ALSA-2026:18134 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633) * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839) * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980) * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015) * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097) * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166) * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202) * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279) * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267) * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275) * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346) * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345) * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405) * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441) * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470) * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866) * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034) * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134) * kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210) * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257) * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320) * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040) * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111) * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210) * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.7.1.el10_2.s390x.rpm 0be2bcafa050a64a33fcd89848d7e15d8f3d06b27854a1ee8be4411cce848c66 rtla-6.12.0-211.7.1.el10_2.s390x.rpm 2a563f699462c5ad1c55b8977c6a5bca6e81796d8c1482a5283662183a771c50 kernel-debug-devel-matched-6.12.0-211.7.1.el10_2.s390x.rpm 4b6ca87c247a249507b70cf0d4f7dfb2a0c95265c783d9ca072c5e5fb101b422 kernel-zfcpdump-devel-6.12.0-211.7.1.el10_2.s390x.rpm 5a605b8e688820ab918c6d318b99e983ea92f6ca0c811e6c65c1af59e6dd9644 kernel-zfcpdump-devel-matched-6.12.0-211.7.1.el10_2.s390x.rpm 7463a3fb32b0cef659cf224c41265026493e270b8a7783b97145c19d5771cb38 kernel-doc-6.12.0-211.7.1.el10_2.noarch.rpm 78db96b63b180a526d27658a5f66bd367e0d516ce72b83b9aa8ec6f642d3b051 perf-6.12.0-211.7.1.el10_2.s390x.rpm 9a8f876c583619c1600e6386c47f0a6c148469612d8519e0862d1b1901071b12 kernel-devel-matched-6.12.0-211.7.1.el10_2.s390x.rpm 9ae9d15a35c580bd003d33d6d43457d6ae4166d32ea0353c15ac7b30f6719c6d kernel-devel-6.12.0-211.7.1.el10_2.s390x.rpm 9be82cd79265c70fa6c845b109e244daf30fa1c0e72012baf549a983eb734607 rv-6.12.0-211.7.1.el10_2.s390x.rpm a9a212546ee1dc164894c065263909e77613a7559a3333509c8477b39e0bdf97 python3-perf-6.12.0-211.7.1.el10_2.s390x.rpm aa907058d2fe9389117cba7619f612965c21f5353916d6f983c80184d1f118de kernel-headers-6.12.0-211.7.1.el10_2.s390x.rpm cfaf9d3aad59205c87ad916cb2e0bcc5752fbe844e9781152c00c3b79c8e93d7 ALSA-2026:18142 Copyright 2026 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * networkmanagr: NetworkManager File Access (CVE-2025-9615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default NetworkManager-config-connectivity-redhat-1.56.0-1.el10.noarch.rpm 3c3510b6b69347004ae5092b71485721e86928b812cdbbb21a7a13cf2a6cf1ec NetworkManager-ovs-1.56.0-1.el10.s390x.rpm 538a20a9ee60b5a18a4a2d694b95f38c24cb4d984d224f42430217b18ab873b6 NetworkManager-cloud-setup-1.56.0-1.el10.s390x.rpm 8dfacd49439bf6bc7447fceb1b09262cbb9da1a71cfa1074a5e15f3f91de1bd7 NetworkManager-ppp-1.56.0-1.el10.s390x.rpm fd64b21eb3eeda3f3ac4acdf42f83f93a03874dca75c4e20093f7f28ea7cc68d ALSA-2026:18143 Copyright 2026 AlmaLinux OS 0 1 Moderate

