10_2.aarch64.rpm 8c0e141179120db169794ce8e3ebe0663fd13757bfaf985ed0cc7d1541fb24d7 kernel-64k-debug-devel-6.12.0-211.59.1.el10_2.aarch64.rpm 8d9afee71fb8f306a7066dfca68e8a4126c23942a0e0ace7f8e90622d679f205 python3-perf-6.12.0-211.59.1.el10_2.aarch64.rpm 9206cc26de1562cc6e398962d629edbe48aa17cda03b7be6b8d13b31fbc6087e kernel-headers-6.12.0-211.59.1.el10_2.aarch64.rpm 937551f8c4e4dc070bf0ecacac1b57008c508e3d363a5421b71c437e6515c7d7 kernel-devel-6.12.0-211.59.1.el10_2.aarch64.rpm bc6479e5b81d4fb8ef472b9d574888a76ca831c952c83933970ddeb750610da9 kernel-64k-devel-6.12.0-211.59.1.el10_2.aarch64.rpm c826e79de3ea4d73893b7881aa1f0934d657703d944d32119830f6d8ac0aac62 kernel-debug-devel-matched-6.12.0-211.59.1.el10_2.aarch64.rpm f4a89112cc948b70b129d1a85d29fb750e5dd39a7595705e0d30245697a92fec ALSA-2026:71419 Copyright 2026 AlmaLinux OS 0 1 Critical

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717) * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634) * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default unbound-dracut-1.24.2-7.el10_2.6.aarch64.rpm 1ad138c06cc854e6e0e4bcb2a2512d7ebd8d46c96235b2c3b486bb3f58cec86b python3-unbound-1.24.2-7.el10_2.6.aarch64.rpm 3759eda539b5f4ee298f405b8e7b89162d32554dc92caf94c949a64f916fa36c unbound-utils-1.24.2-7.el10_2.6.aarch64.rpm 55680678e1212f2c118069dd25ea2efe1d790395971333e579a8d71115d3ce5d unbound-libs-1.24.2-7.el10_2.6.aarch64.rpm 69cd86427a2a9930ea84df54379330906ec09623a72b1a4bb4d441fc78ab66f3 unbound-1.24.2-7.el10_2.6.aarch64.rpm 798f30c3d0d46b1d5d0a6e6b79878d213930b63fafba1afa6637ddefe0108235 unbound-anchor-1.24.2-7.el10_2.6.aarch64.rpm c7701fbe4870402ef57cce11fe77d430fe5d137f6e64709d5d36492056a68461 ALSA-2026:71543 Copyright 2026 AlmaLinux OS 0 1 Important

cockpit-image-builder security update

The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild. Security Fix(es): * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899) * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975) * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172) * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default cockpit-image-builder-94.4-1.el10_2.noarch.rpm 6d46bc65678588738897e9833c8b0821f6f410eb59d37f70469150a20636cb8a ALSA-2026:71586 Copyright 2026 AlmaLinux OS 0 1 Important

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138) * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143) * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140) * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142) * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144) * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.4.aarch64.rpm 8c0220464b81fd92a36a11b9c1767758d23e10f3560dcab388ac630e2ec40f1b ALSA-2026:71602 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323) * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285) * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984) * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990) * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199) * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311) * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005) * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203) * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290) * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098) * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121) * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108) * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257) * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267) * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266) * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273) * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714) * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481) Bug Fix(es) and Enhancement(s): * Bypass DMA APIs for coherent allocations for pre-mapped memory [almalinux-10.2.z] (JIRA:AlmaLinux-252331) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-devel-matched-6.12.0-211.60.1.el10_2.aarch64.rpm 0b5b733ea1f129669a076f34f1c4c1371291ec1a4ffdf0a8c22439a12741c3e0 kernel-64k-devel-6.12.0-211.60.1.el10_2.aarch64.rpm 187929a19be329479f3cabf2c095fb82f176e9b18b5b3fb6488a8cd6c8f48b4d kernel-debug-devel-matched-6.12.0-211.60.1.el10_2.aarch64.rpm 18be77c94ea1a03ce70da1524e8687e2249cd89d6dd807cf361736f0fd039735 perf-6.12.0-211.60.1.el10_2.aarch64.rpm 30cf5c7f7288bc29a084bc29c1914d1f698c4210e8878f23813ec3a6221d4a5e kernel-headers-6.12.0-211.60.1.el10_2.aarch64.rpm 4a24c46a39487e6c84d031599b736f416684bde7c2574ecc693acd5a488e3485 kernel-devel-matched-6.12.0-211.60.1.el10_2.aarch64.rpm 6b006d2d9ccff9f4cc0772a9fc1b209832a96ed6d19c791e67dc6ead3a47cd59 kernel-debug-devel-6.12.0-211.60.1.el10_2.aarch64.rpm 6dedc267a5f23e3f0cfa067a12fbd3dc3670b885e004407fa7bb7b24d7601c01 kernel-64k-debug-devel-matched-6.12.0-211.60.1.el10_2.aarch64.rpm 7a947a05cae81b13f399b0322c47b22401217f946338efcc7cfb267b4bbae8b1 rv-6.12.0-211.60.1.el10_2.aarch64.rpm 9f11adac2f91f7d8b38b7260578968e8b0d3beaeae611cb765c0540066b1d3a4 rtla-6.12.0-211.60.1.el10_2.aarch64.rpm af1dca1a1aebe461788a059ccb3e9e05a67a492ac01135e636fa69749121d9b1 kernel-devel-6.12.0-211.60.1.el10_2.aarch64.rpm b171f79b841c2f9927b9337218ef2adc7f50b4dc8e44c59aff64e8a12882374f kernel-doc-6.12.0-211.60.1.el10_2.noarch.rpm bbbe1ee1c8c000232e1f59ed8256dab96ac04d67ae9d73b4bf3a15fc22954391 python3-perf-6.12.0-211.60.1.el10_2.aarch64.rpm cdacc4b1cbbbe64abb3826d9660996b8f73bb8e417b9a2a553c67411b90b3992 kernel-64k-debug-devel-6.12.0-211.60.1.el10_2.aarch64.rpm d47bc9c896bd5b691acfbbf79c4325c6f3422d30bdf45c4c6591f4530b9fba16 ALSA-2026:72279 Copyright 2026 AlmaLinux OS 0 1 Critical

ipa security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux10.2] (JIRA:AlmaLinux-173375) * WebUI Hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238510) * ipa-otptoken-import hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238518) * host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-10.2.z] (JIRA:AlmaLinux-238522) * ipa env: support only simple * wildcard [almalinux-10.2.z] (JIRA:AlmaLinux-238526) * ipa-epn: drop_privileges method is mixing uid and gid [almalinux-10.2.z] (JIRA:AlmaLinux-238673) * ipa-migrate: require Replication Administrator privilege [almalinux-10.2.z] (JIRA:AlmaLinux-238676) * ipa-migrate tool is renaming host records & host info in automount information [almalinux-10.2.z] (JIRA:AlmaLinux-240768) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-ipaserver-4.13.4-1.el10_2.noarch.rpm 0fd7500513d74955796c1d0fee7ecba945a8e28ace17bbdab27b6aaa886ae8c1 ipa-server-encrypted-dns-4.13.4-1.el10_2.aarch64.rpm 10e392eef79c8ad51db62f0c114127a7dfebf5fd2b9e21f7c187ef70a6824a01 ipa-client-encrypted-dns-4.13.4-1.el10_2.aarch64.rpm 155e5f6c54388b81e2d897b1b37b3093ee6f54a4cabeb666f1a99ef94f7ad764 ipa-server-trust-ad-4.13.4-1.el10_2.aarch64.rpm 2765a8d625daf07f5a4e43a37694cce9787940cc8bf47e6e01609e9d18897baf ipa-selinux-4.13.4-1.el10_2.noarch.rpm 3bbaaa21c4182fda1a5241bb0f5fc945b4dd8f1295609aea9cabfc4dc827688a ipa-common-4.13.4-1.el10_2.noarch.rpm 4144c11a83aecac08226230567deedacef7facf17ce0a31efefe1a2ad9aaa0a1 python3-ipalib-4.13.4-1.el10_2.noarch.rpm 4becc4f5c6c2c8d32741a3600b8b75f350754d326439bba74ab74eec92cbbde3 ipa-client-epn-4.13.4-1.el10_2.aarch64.rpm 6d98a1a1dd15fdf12c174b1f54e26bd1772d8530144a0b54b79bf085203d9324 python3-ipaclient-4.13.4-1.el10_2.noarch.rpm 75d3397f9faa033046ebf837c3173a3b93b02cb7b7be5d66ee746e74cea35086 ipa-client-4.13.4-1.el10_2.aarch64.rpm 87f4b242d15411726772444ab0a782c64e6fbcca21fb75d43938f3f9b5d2bde7 ipa-selinux-nfast-4.13.4-1.el10_2.noarch.rpm 898e7d3623722553f2ba1cd2b4a473f852a3e0790749aa320403d269e7a0a24a ipa-client-samba-4.13.4-1.el10_2.aarch64.rpm 9353b8bca27d241c437e6bd27bb0eb290364a23426ab8caf35e9ff14c5969834 ipa-client-common-4.13.4-1.el10_2.noarch.rpm 99ad0482c8eaf5ea6a943447eaac1ba10950f97cd551e3ce6c2793f1832e41a8 ipa-server-dns-4.13.4-1.el10_2.noarch.rpm b51948fbd1e5414a345dd9a8a33d2f5c4e174fa72168bdc2518a48180e3894e1 ipa-selinux-luna-4.13.4-1.el10_2.noarch.rpm d6c79b60b49a1f8f4c6f9bdf660fa53d2910a7593dbace5e93e486cb87b288ea ipa-server-common-4.13.4-1.el10_2.noarch.rpm e77c01557668023ac072b330d723c4dd1555495797742ca39c2e7fef063bc959 ipa-server-4.13.4-1.el10_2.aarch64.rpm ff213304f6147b173f79e3f1d35833837e48473bffe59c9c11f37e69bddb3528 ALSA-2026:72427 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default ruby4.0-devel-4.0.6-37.el10_2.aarch64.rpm 0df4d0529a9013cb23ea18a31e90e588268d018f1db4b88168c64180d9b45fd6 ruby4.0-rubygem-mysql2-0.5.7-37.el10_2.aarch64.rpm a40933b26e5ac193492c532de8215a50ceb8b745a6f9cad5f2094120e67c38f3 ruby4.0-4.0.6-37.el10_2.aarch64.rpm c7d621deba66b6c408689fa2c259d8dfa952f7d730463d8d64ed1b23998425e2 ruby4.0-rubygem-pg-1.6.3-37.el10_2.aarch64.rpm d3b3df7c7e0e8d15eba750e8d25c727347b23a71e170264c8dc5110ba39b90f4 ALSA-2026:72624 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076) * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942) * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317) * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341) * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522) * kernel: perf: Reject exited events as group leaders (CVE-2026-74753) * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480) * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775) Bug Fix(es) and Enhancement(s): * KVM: s390: Limit adapter indicator access to mapped page [almalinux-10.2.z] (JIRA:AlmaLinux-188661) * crypto: xxhash64 should not be fips approved [almalinux-10.2.z] (JIRA:AlmaLinux-254943) * kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ? guest never executes. (10.2.z) (JIRA:AlmaLinux-260402) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.61.1.el10_2.aarch64.rpm 13f3df00819c2a88ec08de4cb47e435721d7b0454b35e353ec38d33fa6ec1289 kernel-64k-debug-devel-matched-6.12.0-211.61.1.el10_2.aarch64.rpm 17c81aaf3d1f86cdf10713174e310d01e4762943b140b1e28d616174d0d05946 kernel-headers-6.12.0-211.61.1.el10_2.aarch64.rpm 3b8bca81939c7e87a93204bab5e6e7d5c9e0a77177b8fd399b2f0e5a45293382 kernel-64k-devel-6.12.0-211.61.1.el10_2.aarch64.rpm 4e18bee804c1679cc892152acb11b8bb78bac910e398eb33d1135e010ac4475b rv-6.12.0-211.61.1.el10_2.aarch64.rpm 69b93c7c4388c9fa9f11eb68053f6656df8e0e1beed63a1f53d08536a6949d57 kernel-doc-6.12.0-211.61.1.el10_2.noarch.rpm 6d745d7d315fc5f6d99298e2a1473d86795b33684aeb63850538eb9f248208c2 kernel-debug-devel-6.12.0-211.61.1.el10_2.aarch64.rpm 82d6bf67ccb5ca6adbca3946bf21c3727eb79987fa0c963a4aa4ae98e42dd056 kernel-debug-devel-matched-6.12.0-211.61.1.el10_2.aarch64.rpm 8e0b103440f2a8fe3f17a84419701ef0220ee0e289eab79614134aba6988bcfd kernel-devel-6.12.0-211.61.1.el10_2.aarch64.rpm 95078330ed8f43051c202a472d54aff9e3bad13910f6cd7ce097c5e885419aaa perf-6.12.0-211.61.1.el10_2.aarch64.rpm ae781cf01d38057f52a46786a300b7fff17cd7ee6b2fa4a267483107ca433d9d rtla-6.12.0-211.61.1.el10_2.aarch64.rpm b0f8032f53bf12221f82c020da4283ee2e89494c86f232574932089be530e2aa kernel-64k-debug-devel-6.12.0-211.61.1.el10_2.aarch64.rpm b1aa7bb7de32a129cbfba82490c40db755eba2222a7b28b233c9ebe09a9b043a python3-perf-6.12.0-211.61.1.el10_2.aarch64.rpm ca5c161d99ec791857ec67bf9741ecf77b90dbc081e8500660962bc0e7fffac4 kernel-64k-devel-matched-6.12.0-211.61.1.el10_2.aarch64.rpm fd9799ddb1f7e6fada5ab95718a299b8c537b8e22497861a9f0df7d98830a369 ALSA-2026:72785 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default rubygem-io-console-0.7.1-15.el10_2.aarch64.rpm 0882220ae9bbc8704daebdffd90c418409632b2fee303acade0338829ec0fe23 rubygem-irb-1.13.1-15.el10_2.noarch.rpm 109ed4ad1eaa45bf5dd31e4d43f1ae7d8d990a2c4d7eb7d161005b447b9cfc31 rubygems-3.5.22-15.el10_2.noarch.rpm 11349eba9345d9f2cc94bf421e58373e1d5458cbb9114f92d6b98d8207922418 ruby-devel-3.3.12-15.el10_2.aarch64.rpm 32d7d85361587908538580d463bffed6b8d2894fa09548a8f6721fe7ece47a74 rubygem-rbs-3.4.0-15.el10_2.aarch64.rpm 36efc5db787e75fd408b01480e4f23d3974fa831db5b3c7997c27f114bc37c4b rubygems-devel-3.5.22-15.el10_2.noarch.rpm 492612048da0e57f477983879982cb57b3eada4308202c6d3fee92d24838f1e5 rubygem-bigdecimal-3.1.5-15.el10_2.aarch64.rpm 51f703aa299f0703ff2af7654181de3f9c80a06aec844c7e6c50efb659196636 rubygem-json-2.7.2-15.el10_2.aarch64.rpm 53d3de10db4f547fbb8145488ed4a1199fb7884aaa330bc81d6ebdc56ee8f652 ruby-libs-3.3.12-15.el10_2.aarch64.rpm 5c7738b1a0889128dabd153305483a5c74ef8432eaf22db82f5a7a7c9e408c67 rubygem-rake-13.1.0-15.el10_2.noarch.rpm 6c4b9241ff9efa450aa5d3329a216aa37da225de270e1a5fe3f5f832b872e5ad rubygem-psych-5.1.2-15.el10_2.aarch64.rpm 79d30ef9d5418d287f4cbd2dc4ef40a4d5f6fe50e2afd17af75bb8ef9394969f rubygem-power_assert-2.0.3-15.el10_2.noarch.rpm 854289d012a71949ba1daef7ada1a60911e03ba7ba8676153267c548b6ad62e4 ruby-default-gems-3.3.12-15.el10_2.noarch.rpm 9155f150b9f91e2dafb16414991ca13c36df3f4aee6ca777ca785c0180a1f86e rubygem-minitest-5.20.0-15.el10_2.noarch.rpm 981707b75742760cc5c109ab99fa4285d4062bb296b498d5b21eb4ff7869c5fd rubygem-test-unit-3.6.1-15.el10_2.noarch.rpm 982aad6d4f946198793b11b68f74cc897cad5306f4398bac99c666a1c85bdf92 ruby-3.3.12-15.el10_2.aarch64.rpm 9845bb0e3bd79980e6579cf41a5872f1bc063125597e1579591bdde37d1ec3ae rubygem-typeprof-0.21.9-15.el10_2.noarch.rpm a685c24c2adbb428ee0cbfe323eb4e6a3c6c342892b6be21a0290944b16acf89 ruby-bundled-gems-3.3.12-15.el10_2.aarch64.rpm b856d8bafb82ac84adcbeffb0e43de6893a26abc2206729b972d71d1d3a5ffd4 rubygem-rdoc-6.6.3.1-15.el10_2.noarch.rpm da102fb3c095a3ec1f34f5f5a2ac9fd136e78f9fb8ae0ed3b5f70b5e93856125 rubygem-racc-1.7.3-15.el10_2.aarch64.rpm dbbfb5b468e251312fe0864112731c173619bb314219947336c1fb9c7ed7e5ef rubygem-rexml-3.4.4-15.el10_2.noarch.rpm e05b865f8e326502a6561acbfe24e18752a7487792d727bb1f7154f70d471abb rubygem-rss-0.3.1-15.el10_2.noarch.rpm f72093880d7151f2ac3049b0131eef30043c09b0a89c1ef075bae97585e288eb rubygem-bundler-2.5.22-15.el10_2.noarch.rpm ff78ada1e367ca1dff09e79265bf4cff6a89438532915087f337c77c7cd2923f ALSA-2026:73130 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) * thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639) * thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641) * thunderbird: One byte overflow read in mail parser (CVE-2026-84640) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031) * firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011) * firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028) * firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013) * firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012) * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014) * firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) * firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021) * firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008) * firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007) * firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029) * firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023) * thunderbird: Out-of-bounds read in IMAP response parser (CVE-2026-92240) * thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line (CVE-2026-92239) * thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers (CVE-2026-92238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default thunderbird-140.16.0-1.el10_2.alma.1.aarch64.rpm c117e902cbab13ceee707e2d5ae9f7c0b7d3629e0fb5a16a3f63988051d18493 ALSA-2026:73427 Copyright 2026 AlmaLinux OS 0 1 Important

gdb security update

The GNU Debugger (GDB) allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion and printing their data. Security Fix(es): * gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF (CVE-2026-13732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gdb-gdbserver-16.3-3.1.el10_2.aarch64.rpm 2ff1818e6c08740f4459d3d8bf9ff562e0a4866fe2951c4f90af9ef9b298c975 gdb-doc-16.3-3.1.el10_2.noarch.rpm 39dce27fc5099ec9272403ef4efccf67f2543fb0057041caf17d6dd68cc06eb9 gdb-minimal-16.3-3.1.el10_2.aarch64.rpm 5600dd85b3dd8f61914c16fa432eedb126da37f75b794429e337030676a1e502 gdb-headless-16.3-3.1.el10_2.aarch64.rpm 57ac37f4f6c731c08aa08b056c095be1f9587c792efc881138383d8ea1eacc61 gdb-16.3-3.1.el10_2.aarch64.rpm fe6c9988e781a8319d71984219edc4b8bf0ad7ed3bff0aaf50f74885e3d6620f ALSA-2026:73428 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs24-docs-24.21.0-1.el10_2.noarch.rpm 3c0582da0fa349b5c85a8671a5ccff46d1d89830e1e263672e2e93e4eb5161c5 nodejs24-full-i18n-24.21.0-1.el10_2.aarch64.rpm 7801c6e666ab708e902c62d610264eb43400a1374858445afaa601042b8f312c nodejs24-24.21.0-1.el10_2.aarch64.rpm 90585f81ad3a3373df1b3401743d4ffee865518485a67d1e0029964bcba85dc1 nodejs24-npm-11.19.0-1.24.21.0.1.el10_2.noarch.rpm c33582aee585c85053bce7f5822e3f7bccd46c315de9ed48e5522daeeeec7080 nodejs24-libs-24.21.0-1.el10_2.aarch64.rpm d1a7f724f7992879cf9eaa9822a107fc4945d30d8b9054cde5a538f177d4e1d7 nodejs24-devel-24.21.0-1.el10_2.aarch64.rpm f4a3cba3fb88d87950bed205f721bf15046808c38062b8e51db14aec52d0e010 ALSA-2026:73429 Copyright 2026 AlmaLinux OS 0 1 Moderate

gawk security update

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs. Security Fix(es): * gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468) * gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service (CVE-2026-40553) * gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gawk-all-langpacks-5.3.0-6.el10_2.1.aarch64.rpm bb22ed0287f42ca79f6fbc317f37376835e2ad983212e1f421b86e3a03f89d4c ALSA-2026:73765 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561) * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default idm-pki-java-11.9.0-5.el10_2.alma.1.noarch.rpm 0cdf052ebc4a0c8e950bbeca80d0f2c7c6760d139c66043c04ced088658411e4 idm-pki-ca-11.9.0-5.el10_2.alma.1.noarch.rpm 222cd95d6a7904a983de39241895dd9acb151c45c8a7491e9550adc37bd65352 idm-pki-base-11.9.0-5.el10_2.alma.1.noarch.rpm 582d387b6396d8e4e698857b48390f3d102d7ac512738e3cc874874c5c912711 idm-pki-tools-11.9.0-5.el10_2.alma.1.aarch64.rpm 5c75378835fa515066c83de8a1959beb73b79fea10f3d3caf7dbd8170329cddd idm-pki-server-11.9.0-5.el10_2.alma.1.noarch.rpm b0f00e34f7b8789bf4cf070694a5cd3513616af2667ab61700b8c68820ad419c idm-pki-acme-11.9.0-5.el10_2.alma.1.noarch.rpm b5bef02548113c0fa533f73999506eb0f9f5ed8060cc5870f5a024cfe04b38f8 python3-idm-pki-11.9.0-5.el10_2.alma.1.noarch.rpm df55263895dce79bb1709226dd320f18f208f120a85e935cfa2ab9bc787fdda0 idm-pki-kra-11.9.0-5.el10_2.alma.1.noarch.rpm e5fda389acc85e9115f766d485557babdcf49b10683904f1114a8015fcfe0ae7 ALSA-2026:73954 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay (CVE-2026-60001) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssh-askpass-9.9p1-28.el10_2.alma.1.aarch64.rpm 97686d76136b9ec90fa056a969307a864637c0c09c094dd56ca7b17fe91c0824 openssh-keysign-9.9p1-28.el10_2.alma.1.aarch64.rpm ef366fdbf894c71976aab84f5b96f441aa2d9d0da5991325eebeba36a8696d75 ALSA-2026:73979 Copyright 2026 AlmaLinux OS 0 1 Critical