p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files. Security Fix(es): * p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters (CVE-2026-2100) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default p11-kit-devel-0.26.2-1.el10.s390x.rpm 78aa8b69b690f1b1b6fdd09fc7e6f2ce6712f03f1fbd9415f041a25294a6dedd p11-kit-server-0.26.2-1.el10.s390x.rpm 8ffced71fc254c3e9d569e9b3e73894c80c080228383566ddf402219423eae4d ALSA-2026:18160 Copyright 2026 AlmaLinux OS 0 1 Moderate

libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966) * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964) * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965) * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967) * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libssh-devel-0.12.0-2.el10.s390x.rpm 721bab56a2867eafceaac56e88458c10956e701f9f57faec2d96c3505dd165be ALSA-2026:18326 Copyright 2026 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Denial of service in XML parsing (CVE-2025-12748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libvirt-daemon-common-11.10.0-12.el10_2.alma.1.s390x.rpm 0268bf88ec150d67f4d7268c86fabc57020a9de7e96659fd5ae84ddd3df02a4d libvirt-daemon-driver-storage-disk-11.10.0-12.el10_2.alma.1.s390x.rpm 054fad7a64cc8026dcdd09d548fe0b84385f137f46d5282fb22ef5fda4e2a6e9 libvirt-client-11.10.0-12.el10_2.alma.1.s390x.rpm 17e7ced972d03eecfe0d04c1b3a08f2b061a1721beb05c07a2e3e7bdc0e9b721 libvirt-daemon-driver-nwfilter-11.10.0-12.el10_2.alma.1.s390x.rpm 196a275176c7b9111cd1f6d929c1ad4fd114660205dccef6ed9dfd6509b8d4df libvirt-daemon-driver-storage-iscsi-11.10.0-12.el10_2.alma.1.s390x.rpm 19c5c6da5b9dd58a11e2cb380f1c5a50902267c857ddc10f6db0bf8256333644 libvirt-libs-11.10.0-12.el10_2.alma.1.s390x.rpm 2c7d7ef29b9cbd021e0dc9c354463a027ac1b412d25c29229c369573225a9d00 libvirt-daemon-driver-storage-mpath-11.10.0-12.el10_2.alma.1.s390x.rpm 3d143234d0b60f773bdf0669c44f651935f8afe5324bfb3a3232b660d0344370 libvirt-daemon-log-11.10.0-12.el10_2.alma.1.s390x.rpm 3fc1991c7e5ed94e22958e71a4bcedb8d3553896cade8d3496d8697b461f6431 libvirt-daemon-config-network-11.10.0-12.el10_2.alma.1.s390x.rpm 53681673b53b6ed6e3522757007af6876f47e6b20efd0b0261d13f6315c7cb5e libvirt-daemon-11.10.0-12.el10_2.alma.1.s390x.rpm 586256a1f396c2a1e451284985721e0f7954277a28d3e7609f4c927bebc5d612 libvirt-ssh-proxy-11.10.0-12.el10_2.alma.1.s390x.rpm 624ffae06647513a3aebcf06cb9a88ce42f65f0437ff7bc0dc54d8aed7894f1d libvirt-client-qemu-11.10.0-12.el10_2.alma.1.s390x.rpm 653d20c90932de5aa138bbbb55f0cd820a0d65e710be54da955f37322f721298 libvirt-daemon-driver-storage-scsi-11.10.0-12.el10_2.alma.1.s390x.rpm 6d6e10e4459bf25ca8f5eb7a6eb16f0d208a4c9a329418cb53548e6f64840b9d