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.13.aarch64.rpm 7daef08f82a7512653f9e8ea1a58638904307ee75b883650fb48fa3df3a98d96 freerdp-libs-3.10.3-12.el10_2.13.aarch64.rpm f184a1a1f22d087385005b92cd0a9c2eabf86ebfa0959b3765a15bc61654d3aa libwinpr-3.10.3-12.el10_2.13.aarch64.rpm f32b7dff01774be3f12415a4403b82cbd41bf686fbadb048d4f97478519ff92d ALSA-2026:73998 Copyright 2026 AlmaLinux OS 0 1 Important

gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer. Security Fix(es): * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268) * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gvfs-mtp-1.54.4-4.el10_2.1.aarch64.rpm 25f083d00c48be4dd5444af45bb40d2df701b9531c0fc577b82f9992393805f5 gvfs-client-1.54.4-4.el10_2.1.aarch64.rpm 29f50584004ddc0d57e396ca20a18c3ecd7c05b520f7a21cc1e94a52ecdff04f gvfs-1.54.4-4.el10_2.1.aarch64.rpm 2cff29f8902378fdf7427927dc0fc8695bd371858451da48ede962fe0ca00f06 gvfs-goa-1.54.4-4.el10_2.1.aarch64.rpm a145be318c2cdd62f38a7a3517cd2ce05bf050713031ce39a05e9331ace2ffd5 gvfs-smb-1.54.4-4.el10_2.1.aarch64.rpm ae50f0f79c44feca31d089cb9da77f50e74d78306eba5a420bf96720a3518967 gvfs-fuse-1.54.4-4.el10_2.1.aarch64.rpm c5201ef6a43fae189a432b50507226ab190ab3996dabb3c1abefb1be298fe920 gvfs-gphoto2-1.54.4-4.el10_2.1.aarch64.rpm dc70d730b49332d090b8ccf681835b7ecc7e7041a1356bd328dee861d6580945 ALSA-2026:74001 Copyright 2026 AlmaLinux OS 0 1 Important

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046) * expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.5.aarch64.rpm 5447040fb05a0dc0bf3bb1ad3c660c6336bd4e2e23541651d7c2af4b00c28fae ALSA-2026:74464 Copyright 2026 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default ghostscript-10.02.1-16.el10_2.1.aarch64.rpm 5802ac306430c40ceb9add2dfd4b9e139dba5423438d957bf9a0f34bc9a99d4d ghostscript-doc-10.02.1-16.el10_2.1.noarch.rpm 617175f855bb442ae2b330cea4f12398f5b091a7d462994c072769221b20c59e ghostscript-tools-fonts-10.02.1-16.el10_2.1.noarch.rpm afeee0186e3b8fc2a1465593bc73b907e5983363ee869023e04bdc397fa74493 ghostscript-tools-printing-10.02.1-16.el10_2.1.noarch.rpm c49fc8445ae5065659355a423f7eff2b5067e08b45ae02b7062620618b3b5cb2 libgs-10.02.1-16.el10_2.1.aarch64.rpm e1ed48fa891859ddb1303432af862db96c500e5c56a310235a1ff9d813fb140d ALSA-2026:75570 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089) * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) * FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) * FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947) * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950) * FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960) * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.14.aarch64.rpm 06977562df0bdc4f404fb309518b2ceeae5de60322303d6253d1587feba95a90 freerdp-libs-3.10.3-12.el10_2.14.aarch64.rpm 50dd7ef6804b664f59397efc9ee9cccc073c0e56cca0c5b8d0791b5490ecf9d0 libwinpr-3.10.3-12.el10_2.14.aarch64.rpm faa4e0cd66ede292f59a944252b259a0c1648b9a5c79e52521933fe6dd548079 ALSA-2026:75576 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099) Bug Fix(es) and Enhancement(s): * gve: backport large queue depth patches [almalinux-10.2.z] (JIRA:AlmaLinux-219261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.62.1.el10_2.aarch64.rpm 0caa1f892d76cb1e066f6cccfec3e40894dfb4e4a79ae48adb054573f1eb3098 kernel-debug-devel-6.12.0-211.62.1.el10_2.aarch64.rpm 1e124881626d6198fab4f4e164e1666a57eace967be5c123d5cabf8028cb495c kernel-devel-matched-6.12.0-211.62.1.el10_2.aarch64.rpm 2943932b8654af66d5d418cd39c3f1a6e275e36014b19ccf5cbd613af7a29c5e kernel-headers-6.12.0-211.62.1.el10_2.aarch64.rpm 4403951d522f8f7051c0be43d98f95c2f502e0911730ed15ee635a3d8f7b4055 kernel-doc-6.12.0-211.62.1.el10_2.noarch.rpm 4651096af1f2c0d1dadca18c541eee91d0617eff4471a68b40d10def0058f9c3 kernel-64k-devel-6.12.0-211.62.1.el10_2.aarch64.rpm 4e8ad519b6773435e3a6dcd59903422867ea4e74e44681404fa6270a775a4526 rtla-6.12.0-211.62.1.el10_2.aarch64.rpm 57bbf678948e2a9b32830fe5045c6a9ee8a30ece44e4ceca8751ed38ddb3e18a kernel-64k-devel-matched-6.12.0-211.62.1.el10_2.aarch64.rpm 766a413600250e288c4dc781cb8cc4925de594e5cc70a50c36d66c53b0583df7 python3-perf-6.12.0-211.62.1.el10_2.aarch64.rpm 9b9c3b3c0e911ad5a2ab7e9065e6a7458df4d5daf7546b892887ed15eca6984d kernel-64k-debug-devel-6.12.0-211.62.1.el10_2.aarch64.rpm b966bcff26ca26006958a68beabbf98783b5d606d3109a789265852a01621863 kernel-64k-debug-devel-matched-6.12.0-211.62.1.el10_2.aarch64.rpm c75a7df6ff96ba69c80bedc2802e3146af21344aa20dd1fce57208f5c0d6bc65 rv-6.12.0-211.62.1.el10_2.aarch64.rpm c80c9c7117b02d2c0fa74c0822f4aaad5bed634ebfae5565620d4709e269fb3a perf-6.12.0-211.62.1.el10_2.aarch64.rpm f61504ef9222026719c68fd19438c99b2189feb14d850478be496e22394ed8d7 kernel-debug-devel-matched-6.12.0-211.62.1.el10_2.aarch64.rpm fb847a500b75e7013a61e89f53905c155f065d08f83c6634ce75a632d0b046ec ALSA-2026:75577 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736) * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default bind-9.18.33-15.el10_2.12.aarch64.rpm 3b3c21669141623cd7395a21cbf64cf11a8209aea442835b0644d039072bf5f6 bind-libs-9.18.33-15.el10_2.12.aarch64.rpm 3cf985569aadfb5e34936e6057f5edf5a63445e3e2e1a641e32d227e214e70e6 bind-dnssec-utils-9.18.33-15.el10_2.12.aarch64.rpm 65e72e74670434112a2257912db207edc40fac85ad7dad0eb388ad55a7157426 bind-utils-9.18.33-15.el10_2.12.aarch64.rpm 76c0095ee2bac8de2830529afc46e391914145f1033f6096f02d8a309150fa41 bind-license-9.18.33-15.el10_2.12.noarch.rpm cf3c504a9857ffd2222e1db77e1c60344ac788c5662696ad6ef92bbac52bdf0b bind-chroot-9.18.33-15.el10_2.12.aarch64.rpm e8aeeed1122974ee7f28cf8221a265ba01f7e63257dc8c6c89de050af236db34 ALSA-2026:75579 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-10.p2.el10_2.7.aarch64.rpm cddeb2aa376046c28129cd3d4146fe9222477a42e77ac018dbf0a479e1a7b717 ALSA-2026:75581 Copyright 2026 AlmaLinux OS 0 1 Important

mod_auth_openidc security update

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mod_auth_openidc-2.4.16.11-1.el10_2.1.aarch64.rpm c11e84983fb23d89d1544ea53509d81da32d91257e8d9380f0f2a945c02f5b3c ALSA-2026:75583 Copyright 2026 AlmaLinux OS 0 1 Important

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622) * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917) Bug Fix(es) and Enhancement(s): * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-10.2.z] (JIRA:AlmaLinux-186019) * virsh dumpxml missing one SCSI disk when VMware VM has 64 disks per controller [almalinux-10.2.z] (JIRA:AlmaLinux-191267) * libvirt-guests does not work together with virtlockd on shutdown [almalinux-10.2.z] (JIRA:AlmaLinux-224982) * Expose guest-get-devices in libvirt-api [almalinux-10.2.z] (JIRA:AlmaLinux-243305) * allow hyperv pvpanic "device" to process Windows crash dump [almalinux-10.2.z] (JIRA:AlmaLinux-242547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libvirt-daemon-driver-nwfilter-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 0045e1eedd9dc6a0ba3d8b8af0ad3048fd91908321960ec75d6ea19627eae291 libvirt-daemon-driver-secret-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 030d42b289fd280982d1dfd080855691447a2287a7039e9a6368fa85c63ada1e libvirt-nss-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 09204336fee684373110911d277360035808448b148857077e388d05150cac50 libvirt-daemon-config-nwfilter-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 12ab6552c2665ad778b6ab217668c79c14286586cb600d4214a7635023a75e1a libvirt-daemon-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 15ba0d159a6a7b106d6c0ea27077baa84e125078fcec1f71a9cdc870ca74ed45 libvirt-libs-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 229a9ebd86d34dde7ebde8f8877fbbbc5e1ea87d1d079375c1833d685f2b5f55 libvirt-ssh-proxy-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 31802947ae833c4adb7ca24ec236a2d8434fa750340f146325b1e256400d2148 libvirt-daemon-common-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 52932370a34b2cf1046cb2835fd721020800044442ee512ae4c92f47a5e628e6 libvirt-daemon-driver-storage-scsi-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 56e8367045cb9591d6df4ef58fa367c3f6708b5ba49584036f2deac911be41c2 libvirt-client-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 68ab4859c9fb189f994653366871568daaec3b6ac73dc099cc2e07fb7839a810 libvirt-daemon-config-network-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 7e8af7fce93b39a6c39290f336f6c7d824aed9219abd54e8ade3d0420fe1e0b4 libvirt-daemon-driver-interface-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 823ef403f3e349e9e415be31fb559b83f222fc847c1e45df62eb55853ac41a7d libvirt-daemon-driver-storage-mpath-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 8397469fa8486ad03be26c679f065ef2959f649f9f3468ac1414d8243663d79a libvirt-daemon-proxy-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 841050780eba3a59fa806a19aad9ef8321b7a91a5f7f83a90606d35ef7afb10c libvirt-daemon-log-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 919781cf29d7aaea2ea9614f654d8d08c92efb8fded3e8eede5e9e4cc3c7e225 libvirt-daemon-driver-storage-core-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 99771adac3402c5429e00d9e6f0999079e7bd5007ed6807205a0f046c88cf8e2 libvirt-daemon-plugin-lockd-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 9c8f957b87e384bd077d4ff66d2bae3f5fc433b984bdda337db0fea4e41eb2c8 libvirt-daemon-driver-storage-iscsi-11.10.0-12.9.el10_2.alma.1.aarch64.rpm 9f18bae5badc2a9e8ac1dcda17aae04fdab87e355526ee9738d6b8e36ba70180 libvirt-11.10.0-12.9.el10_2.alma.1.aarch64.rpm b14b57970483b66b97c0c78df64a7dd231944b3be47c3a6f36ecfa0e17cb9597 libvirt-daemon-driver-storage-disk-11.10.0-12.9.el10_2.alma.1.aarch64.rpm bd230a435e9a33397ba3adbe5411bc2e8c91272706511bec4785e17bcb9c007d libvirt-daemon-driver-network-11.10.0-12.9.el10_2.alma.1.aarch64.rpm c323ff511518243fc97517a40c713eb97e331db91c19b1d3b0851a2cd8920008 libvirt-daemon-driver-storage-11.10.0-12.9.el10_2.alma.1.aarch64.rpm c6126ac9ebc6cea1feb9cc879518fae1aa4da50f5c7e0db3700e535f87b5dcf7 libvirt-daemon-kvm-11.10.0-12.9.el10_2.alma.1.aarch64.rpm c8f395ae97a487109acd2bad6584e4e3a98068258646c2252fe2e3e99dcd0755 libvirt-daemon-lock-11.10.0-12.9.el10_2.alma.1.aarch64.rpm d21830bce8fdd35884c2021553be4a4180dcf18484fa6a0b0d214415b804dfdf libvirt-daemon-driver-qemu-11.10.0-12.9.el10_2.alma.1.aarch64.rpm df346ce4cd3d5d9b3c78800b3c1f1badccd81b6808625aa490c702f01340dad7 libvirt-daemon-driver-storage-rbd-11.10.0-12.9.el10_2.alma.1.aarch64.rpm e8cf3f598bba5ca60329d389a170cb70e94ae6b5540343ac33d37501cf2599b8 libvirt-client-qemu-11.10.0-12.9.el10_2.alma.1.aarch64.rpm e978a4b1c03502443da062398ab9e5ca1a2642b1f52641f6005c41a2e347da16 libvirt-daemon-driver-storage-logical-11.10.0-12.9.el10_2.alma.1.aarch64.rpm f3aff17c063c56cba4f6ec9564b06701bcd4847f5b4fa1a138c95fb2bab70fd0 libvirt-daemon-driver-nodedev-11.10.0-12.9.el10_2.alma.1.aarch64.rpm f86a8e10304749d670891f585ecc9a59a5c6398ba8ea79c7af4f0f1f0ab935df ALSA-2026:75769 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-73073) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default vim-common-9.1.083-9.el10_2.22.aarch64.rpm 0d4f3e2c7088124181c74cd774f5048b64f2664ebd75e32d77b5d51f72d45258 xxd-9.1.083-9.el10_2.22.aarch64.rpm 4c31a6463f6131673105af1983481a449e4ffe97612c797648cf2087a2270a91 vim-enhanced-9.1.083-9.el10_2.22.aarch64.rpm 88dbb9e8b49eccdcecc8c2a616e104241647ebeb8862247a11967283050590be vim-X11-9.1.083-9.el10_2.22.aarch64.rpm f53ff8e16f5bd6c9cd5d549678da98bf2f96d93d986a4cb46ae7e6831f52a486 ALSA-2026:75864 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default nodejs-22.23.2-3.el10_2.aarch64.rpm 1a4a7fa6ebfdb25f7d1dd8009c2fbb4ac7c16ccf1de5e69196e5ac46c040645f nodejs-docs-22.23.2-3.el10_2.noarch.rpm 214fba9be3d9a6ef94f9450d61364b06af4c6aa7e8bf11fcc46229596bed6a07 nodejs-devel-22.23.2-3.el10_2.aarch64.rpm 266364e849d0a46457610c31bcfa6d2f58e54685c4aabadb2bce626741204bac nodejs-full-i18n-22.23.2-3.el10_2.aarch64.rpm 33b5700e9b2260fda63f209e45dedd469610a5709291f2412a3ccf2c2744d508 nodejs-npm-10.9.8-1.22.23.2.3.el10_2.aarch64.rpm 54068d320825bfd3177544be30d1d66b264141da7a840bce81be71b3c3988d8b nodejs-libs-22.23.2-3.el10_2.aarch64.rpm e0eee12c4bb3baa58dadc5207f45d95ce0f14e9c8cd61e3dc4dd9752299e3021 ALSA-2026:76735 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sqv security update

A simple OpenPGP signature verification program. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default sequoia-sqv-1.3.0.2-1.el10_2.aarch64.rpm 5ccf0f82b66c7ac38ebe7a407b173d53fc586cf06ab51375de89403477aa3095 ALSA-2026:76737 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sq security, bug fix, and enhancement update

Command-line frontends for Sequoia. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) Bug Fix(es) and Enhancement(s): * Unbundle capnproto from sequoia-sq [almalinux-10.2.z] (JIRA:AlmaLinux-177547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default sequoia-sq-1.4.0.1-2.el10_2.aarch64.rpm 557be66131eeab45438f63eb9349e09731ffddbc26fd5053ac606f94d7433a05 ALSA-2026:76738 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860) * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270) * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357) * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992) * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994) * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078) * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132) * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557) * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255) * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516) * kernel: packet: use consistent hard_header_len in non-ring send paths () * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582) * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775) * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921) * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972) * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227) * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) Bug Fix(es) and Enhancement(s): * wifi card breaks using FIPS (JIRA:AlmaLinux-257457) * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-devel-matched-6.12.0-211.63.1.el10_2.aarch64.rpm 059a2bba99a2fd296a6e8bdba0a15214c0119440690e31218a4b31fa7853938d kernel-64k-debug-devel-matched-6.12.0-211.63.1.el10_2.aarch64.rpm 4b62fea991d8429bf76d6cc6c7fc08c9523541e8d6cae7c00e017a00c9b8da5c kernel-doc-6.12.0-211.63.1.el10_2.noarch.rpm 4e40163bf75706368e25c8afc3979c308c7fb0ca59fb79c24d6c10fe3130f8f9 perf-6.12.0-211.63.1.el10_2.aarch64.rpm 574f75e51f9f3c5c9c113196804b47f0b3ddb566403aa7c5aec6a850e418fcb1 kernel-devel-6.12.0-211.63.1.el10_2.aarch64.rpm 5b17a50b36aadf698a91bd5baf0bebecfeb4a10ef60504593320d8b5106f5aad kernel-headers-6.12.0-211.63.1.el10_2.aarch64.rpm 61cc195aa4f4fb75ac8cc1890a7e5ac4f3c6c990c7a4616e016e5bf5d94b6b64 rv-6.12.0-211.63.1.el10_2.aarch64.rpm 7693025018403833b01e13398e2973147732309310ac0cd378eee33b5abd861f kernel-devel-matched-6.12.0-211.63.1.el10_2.aarch64.rpm a231d7c99e14f76ff03dab307a2e5bbfdfc6b5a90a78fbc9c5bb1f90490d1c6c rtla-6.12.0-211.63.1.el10_2.aarch64.rpm ac4b01300040cf6b26a74a2d52eb2a3d3813d06b28e08d4e4b036ec693a46a92 kernel-64k-devel-6.12.0-211.63.1.el10_2.aarch64.rpm be4fa0cdbbff92d9910f5b83dcf0917efc3e66a543a3a562629bbb23b255af67 python3-perf-6.12.0-211.63.1.el10_2.aarch64.rpm c4028e71de8d6295acbeef825214a9aac0be9cd3ea2615c0d7d11327f1f3e648 kernel-debug-devel-matched-6.12.0-211.63.1.el10_2.aarch64.rpm c611aba4ac775af5977d9dade6c83389d78bffd18ad18d2c59b36b89f682fcd4 kernel-64k-debug-devel-6.12.0-211.63.1.el10_2.aarch64.rpm d92d91855be621eda434378bee5ec1b535139c0eff02e7b5e72811f37937b824 kernel-debug-devel-6.12.0-211.63.1.el10_2.aarch64.rpm e14d8f1289603da80570ef6ecba7ea838cc2d8bd5b3b9b5a1e8b0e99861eaf51 ALSA-2026:76743 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests (CVE-2026-84445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default opentelemetry-collector-0.158.0-1.el10_2.aarch64.rpm 8a4a4f3a9593eaa83d92b404ba75ee166aed44b3f828e60c6c4ed6e41e29db13 ALSA-2026:76762 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.7.aarch64.rpm 8ae7067568352429100095f6a6fb0485d01e169982fb18659300fa6ce50b177a ALSA-2026:76781 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368) * glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791) * glibc: Buffer Overflow in strfmon right-justification padding (CVE-2026-19499) * glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542) Bug Fix(es) and Enhancement(s): * The iconv utility no longer returns exit status 1 after a successful //TRANSLIT transliteration * A counter overflow in __wcsmbs_clone_conv that occurred when setlocale was called has been fixed * A fcntl.h header conflict when compiling on AlmaLinux 10 has been resolved * Minor documentation improvements have been picked up from upstream For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glibc-utils-2.39-142.el10_2.alma.1.aarch64.rpm 4abe0e4f5204e04aae5d29a5fb167c771a0ac545dedd3a6cd0126be4058da38c glibc-devel-2.39-142.el10_2.alma.1.aarch64.rpm 4faee2a4c0e6b8f22f0f61e97db0f0d3c65535ea54fc6c76f55ff65b10aebc79 glibc-doc-2.39-142.el10_2.alma.1.noarch.rpm 9ff671a257df14b19f73a58d114b8b73bcc77d16d5944e412b42babfd68bffd5 glibc-locale-source-2.39-142.el10_2.alma.1.aarch64.rpm e5a45b54bd88f537ca3de233c82e21e17af26b0b09068c8c249972cb847cf83b ALSA-2026:76918 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssl-devel-3.5.8-2.el10_2.alma.1.aarch64.rpm 2497e6e0e5226e85d0344c459f2bc7f598d84a1ef982a33e5b71195d58dd4021 openssl-perl-3.5.8-2.el10_2.alma.1.aarch64.rpm c43884af37d41d76678442dfd6cfe310380f1ab15924907ada92e20bd0a71525 ALSA-2026:77018 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3.14-libs-3.14.8-1.el10_2.aarch64.rpm 1c98c00f1443436b6a10c297f8589caf5a17e184dc58413f1e6dfd47b0fa6f41 python3.14-tkinter-3.14.8-1.el10_2.aarch64.rpm 7343a011a786cb2dab2011bd16d9937af91cc931c8e69837f2a4436ce63252af python3.14-3.14.8-1.el10_2.aarch64.rpm 739b6fa1ded7a59aee819332f67c707b504047d11bd20b5f69be2f9f3b253143 python3.14-devel-3.14.8-1.el10_2.aarch64.rpm e669a5cd23ad0f170b0a6add514facda22be5de4b66ee6da0bb0f48cf5e6df81 ALSA-2026:77020 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-devel-3.12.15-1.el10_2.aarch64.rpm 5e06806b095ff11a0f9be14578436e98e6b0c45168f706e7b07a83899b79aeec python-unversioned-command-3.12.15-1.el10_2.noarch.rpm 8c7ff57dbefad31a537c80cf34212f88d1136e20c2922150444565e58eb8d223 python3-tkinter-3.12.15-1.el10_2.aarch64.rpm d9a845fc616df2454a48b8fccb680bb53251c8db4d37c0e202f61996e6313005 ALSA-2026:77534 Copyright 2026 AlmaLinux OS 0 1 Moderate