libvirt-daemon-driver-secret-11.10.0-12.el10_2.alma.1.s390x.rpm 6d74be97b8c15c0fe7f571b965cb31340e20618ef2186ac9d4db61a5de0373c7 libvirt-daemon-driver-nodedev-11.10.0-12.el10_2.alma.1.s390x.rpm 972520d8cfcb05feeda60773544c7e1667842c28fd7e1cdf82e54e6fb56e2e0a libvirt-daemon-driver-network-11.10.0-12.el10_2.alma.1.s390x.rpm 995ece84c075b6d189c9a3f45c9f5d436a8ba778d4dfc965f5654800f2f47c4a libvirt-daemon-driver-interface-11.10.0-12.el10_2.alma.1.s390x.rpm a7d4e2a65c5ad7dcdb09b5fdecbd58d17dd2c74766200959a634e403d1d68965 libvirt-daemon-proxy-11.10.0-12.el10_2.alma.1.s390x.rpm b02a943f07291f9b284485310373589d6425b6107cc7e1348e1a11fe629172db libvirt-daemon-driver-storage-core-11.10.0-12.el10_2.alma.1.s390x.rpm c27ff6557e0c9cbea4a226d75fd05aeba146af351f8dd2857d6b8464156070e0 libvirt-daemon-config-nwfilter-11.10.0-12.el10_2.alma.1.s390x.rpm c4cb34043f8746485f6dc98061e7807b44e02aca08cd5cc53e8b96d8483e431a libvirt-11.10.0-12.el10_2.alma.1.s390x.rpm c68d84bb5f79152ecba9155ce80e6b94b9959a8a0f37a3f13be060f935c56e25 libvirt-daemon-driver-qemu-11.10.0-12.el10_2.alma.1.s390x.rpm caec8d8eff5de8fd669e703c0e5212139459b3866cb62ab9372b7adbfdf6c9c5 libvirt-nss-11.10.0-12.el10_2.alma.1.s390x.rpm cc8fbb2ef2dc351fd3c2764fad5cdebcdcef43e984cc07355e96dcfeb20ab482 libvirt-daemon-lock-11.10.0-12.el10_2.alma.1.s390x.rpm dc866d8ec45c0fd71dc0242ec2dfa6f587d162c1388373cf9849476fcd8898d9 libvirt-daemon-driver-storage-rbd-11.10.0-12.el10_2.alma.1.s390x.rpm e3365bf096776952a10708f72b9d435aa0dcf87c2f540779fec68ff733d21b68 libvirt-daemon-driver-storage-11.10.0-12.el10_2.alma.1.s390x.rpm e3a7e969449ba921e5eb4de930e310b7cf34d187b9813f64de14d734b2e201b3 libvirt-daemon-driver-storage-logical-11.10.0-12.el10_2.alma.1.s390x.rpm ee43a001055a527ba50fab476505c88067c2bdd17dd8d21d92cb2c6889fb7f76 libvirt-daemon-plugin-lockd-11.10.0-12.el10_2.alma.1.s390x.rpm f8f4248f6026098f1166b6d87d1bb3213fcec0c2ef21e6397fdc2ee431e7f092 libvirt-daemon-kvm-11.10.0-12.el10_2.alma.1.s390x.rpm fb65dc9f797be54606923f4c311337d91988f04d3f60e81526b45c2c1d49bdf5 ALSA-2026:18421 Copyright 2026 AlmaLinux OS 0 1 Moderate

luksmeta security update

LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libluksmeta-10-1.el10.s390x.rpm 15ddc13d71c086b8a74f12c8fbac4426cfe2dfbad5130cb3f679406c461e6b0f luksmeta-10-1.el10.s390x.rpm 88e5ebe8cb5b8a7f57332a3fdb4efe358800c4cbd6f8260c1e8eb153bb79da9f ALSA-2026:18479 Copyright 2026 AlmaLinux OS 0 1 Important

qemu-kvm security update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694) * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696) * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692) * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699) * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695) * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default qemu-kvm-block-rbd-10.1.0-16.el10_2.alma.1.s390x.rpm 01f30413f529a28b44a195f7dfd566f3e44c3d4a65a3f6a45d5c0d43d561033c qemu-kvm-common-10.1.0-16.el10_2.alma.1.s390x.rpm 1991d9d537778f169344010804e8c46d9a8566e3c9e9ff135b8252adfff0ff18 qemu-kvm-block-blkio-10.1.0-16.el10_2.alma.1.s390x.rpm 1cd3714070032bb25d12ba52ec1198ee94304c0dd50e50f878c5fee8498fb1da qemu-kvm-core-10.1.0-16.el10_2.alma.1.s390x.rpm 265c64d4af61d41e5ddd12dc9658e58013f5f5abc47c68a87697e509a0467327 qemu-kvm-device-usb-host-10.1.0-16.el10_2.alma.1.s390x.rpm 2f15448aca8fb69b6b4cd2bdf5a845e7ed6a6808cb51df498cea09c81690a805 qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.alma.1.s390x.rpm 33e4b45a0060d0eb211595bdfb7558d1f4914ddf5d3451248c09cf680c475813 qemu-guest-agent-10.1.0-16.el10_2.alma.1.s390x.rpm 347b0aba0712414da88b365d9f5c05d1197eb943cdaa30fecc95e7a78bc2b91d qemu-kvm-tools-10.1.0-16.el10_2.alma.1.s390x.rpm 3ea879433509c4eedb9420a32367dab71897a74c19959f5760dc5caf3295128a qemu-pr-helper-10.1.0-16.el10_2.alma.1.s390x.rpm 411aba59a91df85eeb591a0ea8e9aed46eafa4c7a5595ba65b18c636cf46edb6 qemu-kvm-block-curl-10.1.0-16.el10_2.alma.1.s390x.rpm 585d557526c9ccae7791498663520075d826e4a0b10016d24579e0703431d0b2 qemu-kvm-audio-pa-10.1.0-16.el10_2.alma.1.s390x.rpm 5f6001fe88dc60ba758fed0a4c1896443848ef6bd65a57621cfb67951b9f5699 qemu-kvm-docs-10.1.0-16.el10_2.alma.1.s390x.rpm 65d64c4ea67a821911f6e7ff94d26955a279551cc3ad9b21f8deab4844267425 qemu-kvm-device-display-virtio-gpu-ccw-10.1.0-16.el10_2.alma.1.s390x.rpm 770b220d5a1427a45ae2491ed43795f0b469753170a21105e63e2392d61c0c67 qemu-kvm-10.1.0-16.el10_2.alma.1.s390x.rpm e41638e84143df9afd5bef17d7d2a0474966c00cd59429dbc21f7153168b29e3 qemu-img-10.1.0-16.el10_2.alma.1.s390x.rpm ee59505654068c9d3a844ed73d3ebeaefee96ce75698f5795d3e9a5734f1ce94 ALSA-2026:18556 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: DNSBomb vulnerability (CVE-2024-33655) * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default unbound-1.24.2-7.el10.s390x.rpm 0159e8914dca6e578f42aacba4fd059eb8e7f11de5ac9490885e04e7dea60603 unbound-libs-1.24.2-7.el10.s390x.rpm 39b2c6db9069e266fb07c9b523f65cb7966e55bf629ad8bf13b392e6294020ce python3-unbound-1.24.2-7.el10.s390x.rpm 629c16ff19a61208a98d153cec2060e2a78784eabcdbf81537110a3cae45ffe6 unbound-dracut-1.24.2-7.el10.s390x.rpm ce158eac1943d822c8fc4fec8438b32021266625aff656c790e7bd5409b1f7de unbound-utils-1.24.2-7.el10.s390x.rpm e2c02461a6f38f6c7522b245c6ae8fa73519e06e0ef9610bb60b7f4a115e5e24 unbound-anchor-1.24.2-7.el10.s390x.rpm e6124ab5a1494f47730175bccb635fd89da4690b2a5ef13d5fdb076bffef9955 ALSA-2026:19009 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007) * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003) * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postgresql18-plpython3-18.3-1.el10_2.s390x.rpm 0d5388bd5ef0f6184612d929fcae068124da8a2fed86434162cc703c633dcf62 postgresql18-static-18.3-1.el10_2.s390x.rpm 2db3c9dca756341e0eb22b732ee19e9ba09196696afdf1ffdf0431d30fc02184 postgresql18-18.3-1.el10_2.s390x.rpm 318d95f005be0683b9c5a54b40649b4d482cbb92aa03b1c09bc83eab220775f2 postgresql18-server-devel-18.3-1.el10_2.s390x.rpm 443271d2c3b617a4ad2add5348eee18e08d3dbd6b313c2ea518e2c75e3c71ca2 postgresql18-test-18.3-1.el10_2.s390x.rpm 5ba66a2d2bc89b7c3b02b33f733b98fd4bb64f99884024f7064fec11641a0145 postgresql18-upgrade-18.3-1.el10_2.s390x.rpm 60d18022bcf6974aea2adae43e849941f4fe37da2d009a587c7d52c60ef759b4 postgresql18-contrib-18.3-1.el10_2.s390x.rpm 