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation (CVE-2026-87853) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default sssd-idp-2.12.0-3.el10_2.2.aarch64.rpm 240518b2935dd4d7961369af1b276f3dacd1d66224f0282e38ae8bfa216ed847 ALSA-2026:77648 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default idm-pki-base-11.9.0-6.el10_2.alma.1.noarch.rpm 08cad358e01aeaea12f186ece0391cb7e0364ef41ceeff79643cc2483d3f898a idm-pki-ca-11.9.0-6.el10_2.alma.1.noarch.rpm 29d3862dababdb52efd6b9b8d0372dc5651d36ee8ddf03be663bce826f8057f7 idm-pki-acme-11.9.0-6.el10_2.alma.1.noarch.rpm 7f0b192b8db647fca321e71a6b228288db085e67440a44ed2a3b091c5afc2756 idm-pki-kra-11.9.0-6.el10_2.alma.1.noarch.rpm 980108ca4a2ba723015accc088c6d78c8156b9f1376730f10dcb357a939fa7b6 python3-idm-pki-11.9.0-6.el10_2.alma.1.noarch.rpm d22e7c708f2b9d42c11a0567e3ec0d29b0d6c46728b35bb961574ffc6c76b8d2 idm-pki-tools-11.9.0-6.el10_2.alma.1.aarch64.rpm d4d42b11ef524e680a7e8e69af8aebf2da7a75d7c833de8f29d8396427178652 idm-pki-java-11.9.0-6.el10_2.alma.1.noarch.rpm e127ae2fe0297a6c06dbbd9e5f26fe945b6221de37834b8e268f77e123acb422 idm-pki-server-11.9.0-6.el10_2.alma.1.noarch.rpm e3e12ed856ec63faff76d4dccd1667fa768ec21c075cca9878222449ea115cbc ALSA-2026:77690 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103) * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360) * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365) * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398) * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970) * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035) * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115) * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744) * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690) * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669) * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530) * kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (CVE-2026-89676) * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663) * kernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675) Bug Fix(es) and Enhancement(s): * mlxbf_bootctl: driver update to Linux v6.16 [Nvidia 10.2.z FEAT] (JIRA:AlmaLinux-212709) * [GNR-D] missing interfaces tspll_cfg [almalinux-10.2] (JIRA:AlmaLinux-273805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perf-6.12.0-211.64.1.el10_2.aarch64.rpm 1c9c666b01d0dacbe9d378eafba55ae7efe77986568646a2e6187b4f0750fd34 kernel-devel-matched-6.12.0-211.64.1.el10_2.aarch64.rpm 4f0fee4d98562aed578ad006ac2299ed64e3238aaba43a22f61823465131948b python3-perf-6.12.0-211.64.1.el10_2.aarch64.rpm 4f198a5a55caa69b0a924d4cecb2b19bd6677da37377f48c77b3b4d202899e95 kernel-debug-devel-matched-6.12.0-211.64.1.el10_2.aarch64.rpm 5e0301288c416ac58968fe6ed339a1e528473997861bb3d99c47596bd3a2be07 kernel-devel-6.12.0-211.64.1.el10_2.aarch64.rpm 66a70d1766d7c51687843788443236d9273b9d285af0f23ad22859f5e1a27a4f kernel-64k-devel-matched-6.12.0-211.64.1.el10_2.aarch64.rpm 805cdf470c676d710f4fabefc6f7e041a1b774b0bf67766e0b86e8c4b730cd29 kernel-headers-6.12.0-211.64.1.el10_2.aarch64.rpm 90f538934a7bdd204cd6f5a22ac642ebdee6367a0371a40e5be92e63f31aec87 kernel-64k-debug-devel-matched-6.12.0-211.64.1.el10_2.aarch64.rpm 9a5574c0b21de532185af2c7701e3e072a7eca34e9f1fb72a4a33bda41b135a7 kernel-debug-devel-6.12.0-211.64.1.el10_2.aarch64.rpm a65badc2166edba43e26cdb0ec4d5c435535a7998a32759170dcd0db09558ecf kernel-64k-devel-6.12.0-211.64.1.el10_2.aarch64.rpm a82fc867526c2ae244cdd3322113b80660c2e7560673143ba91af99666ad1291 kernel-doc-6.12.0-211.64.1.el10_2.noarch.rpm acf673cac34caad11b9a79021df322d42655a2b4d8c23977bfc8bd93706609ff rv-6.12.0-211.64.1.el10_2.aarch64.rpm b464819755b0d7cce08174e118ee2e9ab26ecc648be90725d96ac61c7a3792ec rtla-6.12.0-211.64.1.el10_2.aarch64.rpm e36b874cb7b96a8dafd9fc477a7d98a4ddc2c1bd3b4e48b4045c12f616c97b84 kernel-64k-debug-devel-6.12.0-211.64.1.el10_2.aarch64.rpm e4114392d28802f3f7c6dbe1ce823bea262d77d72616f31ec14d5b13b8b42d0d ALSA-2026:79122 Copyright 2026 AlmaLinux OS 0 1 Important

cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default cjose-0.6.2.2-7.el10_2.1.aarch64.rpm 9afff3b2fe86ddc817c6b170ba5ede51c50e0bcca830656ac6b3e544ccdba3b1 ALSA-2026:79371 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dovecot-pigeonhole-2.3.21-19.el10_2.8.aarch64.rpm 37b1c7324ce0b120688734871b5fb637975668c290ec2160db0b45082822f856 dovecot-pgsql-2.3.21-19.el10_2.8.aarch64.rpm 427ce1ffd2d665200a34a0a33d534e971b81107c900d055141f8fcc648342a82 dovecot-mysql-2.3.21-19.el10_2.8.aarch64.rpm 8d16fefee4779dd96f144ccaa6e4dc6ce9a5265be65507699f626a01d0e15ee6 dovecot-2.3.21-19.el10_2.8.aarch64.rpm d668daf1ed181970cf56d6111ba64e13e9250ca39b08e046deaadc789794c5cf ALSA-2026:80495 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es): * flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default flatpak-builder-1.4.4-1.el10_2.1.aarch64.rpm acedfc5fe74373deeecac6bb00b5fb5d97839e4a3678bfa34cce39defbfdb2c9 ALSA-2026:80498 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275) * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default flatpak-selinux-1.16.0-9.el10_2.4.noarch.rpm 172e1711504e739522ae1206e914d28afb7a6412e2819c17a2f06a084ed5aec3 flatpak-session-helper-1.16.0-9.el10_2.4.aarch64.rpm 79ddb4a39566a98c83e51a32cd7f8ec42793d549749d6245db2be1de01b85cd4 flatpak-1.16.0-9.el10_2.4.aarch64.rpm d0c57a6d7fffa26c2577a31ab8712245e41b79f206c1b2b0bf25a45587adb89d flatpak-libs-1.16.0-9.el10_2.4.aarch64.rpm df6f98e184fa4be68af2226e05efb9785cd8be2f32b33a6c43d36a022023547b ALSA-2026:80512 Copyright 2026 AlmaLinux OS 0 1 Moderate

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253) * curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545) * curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429) * curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168) * libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.7.aarch64.rpm 1e279b916bc0fbb05916f66a920b55e0329dcff97c5a028503b6df8e6d3f6b25 ALSA-2026:80605 Copyright 2026 AlmaLinux OS 0 1 Critical

cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default cjose-0.6.2.2-7.el10_2.2.aarch64.rpm ca8d254eba46ca66faf9c76a17ba2ec8b5f9740758800d24ccf445e52171e9c8 ALSA-2026:81406 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332) * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385) * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508) * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507) * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123) * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521) * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970) Bug Fix(es) and Enhancement(s): * net/tls backports for 10.2 (JIRA:AlmaLinux-275027) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-debug-devel-6.12.0-211.65.1.el10_2.aarch64.rpm 09a02ec893f24f91add601611dd6328c235863223ed657d61b60c621bc1287c7 rv-6.12.0-211.65.1.el10_2.aarch64.rpm 0e3d629c23b8e9473f1497f25f4d69a90c14d3bf23abe509c84f622ed162d436 kernel-64k-devel-matched-6.12.0-211.65.1.el10_2.aarch64.rpm 31d4dde4d337ac959c267711ff574b7abb1379b9dc825fa8e1e10d10b65e79e0 kernel-devel-matched-6.12.0-211.65.1.el10_2.aarch64.rpm 36f433a3198091c200e7edac973da499acbbe920de952ad6ff46f021547a276a kernel-devel-6.12.0-211.65.1.el10_2.aarch64.rpm 431c49eb1f792949fade11a6f0f1a1fd74a3b986b665dc4701fcbe9475842039 python3-perf-6.12.0-211.65.1.el10_2.aarch64.rpm 5c60a8aa4be3c330d92ba386072fe16ea9e536cff111978c1b416b51081a94f4 kernel-debug-devel-6.12.0-211.65.1.el10_2.aarch64.rpm 791f7222864e69d865520aaeb146bb7e1f0eeb5649cbdf6c478a710604f0145b perf-6.12.0-211.65.1.el10_2.aarch64.rpm 80217a9553de4df1c03008ffb7b9a5af821f674f166f5c4b9c98fc6ba89d76de kernel-doc-6.12.0-211.65.1.el10_2.noarch.rpm b35f6a677826f22ce14c1a40eace7076869d953b08049e8332f8de56535432ee kernel-debug-devel-matched-6.12.0-211.65.1.el10_2.aarch64.rpm c538c42bba6ad5692c81b9fc2dfc2a06c3203cedc48123e1b605d81f7348d00f kernel-64k-devel-6.12.0-211.65.1.el10_2.aarch64.rpm d9f3ead3f021577e1186651437f4fafe181553fb3ccda2158d5bbcb8af60bc76 kernel-headers-6.12.0-211.65.1.el10_2.aarch64.rpm e423fedc197c3293ed6daad6086e865fb4ebe76d97d1747536bf0907df5c1ff5 rtla-6.12.0-211.65.1.el10_2.aarch64.rpm ec1840ef2b0bfda483f3673e4d1041aa3e167a811da63a2ba1c43c38880bc886 kernel-64k-debug-devel-matched-6.12.0-211.65.1.el10_2.aarch64.rpm f9f1e767903b641d8946b8c15e66515ea7910b02ed950eed5496b14d6274b201 ALSA-2026:81518 Copyright 2026 AlmaLinux OS 0 1 Important

gd security update

GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats. Security Fix(es): * libgd: buffer overflow when processing specially crafted GIF file (CVE-2026-9672) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default gd-devel-2.3.3-20.el10_2.1.aarch64.rpm 5b2cadf3b2c4bcf45d0a549365d090ccc7249b1f8a9f7c1cde5c8b89522ddbf2 gd-2.3.3-20.el10_2.1.aarch64.rpm a38e35225b019f8a8f90d3d1cc3c082b50c877c23111c997b3b6687b3476c542 ALSA-2026:81522 Copyright 2026 AlmaLinux OS 0 1 Important

pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback (CVE-2026-89156) * pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157) * pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching (CVE-2026-89160) * PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default pcre2-devel-10.44-1.5.el10_2.aarch64.rpm 2a0fcf80e0c205444767a29d81052952bd3836cd11487b0e8aa67fc9921eab99 pcre2-utf32-10.44-1.5.el10_2.aarch64.rpm 2f05d4ea20db78164b5c399731eb90a7375bf430455c6ed3789601f33907fce4 pcre2-utf16-10.44-1.5.el10_2.aarch64.rpm e4b2939734a79ece2652b2c297cea619ddb97955bf397a36ba9a6f31057a52d3 ALSA-2026:82041 Copyright 2026 AlmaLinux OS 0 1 Important