7eda28d6b299a8ab7f70c138fc45dc1882a782b608868e1027d688e8c12b6ba8 postgresql18-plperl-18.3-1.el10_2.s390x.rpm a71f6a8982909aab348bd1ab18ec6bf69d64020d6faac95e1e965b63644d8bfe postgresql18-private-devel-18.3-1.el10_2.s390x.rpm b73fc3c89773b430965b283f99cfce422260429eecf9bf97bd935fc42e677d3e postgresql18-docs-18.3-1.el10_2.s390x.rpm ddc3bb8bcccfcedc22a4b84ffd415e3a6b9fd3643c6706b25cb0adc96dab938b postgresql18-upgrade-devel-18.3-1.el10_2.s390x.rpm dfd68917a7f2872d7e8f8fb5fa77fe7da305f198fb7a1281dad8d67925f8752b postgresql18-server-18.3-1.el10_2.s390x.rpm e48957ed48ad8a278b13fa9f79f7b69678ce6a8d6468dafd863d537b02b85a6f postgresql18-private-libs-18.3-1.el10_2.s390x.rpm fbacc0947af7a1e9d160ded92b41eb96a8ae5037904c87be777f6a830da11130 ALSA-2026:19010 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003) * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postgresql-server-devel-16.13-1.el10_2.s390x.rpm 0c0494a339f0e870799304489ed6308ee6b32797c7f6b0b5e89d2a0aa7836ecb postgresql-upgrade-16.13-1.el10_2.s390x.rpm 2bcf91f4d489215bb6dab61e4b94ca14027b4d524a1f454bd279081e3e1ec267 postgresql-docs-16.13-1.el10_2.s390x.rpm 47ffba920fac5553b42621207a2247821a9c645ba93182d83ac71e3bc0a7f10a postgresql-server-16.13-1.el10_2.s390x.rpm 624c2cc73cac6637980b1899421a64de98de49621227da327039b76018a34e6c postgresql-private-libs-16.13-1.el10_2.s390x.rpm 86741636a39153c201ef448a75f3fb80b5a9c31829cb9ae3945fde29414c18cc postgresql-static-16.13-1.el10_2.s390x.rpm 8cd218c52873cfeffdfc64d50155986061fa12e2de54e44c7392bafe2a346b47 postgresql-pltcl-16.13-1.el10_2.s390x.rpm 9018eb347644e4132a89966c0aa66aee995c6b44f2e1b7d5139e4ad48e20ba73 postgresql-contrib-16.13-1.el10_2.s390x.rpm b635d56df2caa6074ec9a6db7d54c9bbf96448ecd03898aa3e1bbd31361d7ed5 postgresql-private-devel-16.13-1.el10_2.s390x.rpm c545766a684d3cb045d6f554e654ca932d779834c33cd3c62d7354ecf4875290 postgresql-plperl-16.13-1.el10_2.s390x.rpm c5c2e4c652d3302e56effb512fa84e899efbe9688c9f140cfef58f430aface3d postgresql-test-16.13-1.el10_2.s390x.rpm d40fa356e3a3b7f735a053ea14cd73b6a10575cadd5da1dec50d8e648a2b2c9a postgresql-upgrade-devel-16.13-1.el10_2.s390x.rpm da868281760f7c4ec8d216e5a33c8173ff95ebe7f2a9028a230454218580e65d postgresql-16.13-1.el10_2.s390x.rpm e7ca4be01dfd306225be4cb2a1b63d95a36fac0891dd000c92cc7f215dcca630 postgresql-plpython3-16.13-1.el10_2.s390x.rpm ea0cf7cbad95a01fb7843f5aeb2340d9a81331ce507078b13ffc8e81485e4731 ALSA-2026:19017 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default podman-docker-5.8.2-1.el10_2.alma.1.noarch.rpm 167be1b8d65574dac9045abe3e1e0b9208ed8e6c2c2c8b29b83d77c4173a468f podman-5.8.2-1.el10_2.alma.1.s390x.rpm 46434809c83f7e006528fa1aeb480e05b19d424b38a1a1f8d3b0fbb83df48b0a podman-remote-5.8.2-1.el10_2.alma.1.s390x.rpm 66dd7bf515e57dc79dab9157d6392bd6a2f98bd21bdd9d53b4333644ad466097 ALSA-2026:19019 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3.14-tkinter-3.14.4-2.el10_2.s390x.rpm 1ce5667bd1920f74f616e9c18a2d8c1863ecc0d7fe1893c4a528e40b796f93b2 python3.14-devel-3.14.4-2.el10_2.s390x.rpm 2ffa350766828d92904b17c39a761e8207b06a7d37569e1d5c616efd8303527c python3.14-libs-3.14.4-2.el10_2.s390x.rpm 569700be3d34325d357d49db1e5ecb6d6c3270cf4483f01ab03c5deb90c0a248 python3.14-3.14.4-2.el10_2.s390x.rpm ae6a4ffbfd88e609bfc816091e06db2983465392908e5eb6acf38edaddd0dca7 ALSA-2026:19020 Copyright 2026 AlmaLinux OS 0 1 Moderate

crun security update

crun is a OCI runtime Security Fix(es): * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default crun-1.27-2.el10_2.s390x.rpm d0c5d6fea39bb6da41d971614ca6c026d4bc5610b391cfa39640caba1b23bcef ALSA-2026:19022 Copyright 2026 AlmaLinux OS 0 1 Important

golang security update

The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default golang-1.26.2-2.el10_2.alma.1.s390x.rpm 2ac8d0725813d5561ff8888509da10bccd045ad274f89750213cdd73a7036282 golang-race-1.26.2-2.el10_2.alma.1.s390x.rpm 48e2dad9f2aa2acf062baa67bd417d702863c28b8fcdf42183b66751570bb1bd golang-tests-1.26.2-2.el10_2.alma.1.noarch.rpm 86ddbd7f00012fa580ea1c9edb33d9e5982eef71b38e0283ad2659fa61352095 golang-docs-1.26.2-2.el10_2.alma.1.noarch.rpm a7b9810b608f99d1d4e8dc8771e6e1493f6f39113e88f56ae83bd92548afe904 go-toolset-1.26.2-2.el10_2.alma.1.s390x.rpm aaae45c676045e299bd952d780f757a034fe5e0f9bf4b8021f46642a4b3de6e4 golang-bin-1.26.2-2.el10_2.alma.1.s390x.rpm b8cefd17c695683067598044b26f4ddf3941759cda40415b1cd35f5fa901b0ba golang-src-1.26.2-2.el10_2.alma.1.noarch.rpm dbf8e7996f83be39afa1954de0ab45d661a96b356a3e406a1960cd6be572a7bb golang-misc-1.26.2-2.el10_2.alma.1.noarch.rpm ff930bc6ddd8d4469f1e7d1cab514142b71eff36da84ce419045251ce79e3e17 ALSA-2026:19024 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.s390x.rpm 09ab24a3abb9330079854a5abc7ea682edee9d5ed0f39d484877140b766032c2 gstreamer1-plugins-good-1.26.7-2.el10_2.s390x.rpm 13fa45e951b6d969ea1a40da866d9d5150261ada4df7bc7dcc1f59aec71bbe8c gstreamer1-plugins-base-1.26.7-2.el10_2.s390x.rpm 22f976191a2ddf74aba38abffdf8b3e59c4510854f40288780a4621acdde2f65 gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.s390x.rpm 39be9fe8b729b23263843668187613537e64b0a6e1a5703b31920b845e879d10 gstreamer1-plugins-bad-free-1.26.7-2.el10_2.s390x.rpm 545d25c7c08f3b7b61fc5ecadef2795b8c022cef04292cf1164ae80adb4e57c8 gstreamer1-plugins-base-devel-1.26.7-2.el10_2.s390x.rpm 7163b2e22a846ca1b2a8a068ca60dd68862995196beb1a587a19496b2259cf63 gstreamer1-plugins-base-tools-1.26.7-2.el10_2.s390x.rpm 945104f815a1a766ba8cae0988eed6bd73b5a1e4f3318a0e18b34fcd21a67e4c ALSA-2026:19031 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default skopeo-tests-1.22.2-1.el10_2.s390x.rpm 3a58e8539a9ab788b567a921fc15f9d8450faedb51d690119d76d22533520475 skopeo-1.22.2-1.el10_2.s390x.rpm cc0ad61ec401ee3d0a76dd8e7992f2b7cee5f24d07ba46a2511d4819864c9f10 ALSA-2026:19032 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default buildah-1.43.1-1.el10_2.s390x.rpm 6dda869fe9eb6fe56138d7892a79d7facdc8ac19a56073bb7683c198206542e8 buildah-tests-1.43.1-1.el10_2.s390x.rpm c154bb48bc696cb406d2bc1a7c5c0a76d93794ab5c54e3671c8f33e892f0adda ALSA-2026:19034 Copyright 2026 AlmaLinux OS 0 1 Moderate

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958) * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-tornado-6.5.5-1.el10_2.s390x.rpm 17b68a9295977150ccabe720c587dd482f15e1a815f081bec50a3cd7a649bfe5 ALSA-2026:19042 Copyright 2026 AlmaLinux OS 0 1 Low