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient (CVE-2026-103262) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-tornado-6.5.10-1.el10_2.1.aarch64.rpm 83817896619c5691a4d598bc027805974e2fc694c85ee480780b1996592e23f1 ALSA-2026:82280 Copyright 2026 AlmaLinux OS 0 1 Moderate

tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine. Security Fix(es): * tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default tftp-server-5.2-50.el10_2.aarch64.rpm 01db45eae15e3e453fec52b33071640249baf7b979f9bb4fc685138307747b90 tftp-5.2-50.el10_2.aarch64.rpm 762277cef69d0f12535996ffa4debe8fdc45106a6e8f460ea59482e21b678c7e ALSA-2026:82883 Copyright 2026 AlmaLinux OS 0 1 Important

hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023) * hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098) * hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097) * hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100) * hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104) * hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105) * HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102) Bug Fix(es) and Enhancement(s): * [IMAGE-MODE] missing /var/lib/hp on image-mode [almalinux-10] (JIRA:AlmaLinux-266547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default hplip-libs-3.26.6-1.el10_2.3.aarch64.rpm 4b4514c145cb41addcab97a13a2699ce9d8ce6e13fa60d49dd7b39277e65b549 hplip-3.26.6-1.el10_2.3.aarch64.rpm aefe8696e510f9d3412177c1590e83dabc1b38c9557922f1e30ae65579f97db9 hplip-common-3.26.6-1.el10_2.3.aarch64.rpm b97ff51da48c8449eeb8fa5328f5cc15ebe024feafc329da75534348a53d9ec8 libsane-hpaio-3.26.6-1.el10_2.3.aarch64.rpm cedeff2d05f6de52a177c7cd4840db6e4db2984690aa0fc89fc5f3fb867a28d7 ALSA-2026:83207 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859) * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319) * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030) * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974) * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162) * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262) * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574) * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641) * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985) * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526) * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689) * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036) * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894) * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207) * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228) Bug Fix(es) and Enhancement(s): * cannot use VFs of i40e/ice NIC in bond device (JIRA:AlmaLinux-143410) * ionic: commit backported to 9.8 missing in 10.2 (JIRA:AlmaLinux-165657) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default kernel-64k-debug-devel-6.12.0-211.66.1.el10_2.aarch64.rpm 119ee6638c378a442ef48571e424aacb25771d701e4d375e34065c5fa3f282bf kernel-devel-6.12.0-211.66.1.el10_2.aarch64.rpm 1583a0beac7b1fe21399538df745ea9762de813d855d7144b3e4f4aa1c3f39d3 rtla-6.12.0-211.66.1.el10_2.aarch64.rpm 23f7899535c3012ea2cf4e9bf3dc96e585c94604a791ed8d23fffb7977e6b45d perf-6.12.0-211.66.1.el10_2.aarch64.rpm 2cf5c95b9e8b5af156f4b229fcf7c996d64ce016127913fa8241e6b8c8a739c3 kernel-debug-devel-matched-6.12.0-211.66.1.el10_2.aarch64.rpm 3138594675c67320ad3097a445fd82035bbce027171c12602a82e22902bfb07b kernel-devel-matched-6.12.0-211.66.1.el10_2.aarch64.rpm 31fa90782d87e7d95681565b9c3242678eb83e1bbf2f38207b3cbebd1581f824 python3-perf-6.12.0-211.66.1.el10_2.aarch64.rpm 3387776c97457a358f22fb1c56006ad755dfd2ba6e0207d30d20f4a9b199a166 kernel-64k-devel-6.12.0-211.66.1.el10_2.aarch64.rpm 4edb04566583147a574531fd15eeb709017a286c7045f56040765c177afe277b rv-6.12.0-211.66.1.el10_2.aarch64.rpm 5676128675082f8cd19faadd6250b4dff7f06c55ff170d07eaf3ffe82a15c5e3 kernel-64k-debug-devel-matched-6.12.0-211.66.1.el10_2.aarch64.rpm 578a7be52ba4da95d69131b473405b9f543c013754e7a25e456b623bf772cc05 kernel-doc-6.12.0-211.66.1.el10_2.noarch.rpm 6f301a5976e15068aa2b07d6ae8075aff2544160af41ef58a535c64c538e8b53 kernel-headers-6.12.0-211.66.1.el10_2.aarch64.rpm a025e6092fa988ddcaf819c31b9dba941aa64eebe60684106b9a23e0e1b574b0 kernel-debug-devel-6.12.0-211.66.1.el10_2.aarch64.rpm e0e6a3fce99bb803e2fe5e568b585c224a68144f4baa3826d00bba306fecc335 kernel-64k-devel-matched-6.12.0-211.66.1.el10_2.aarch64.rpm f8e0faf8b16fd4e14fd17a4e43f1bf414db874fdf3026a199f0dd252118ef7bd ALSA-2026:83551 Copyright 2026 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258) * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libgs-10.02.1-16.el10_2.3.aarch64.rpm 227b38e6f9b213ce5302d4a5b44fcef6edfc12f268b41920913694256145931c ghostscript-tools-fonts-10.02.1-16.el10_2.3.noarch.rpm 2f11201ed712d8c66100867af2653f448d74381381908688fdc39f52910b7722 ghostscript-doc-10.02.1-16.el10_2.3.noarch.rpm 31dd0cac798502cb49a1a9259e5c0dcebf08e0e8ea0f2a893da972d2c6ca75d3 ghostscript-10.02.1-16.el10_2.3.aarch64.rpm 3ef12bd0c9a73b0ab56f11488625f023ff99b86d790aead80813cabb1eb3eb4c ghostscript-tools-printing-10.02.1-16.el10_2.3.noarch.rpm 6dad220e750d8b49fbcb9d4ba86f2c36b7071dd78d13d0856dff27d76ac4cf46 ALSA-2026:83618 Copyright 2026 AlmaLinux OS 0 1 Important

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding (CVE-2026-102555) * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556) * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557) * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558) * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559) * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth (CVE-2026-102560) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default libsoup3-3.6.5-3.el10_2.20.aarch64.rpm 15a5a9d8dd14689d79e8e254fa19cac4a192468b268654cf3239e9df44aa9693 libsoup3-devel-3.6.5-3.el10_2.20.aarch64.rpm d932a149f683095d3f8ae0a1581a8911e813b798790452e20e53f869320230c7 ALSA-2026:84578 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3.14-urllib3-2.6.3-2.el10_2.6.noarch.rpm f85520901dd8eaee108473d77b0f023b36fd8cbd327d8e82e253a0e60f981482 ALSA-2026:84587 Copyright 2026 AlmaLinux OS 0 1 Moderate

perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default perl-URI-5.27-3.el10_2.1.noarch.rpm 611eb7e29299e3e8f52bb171d6d8f6443251979af86b7d673d597c26e07700b3 ALSA-2026:84591 Copyright 2026 AlmaLinux OS 0 1 Important

emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219) * emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992) * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default emacs-common-29.4-14.el10_2.3.aarch64.rpm 2f0f1ecc508a30c4e8b739053b924606f86c0088fad0fc2dd6a6d52655eb49d7 emacs-lucid-29.4-14.el10_2.3.aarch64.rpm 67ff42580194120ff07def060c5a17ba330b84ac52aa3c7c770b28285ff27747 emacs-nw-29.4-14.el10_2.3.aarch64.rpm b2e78b2e01641dc5736be81e01155ccb5ef1f5841b2fc066192be8224c1f5457 emacs-29.4-14.el10_2.3.aarch64.rpm fec0246c639ed15ae55f67e1202efd9ada7d3d9f659bfcf7389ad47cad1f5dff ALSA-2026:84721 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886) * wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880) * wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919) * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76879) * wireshark: Wireshark: Denial of Service via X.509IF protocol dissector crash (CVE-2026-76928) * wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927) * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-95389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default wireshark-4.4.2-10.el10_2.8.aarch64.rpm 561fc3178f68ce22756ae33df9340633dd35519994549218ad07fdb2f52960f2 wireshark-cli-4.4.2-10.el10_2.8.aarch64.rpm e93221d03af57a6d78ae61c4815fb7eee00da1ee0861b317b098080f42db76cc ALSA-2026:84753 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117) * glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489) * glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374) * glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default glibc-locale-source-2.39-145.el10_2.alma.1.aarch64.rpm 049b1d3beba7ba92cb6c28c8da2f467231b5bcc113a15286c4ed9732efa7f1f6 glibc-devel-2.39-145.el10_2.alma.1.aarch64.rpm a44843774ce8d04b57fa36865180c4f7f229feeba28ec826214f3c0de1f2d4a9 glibc-doc-2.39-145.el10_2.alma.1.noarch.rpm c1c6d8b798e7e9695a6bc003ad236d37961e0f8401f3349a7e892ca0785f46f8 glibc-utils-2.39-145.el10_2.alma.1.aarch64.rpm c5352d3c3f62880d22d9db7437c15f52cf17fb23e5e5bf0ad190ec359babc753 ALSA-2026:84795 Copyright 2026 AlmaLinux OS 0 1 Important

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default librabbitmq-0.14.0-3.el10_2.1.aarch64.rpm 2576d17aaf821b28beded3d934d6cba85e6c129879645201bef097f423e17088 librabbitmq-tools-0.14.0-3.el10_2.1.aarch64.rpm d4717b4bf3bf84ce3fe51e17eb9dde7d39b0ea70653b1be2dd0d870b6ae11fc8 ALSA-2026:84796 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) * OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) * OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) * OpenEXR: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) * OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openexr-libs-3.1.10-8.el10_2.5.aarch64.rpm c83c08969cf0fc2088031ba96b8401ca8905ee909a3f8894a1970fbb69426999 openexr-3.1.10-8.el10_2.5.aarch64.rpm cb58de99ccb25457a9d5d56e59a5e9a5d302d07deb7e4f7d5612ebdcd070d8b8 ALSA-2026:84799 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb11.8 security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default mariadb11.8-test-11.8.8-2.el10_2.alma.2.aarch64.rpm 0c99a825481e6dca8eb7eb5a77e32ab71e52e29371b760af10143ecc2fc563fe mariadb11.8-client-utils-11.8.8-2.el10_2.alma.2.noarch.rpm 12129a48fbf0bf75af7db9ec51b44577a01a5f68033e0afc2926050dfbd4b09a mariadb11.8-server-galera-11.8.8-2.el10_2.alma.2.aarch64.rpm 16434a84ae07fb60cb2d81382b6fbf3b0cb0f9281916804961fc5a34a10266d7 mariadb11.8-oqgraph-engine-11.8.8-2.el10_2.alma.2.aarch64.rpm 187437ab1c9c07cf3bfef5482c60f131824559a4323fc395c580db4abbee494a mariadb11.8-backup-11.8.8-2.el10_2.alma.2.aarch64.rpm 1a37bbf46beb8c4136fc213fbf3cfdc17b0ac9170524b7073fe1e63fd453907f mariadb11.8-devel-11.8.8-2.el10_2.alma.2.aarch64.rpm 28cd679f0e94125889bc6bc2453941334a6e9009dc36483c9f7cdead7645ae80 mariadb11.8-server-11.8.8-2.el10_2.alma.2.aarch64.rpm 405110d0271e8e3854e5754a76bf5d42e8a44d6bb407dcd457015abb9ec30a4d mariadb11.8-embedded-devel-11.8.8-2.el10_2.alma.2.aarch64.rpm 5285cd95b0697f29f509eb48998df783a0a645d6c3e65d6068c5b40cde1734a6 mariadb11.8-11.8.8-2.el10_2.alma.2.aarch64.rpm 6a9911edcd869589040484276e68d8ca2d2a88f093c964b53472ba81f07153c4 mariadb11.8-pam-11.8.8-2.el10_2.alma.2.aarch64.rpm 711baa1091adecdc2abe5e7c0b78c0810b9357ab53aed6e4a8a24b6d75e8bc6d mariadb11.8-errmsg-11.8.8-2.el10_2.alma.2.noarch.rpm 8d642bace1bba11ccca8ea2c8a11a03bd79c79e1f8e1bb0d1c61760ee1505e1b mariadb11.8-embedded-11.8.8-2.el10_2.alma.2.aarch64.rpm e80adfbba9014c659b3cfaaae335ef13c76949099c60186197c1dde38aea54bc mariadb11.8-server-utils-11.8.8-2.el10_2.alma.2.noarch.rpm eab081636282b63c450ea09a5a2d58ccd71c89eeef2705c6dc97af3c8ebe9c55 mariadb11.8-gssapi-server-11.8.8-2.el10_2.alma.2.aarch64.rpm efdce62d78e5dec30c6f8b6f0d0d49b9f196dba4e0d5956d5a606cc61413a6e7 mariadb11.8-common-11.8.8-2.el10_2.alma.2.noarch.rpm fad75cb8cb6a19b23db136f4f44c4038fddc3718e190afa3a73c8f04192d30ba ALSA-2026:85191 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.4.aarch64.rpm a9fbe77100e9ba8f427880b8a71d3270d2920279ebcfad0aba76f2d265322fef ALSA-2026:85276 Copyright 2026 AlmaLinux OS 0 1 Moderate

hostapd security update

hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd. Security Fix(es): * hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default hostapd-2.11-3.el10_2.aarch64.rpm a9b663d06c1a3249e287ed086ff4f05e4af5ee6fc09e6df4126d9a23cfa457aa ALSA-2026:85321 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801) * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162) * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117) * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300) * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: signal: Prevent exec() race (CVE-2026-98256) * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) Bug Fix(es) and Enhancement(s): * [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded (JIRA:AlmaLinux-181987) * [IBM 10.3 FEAT] zcrypt driver overwrite function - kernel part [almalinux-10.2.z] (JIRA:AlmaLinux-245336) * Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:AlmaLinux-256678) * RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:AlmaLinux-257228) * Fix pending kernel issues for L1VH GA - Kernel (JIRA:AlmaLinux-267038) * Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [almalinux-10.2.z] (JIRA:AlmaLinux-280590) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default python3-perf-6.12.0-211.67.1.el10_2.aarch64.rpm 0231a3c146eea5aadd065256c41997858064d2687e5451fec35ce86c14d37667 kernel-64k-debug-devel-matched-6.12.0-211.67.1.el10_2.aarch64.rpm 069cdbdb9b275fa6a1f4ad066f40a12c9d71b2a15ef7c2f1461319a1d5801fb3 kernel-devel-6.12.0-211.67.1.el10_2.aarch64.rpm 1be1251a77d744300712a4ac294aba15d2ca670fc7f8b788171fa3234e05b88d kernel-devel-matched-6.12.0-211.67.1.el10_2.aarch64.rpm 42e712bb285cc5e3ddbc66250016bebb9ffc8c3fc52dbfe51a5fe490ae463e5b rtla-6.12.0-211.67.1.el10_2.aarch64.rpm 61cc062222fed6282728ff15cf15ddc1e3265937ad90e719c10109c193840cf9 kernel-64k-debug-devel-6.12.0-211.67.1.el10_2.aarch64.rpm 69c5d78eb1b5d7ee7c1e8d5618c1d46ef3345f19b84079c535c6fdebb2f72431 kernel-64k-devel-matched-6.12.0-211.67.1.el10_2.aarch64.rpm 6fa0ecaf24e91e58183a2becf798637e92d5147c8f038296a7740944c4976534 perf-6.12.0-211.67.1.el10_2.aarch64.rpm 7364a6b1866ccf05cb189c1a50c59d2be40cd793e83965affb9086b8f0e23311 rv-6.12.0-211.67.1.el10_2.aarch64.rpm 7c2a6800b8f16ba495beea3167348000742176484735e75357c2649613d417dc kernel-doc-6.12.0-211.67.1.el10_2.noarch.rpm 9caff7cead81e13e3372f4e55e542a9d645c00d414b73c690cfe3a97d7add266 kernel-debug-devel-matched-6.12.0-211.67.1.el10_2.aarch64.rpm bc82f1e19eb8162c74a411c058e923527c41de11edab836c37de5ec458903a86 kernel-debug-devel-6.12.0-211.67.1.el10_2.aarch64.rpm ee49497389fecb3d75b9d2228f0c63994b71ea0037f2d5b89f65f76af1b7ab1a kernel-headers-6.12.0-211.67.1.el10_2.aarch64.rpm fbf7673bf4d2a92dd90e2601e006e2a52d00fc27dd9a78ece1f83a3ee0a6abd0 kernel-64k-devel-6.12.0-211.67.1.el10_2.aarch64.rpm fe545711bd1e0f92a1f005aa1cd43fb3df683f51704f73d1417481cd46f01a8b ALSA-2026:85847 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997) * openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998) * openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default openssh-keysign-9.9p1-29.el10_2.alma.1.aarch64.rpm c5f55a902b894ff72e90fce329f8c3342af1c18ae2e49884157294928ba6d2d1 openssh-askpass-9.9p1-29.el10_2.alma.1.aarch64.rpm efc52552e11a2876bcd78bbc157ad20a1e061f81d06051275212ce72b49b3d50 ALSA-2026:85848 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sq security update

Command-line frontends for Sequoia. Security Fix(es): * hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657) * rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default sequoia-sq-1.4.0.1-4.el10_2.aarch64.rpm adfa88932daed582c4e08a6982b170b6bf36aca4935b6620e03f82118a07da8f ALSA-2026:85959 Copyright 2026 AlmaLinux OS 0 1 Moderate

fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client. Security Fix(es): * fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default fetchmail-6.4.38-3.el10_2.1.aarch64.rpm 18085533f99f5a6007f984e9876e7ee562fdf50c590554c23000fff14b6886eb ALSA-2026:86093 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default golang-docs-1.26.10-1.el10_2.alma.1.noarch.rpm 2d79e769efee24206777297d81950a59cd8f92825199a4b095bd00a11b65fe72 golang-bin-1.26.10-1.el10_2.alma.1.aarch64.rpm 349fbdb36115dec6a7f1c96db7b60ec5f7777e39dd9e6695aa40f47a670ef4de golang-src-1.26.10-1.el10_2.alma.1.noarch.rpm 43d81a2ae0e8050075f42624aeeb87c9923f73d9eff287c06c6f5161f582dddc go-toolset-1.26.10-1.el10_2.alma.1.aarch64.rpm 7f23aa5eab3fa846b72a832c6529b4bc1fec7821a2c834ea9a2dfcd0a2a6f981 golang-1.26.10-1.el10_2.alma.1.aarch64.rpm 82f4b6e580912b5c95116ed05ab0fc12ba766620a80559e0a4e842a9e1f92dc2 golang-tests-1.26.10-1.el10_2.alma.1.noarch.rpm 8564845c95e3ad9ae431701bfc86844c9f231174349f09fa3bf96764c9e304bb golang-misc-1.26.10-1.el10_2.alma.1.noarch.rpm 9cca556f68ec191e90e65a5ff40a7482d60e4866fea7a72fa75649b2f73a01f7 golang-race-1.26.10-1.el10_2.alma.1.aarch64.rpm df53bfeab539b2806f812c1d0e6a0881a732f468d99fdb99d44a9e0764ccbd74 ALSA-2026:86168 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-10.2.z] (JIRA:AlmaLinux-277794) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-sdk-8.0-8.0.132-1.el10_2.aarch64.rpm 229dbe520afd2eb77c5fd7a7ab484631cbe603df903a52da3644a0fa715d0814 dotnet-templates-8.0-8.0.132-1.el10_2.aarch64.rpm 695d6096a4bdd7255e7c09f0e03d949fd683527888575c72f8eb3ff1821d8867 dotnet-apphost-pack-8.0-8.0.32-1.el10_2.aarch64.rpm 74183abf9b0d0288354a133cbeeff371246179105b1ee64debb1379995a02463 dotnet-sdk-dbg-8.0-8.0.132-1.el10_2.aarch64.rpm 78328db6724e8aa740fdd75f06f7d25c1da606e467357118753969cb133ae5cf dotnet-targeting-pack-8.0-8.0.32-1.el10_2.aarch64.rpm 79d5550767d141af78c7f6c2108d101bd95841b34e4ad84c672fc471fcb90ea4 aspnetcore-runtime-8.0-8.0.32-1.el10_2.aarch64.rpm 93ee0e2a4732b652fc1322e4a10caa4210798a79a3cc169549a652a7e625251c dotnet-hostfxr-8.0-8.0.32-1.el10_2.aarch64.rpm aa36392508f949df66d4cf039a8aa86a9f1876c084aea9ded102afa726d513b1 aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2.aarch64.rpm aff6c594ae5a7c27a1763c26ab67fc97f4480d9b7beb5b2a330fc722d56a7903 dotnet-runtime-8.0-8.0.32-1.el10_2.aarch64.rpm c5ba92b42b13af101beede9dac95581c316aa7f3f32b95dfe843932dea49501c dotnet-runtime-dbg-8.0-8.0.32-1.el10_2.aarch64.rpm cfb4d33ef73554e63ff4042b5eb0b4695dc3e880a618957efec31da59c68b69d aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2.aarch64.rpm d51acda9be88b9962d2d1eb7d35f28c8d880c090b8b29e491fed7dc8415a1cdf ALSA-2026:86172 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-10.2.z] (JIRA:AlmaLinux-277801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-runtime-9.0-9.0.21-1.el10_2.aarch64.rpm 10bce3b0634e344ef85851c73db43b93cbdd77698d33d6d260cd166845bd3916 dotnet-apphost-pack-9.0-9.0.21-1.el10_2.aarch64.rpm 5276623c82543c43fad5e692368791f6db0e35997d89bafe506983e6f2620827 dotnet-templates-9.0-9.0.122-1.el10_2.aarch64.rpm 8a0273613711b91e8616a36d6934bb85e51e9c8e1e7919a4e6a01afb41a40e05 aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2.aarch64.rpm 8c62a5c689f0f3ade7321c7899041235c68a3aaa1db576158d44c0950d550310 aspnetcore-runtime-9.0-9.0.21-1.el10_2.aarch64.rpm 8d9299379e985dbfd4de1045af7da2fc24f3ec627b39fd3487d72711911502a3 dotnet-sdk-9.0-9.0.122-1.el10_2.aarch64.rpm afa9752570a0046ebcc007e12d3c9fb257741f9411ea111625ddaee27ea962b7 dotnet-targeting-pack-9.0-9.0.21-1.el10_2.aarch64.rpm b605308f1bf4873e48d082567070fd70b0318b18842093ab639fabc323874463 dotnet-runtime-dbg-9.0-9.0.21-1.el10_2.aarch64.rpm b703a34cf988ebf4b3c8c462ae65da10f54f17db1fc382d6165921ffb4b39f51 netstandard-targeting-pack-2.1-9.0.122-1.el10_2.aarch64.rpm dd20d52b140ff1bafe7dd51610b15f0cca349f3d54a6a29bafecd83eba5435db dotnet-sdk-aot-9.0-9.0.122-1.el10_2.aarch64.rpm eb4ec04277072c34b3f61424a098ae31445567f7490e746d28d7cc25e307995c dotnet-sdk-dbg-9.0-9.0.122-1.el10_2.aarch64.rpm ed2f857896ef5b4f8fee7d140ac51e2604864d699a8b4b10e8f54b4554447a66 aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2.aarch64.rpm f232d1a5ed6b34c8309b3366ead85b670ff9e9e53324266db69f19a582125e86 dotnet-hostfxr-9.0-9.0.21-1.el10_2.aarch64.rpm f62e6de3295668fcb140b5ef98e9105e07ac09a73bf1e12618f51baefcd1b441 ALSA-2026:86195 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-10.2.z] (JIRA:AlmaLinux-277809) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default dotnet-targeting-pack-10.0-10.0.13-1.el10_2.aarch64.rpm 1fb7e7dafe43d42be65c4cc1fa68ad340d1fa2748d57d55155cbcc7f713d9bca aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2.aarch64.rpm 21541aed475b1d559b546956d5f819a3a33a56d2179538d79be7ceb70240aaaa dotnet-host-10.0.13-1.el10_2.aarch64.rpm 276ad91d6f3419f585f06c3323227cca306fef3377f1a6f78d13c4417b04496a dotnet-sdk-10.0-10.0.113-1.el10_2.aarch64.rpm 43a6a9c869c836ce4f43ef3a1dcbb8bc69f9e163b0f7a6753457a28d2e46cf59 dotnet-runtime-10.0-10.0.13-1.el10_2.aarch64.rpm 477e048ab3456873a1856a8b5639d8d9431cbb744ea614085c3a7384254a489e dotnet-sdk-dbg-10.0-10.0.113-1.el10_2.aarch64.rpm 6285822e2f2b9979fbe8536cba555b9f881345d2d1de16a7bbf47cc8220fd193 dotnet-sdk-aot-10.0-10.0.113-1.el10_2.aarch64.rpm 9522b5179b22cd7016c97f29a44123068232fc80ff51ac67d91fd2da7fec64d1 dotnet-apphost-pack-10.0-10.0.13-1.el10_2.aarch64.rpm abc8308ef7ca592c85fbdf3282e8bfb2a47f9dab346ba0946ef050901b563768 aspnetcore-runtime-10.0-10.0.13-1.el10_2.aarch64.rpm aecf2bf327da7d099a0fde710cad618846f42a28526ab8487e90d2f17207d865 dotnet-hostfxr-10.0-10.0.13-1.el10_2.aarch64.rpm ba79de73096eb501875cf201a44d31a5480a43d2590397d743adb61e48e9ce28 dotnet-runtime-dbg-10.0-10.0.13-1.el10_2.aarch64.rpm c0b8e580fbeafe74a70cc9ee9c3f4b57822929c979cc2a75b0db50c50fa32126 aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2.aarch64.rpm d5429a013eaeaef7288c9bb17e6af71481eba2abd1a617cefbc4f9e853fbecf8 dotnet-templates-10.0-10.0.113-1.el10_2.aarch64.rpm fdd8cd40605a79feccf9fbe13af2dc627889bdc512e6b00e8854355854475f00 ALSA-2026:86841 Copyright 2026 AlmaLinux OS 0 1 Important

librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default librsvg2-2.57.1-9.el10_2.10.aarch64.rpm 05c33df8d94a5ea13b76b16101ac285fdf8d93634fcd880ec84dffc09bff86b0 librsvg2-devel-2.57.1-9.el10_2.10.aarch64.rpm 1c8bc8e79db864df873e4f95346714fd04c136c6ec0f82d43399a13269802f0e librsvg2-tools-2.57.1-9.el10_2.10.aarch64.rpm a44daac5813222d11ca8c0c1064ea3fbd892ecd6af68a92ce9fa8a340a14e5e6 rsvg-pixbuf-loader-2.57.1-9.el10_2.10.aarch64.rpm e9716f030a1e6d7e95dbb79b2f03b02d1016b0a570178fd77d4a0da2fc4b36d2 ALSA-2026:86971 Copyright 2026 AlmaLinux OS 0 1 Moderate

cockpit-machines security update

Cockpit component for managing libvirt virtual machines. Security Fix(es): * cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768) * cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747) * cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default cockpit-machines-348.1-1.el10_2.noarch.rpm f07522ae8bce2750b2d0a9b32d8b9b159a43988af1d1d59a1c3ed9655cf017a5 ALSA-2026:87070 Copyright 2026 AlmaLinux OS 0 1 Important

php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default php-gd-8.3.36-1.el10_2.aarch64.rpm 02662ef226d2b85574107491788a5ffe218b563a0fe18cdf99163080ffe6e6c3 php-mysqlnd-8.3.36-1.el10_2.aarch64.rpm 1a2c82b7f1c1b7ff3de14ae386b521ff069eac6b972fab3b80bd692c22c23b95 php-opcache-8.3.36-1.el10_2.aarch64.rpm 233c413767153015583749c8d250734fbde4a5cd6d3ce12d55e991a492be1137 php-dbg-8.3.36-1.el10_2.aarch64.rpm 289a4f0ef89f35b6ffff9c4b310dd345c7c45eae04012dc213c8df77aad9aade php-enchant-8.3.36-1.el10_2.aarch64.rpm 2b952db371296069559468e9805db88e5551e96e39d971e39976fa62d19172b8 php-bcmath-8.3.36-1.el10_2.aarch64.rpm 2ee8123467974a07d226134f0cbebf07f6207e72ac6b9cf24fa3d5e9e279b8cb php-dba-8.3.36-1.el10_2.aarch64.rpm 3dbe7e2cddbb668b0992c1725b1a31530bb1d60067d28ff46df536ec26e2817c php-ffi-8.3.36-1.el10_2.aarch64.rpm 3fc0b7280079f7203717a5621965c1be60331730c0bb4473c8b085ac5abc8be1 php-fpm-8.3.36-1.el10_2.aarch64.rpm 51ea75c36cc750e17acb2198ba5cd5eb2c98b1ded8e104eadb8bfa33e2ebfc3b php-snmp-8.3.36-1.el10_2.aarch64.rpm 5dbf789335761d55760b6e437b7b211a0ba36b22af00534d78e86b0d24215d20 php-intl-8.3.36-1.el10_2.aarch64.rpm 6b3ba3334e95cf1d14a4a5590ba498bae7b820339ac3de266c17dd5536d6e063 php-devel-8.3.36-1.el10_2.aarch64.rpm 6eaa1da101204e0c830831baf858c167fdd408c37bc0883bdf79b337644e6a90 php-ldap-8.3.36-1.el10_2.aarch64.rpm 72cbfc9c528bc4bf01c9d481b0c5c5c8d87a341dc43f795aff023985ff1a493b php-odbc-8.3.36-1.el10_2.aarch64.rpm 76214e60665a6acfd0b86c86697d8f335b01b86f42957c37effbc0df7e604ac6 php-mbstring-8.3.36-1.el10_2.aarch64.rpm 797d6a0eeace6575c3eca6201e85f4962ff77a1e5d931130386915c003195fd0 php-embedded-8.3.36-1.el10_2.aarch64.rpm 84ddffb63ae51a9b8c3869160358d302187fbf06a235234ad47df30dbb9f71d7 php-soap-8.3.36-1.el10_2.aarch64.rpm 95903436836ec35f6c4a4445d0fc76d8a91b09673e8f4de2e172d343d849b90f php-gmp-8.3.36-1.el10_2.aarch64.rpm dedf84ffeebe20a007f541373acbc2dc4f7a5d4109eafd494aedeeba0442d4d3 php-xml-8.3.36-1.el10_2.aarch64.rpm e088b5b67758cdf22a3078f494e36c5626765ccd8fcfb8e2f3baaf6619e1f543 php-process-8.3.36-1.el10_2.aarch64.rpm e72727a81dfb450b31a8a24c23c024962cba7da24e0963933c06474dae308a12 php-8.3.36-1.el10_2.aarch64.rpm eb7494cfaeb6df32189d66160256d7d770c8e178738c7555e5ad32281a1d4057 php-cli-8.3.36-1.el10_2.aarch64.rpm f3c4256e2d28537b3918c1d8d9e439c67a6578a39b1765b3c844b0bfa0677f3e php-pgsql-8.3.36-1.el10_2.aarch64.rpm f452eb9b9e23097782d5bc590f4501007f23dd01df6a885f0a2946e49b849cec php-pdo-8.3.36-1.el10_2.aarch64.rpm f494c9b645fa5cb9d02c407b56d22e2b31a33e8aa35f23620a05e102e500f959 php-common-8.3.36-1.el10_2.aarch64.rpm f4e2b873c30127b95d74e9bd2de2e895c718a0687c497c4713bf402be9261d53 ALSA-2026:87071 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default php8.4-cli-8.4.27-1.el10_2.aarch64.rpm 048f30f89f7cc0fd8c49863c430b41337c64a1c7d87fa4a478438bd5ce82813e php8.4-fpm-8.4.27-1.el10_2.aarch64.rpm 126453fc03b4b9ff7f827e34773a0b8678ec21cca7e4dd5c070096850b31fdaf php8.4-odbc-8.4.27-1.el10_2.aarch64.rpm 1369957954e18b9d91e533fbd849278bb47a60194077e39fa6e500031ae2f4b1 php8.4-ldap-8.4.27-1.el10_2.aarch64.rpm 1a45af2a47fb6c1ede794d9a2148aa8e1a48ce97bb0355612f65aa44f2da9af0 php8.4-pgsql-8.4.27-1.el10_2.aarch64.rpm 20c488c3ebba52757b443b5f4b868623080fd11e2a65c04f528ad27399e4d5f0 php8.4-soap-8.4.27-1.el10_2.aarch64.rpm 254862a276c07d2c9ba37cc36bf3df3269cc8e92fa864edfaa3dcca6f101c31c php8.4-snmp-8.4.27-1.el10_2.aarch64.rpm 2617131e7cb755aeea58beac704f509d00f7507ff5dd1ba2ff2e2988dbbc0af5 php8.4-pdo-8.4.27-1.el10_2.aarch64.rpm 3484778ec5371f719f4c111150b8022b64971e942366e2d844c49c51422ddf0c php8.4-dba-8.4.27-1.el10_2.aarch64.rpm 64c11acc05f547dbbd7b702417b67fbc00c35122ac3874fddbeb855ecab25650 php8.4-common-8.4.27-1.el10_2.aarch64.rpm 66b0b37844226201293e650effe5cb06dadfe4f008640b7ef99cc36d219f4eb7 php8.4-mysqlnd-8.4.27-1.el10_2.aarch64.rpm 69bd6bd16111944ea244e23dec5a0b645490317929788aed9af66c7ab157d045 php8.4-gd-8.4.27-1.el10_2.aarch64.rpm 71ab3dcbb641b19a4c249c082a32f7106a5f81f4d3cd7893cf76e5e3b179e197 php8.4-8.4.27-1.el10_2.aarch64.rpm 91e7736b63c02da6b2a395c57735ab05a616123d48e427e46a445b2cf0d380ce php8.4-devel-8.4.27-1.el10_2.aarch64.rpm 95dd507ba53fd3e89d43081ae0dfdaad175c420153077b611196b4b406be6d2c php8.4-enchant-8.4.27-1.el10_2.aarch64.rpm 97dcc32d271a2104ed53a8cf0bf96dc1b5ead251db57a9392a209a75cc90bc82 php8.4-dbg-8.4.27-1.el10_2.aarch64.rpm a9da72799df8ad577c58cda7dce2991f8a1f3a33630b185a26e3951ab8a2faee php8.4-mbstring-8.4.27-1.el10_2.aarch64.rpm c55028c91515832a1fa0baeae7947155fc817c8518d302f298796ee246c6a4c9 php8.4-ffi-8.4.27-1.el10_2.aarch64.rpm cde6c434cbf95fef365c8981b0b1e66eef5c57adca85f2c2d40b653414338ed6 php8.4-process-8.4.27-1.el10_2.aarch64.rpm cdeb030acae06fcf633d17bc57b126b563e926a3a90aeb3b18719e38f825269a php8.4-embedded-8.4.27-1.el10_2.aarch64.rpm d2f27c2cf196b5702eb203fd986b8af39f6318fc0a2254897c0a9cc7e96c1b8a php8.4-gmp-8.4.27-1.el10_2.aarch64.rpm d8f60d2fa57ed16cfd1e19f50997b95894bc7be097ea3aeeb9c35dfcccef335b php8.4-opcache-8.4.27-1.el10_2.aarch64.rpm dd428e4f6eeb577afc33572c94b584e0cc86d69f94ccdc93e61d6028728da9b4 php8.4-intl-8.4.27-1.el10_2.aarch64.rpm eac0d7cf68757a290615220f8a0f0f4ad7e1fd1968213995e6a939fa55bf7af3 php8.4-bcmath-8.4.27-1.el10_2.aarch64.rpm f5f6a916b20df8211086f227356d109c6c46165c6cc4261a960c269c6b467716 ALSA-2026:88207 Copyright 2026 AlmaLinux OS 0 1 Important

iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3: Denial of Service via UDP receive worker infinite loop (CVE-2026-102253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default iperf3-3.17.1-6.el10_2.2.aarch64.rpm f81878275c3d3e3f14cca598a07e7458057623643850a5f8492d1017f709a56f ALSA-2026:88262 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-aarch64-appstream-rpms__10_0_default buildah-tests-1.43.1-7.el10_2.aarch64.rpm 434a0cf2e6d5e95e0be861fefad429e495f9a1893b4827e4dfe54b5b3fd023c3 buildah-1.43.1-7.el10_2.aarch64.rpm c0f8289d82a57faa6e95d07bf5491395b385e3a13c49a793371bd4bbf24a9c6e