python-jwcrypto security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-jwcrypto-1.5.6-5.el10_2.noarch.rpm db89aecbcd378aa983e05761a6b2cbca01c3a05e38a708730a9029e277498a12 ALSA-2026:19043 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default corosynclib-3.1.10-1.el10_2.1.s390x.rpm aa7a48eef2d25b0ade9a0b2a9698bae39e21101d117688300a93fd71ff86687a ALSA-2026:19053 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default freeipmi-ipmiseld-1.6.17-1.el10_2.s390x.rpm 3a5ab11fe7882f0e4918e910c4fc924bd27c926426931c2662b3cbeab6ffa235 freeipmi-1.6.17-1.el10_2.s390x.rpm 433fde6ea2077b60ac4ed1bed22c2adc4a43b643f6a5a8c16877a5ee488d581c freeipmi-bmc-watchdog-1.6.17-1.el10_2.s390x.rpm 6780c95a11b34e479fa4d2221cba63dc196c6907b47e71bc4539128c81f3c8c2 freeipmi-ipmidetectd-1.6.17-1.el10_2.s390x.rpm b66b1cc09174b62a8d26ed94153c14262f521cd7d78f59f6e47aecfec2e9363d ALSA-2026:19054 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm 032f9dfd26c60d1d72b363ff2061d11662e957528f62a47531f5bbf5f865b387 tomcat-10.1.49-1.el10_2.1.alma.1.noarch.rpm 30074a00cdb2fd116e1a86d0dd4fde4c0ee1ad6c1d76871cede1af36c10ad784 tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm 910908c4cbeb19192b15b52ff7bcb553a79de45a9fd931d50fa458956364dc8c tomcat-el-5.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm a4ea29cfcc7dc0b39309a55f0cb9f6825d1b6965da13f87f41af81d7293301e1 tomcat-lib-10.1.49-1.el10_2.1.alma.1.noarch.rpm bf8d00201d00c1d371bcb29fde0b79354efbec1bdd757baaebc03477a5d83d5c tomcat-docs-webapp-10.1.49-1.el10_2.1.alma.1.noarch.rpm cd1899698b4ef517e177bafdcbdb1e1542a1f0c867d8b7fefb87b3e46b4b54bf tomcat-admin-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm d5a2b5453e34039aa491637abe23194a845e0a52cb69be855ed09fbc360ed9f7 tomcat-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm fdbfa914a61bc11297a055cca8ba8bb8c9d37d90b771583e8b8b87d3a7a388c7 ALSA-2026:19061 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437) * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glibc-devel-2.39-121.el10_2.alma.1.s390x.rpm 2085d02df350f40d321a2d34cc7c0bd3be11a15db00c8c450843c9059f6fb438 glibc-doc-2.39-121.el10_2.alma.1.noarch.rpm 8e5944044c77883ffcdf699a95b72c6bb5ec1b40fe769362ba84948c5c446f4b glibc-locale-source-2.39-121.el10_2.alma.1.s390x.rpm b826cf30e02cc2148f226a1740ab4ea35689003a903a553e036494daedf95553 glibc-utils-2.39-121.el10_2.alma.1.s390x.rpm ff479f617424ebd5e98a69ff413253a55ce5cb1aec98e9205e91d8a765e32892 ALSA-2026:19064 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) * cpython: Out-of-memory when loading Plist (CVE-2025-13837) * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282) * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-devel-3.12.13-2.el10_2.s390x.rpm 4fc91b147d4ec3362835b10378eb0dc9cbb081be5f25f09af64a53d2ae332d6d python3-tkinter-3.12.13-2.el10_2.s390x.rpm 5da59b2ee47b6ac42bbcbe8dbb2c0388e4000e62b586025262bd83ff88dc0567 python-unversioned-command-3.12.13-2.el10_2.noarch.rpm e02dd9af1061d81e9eb4f3b2ab2cee1f8bcaa3917c0c834b9885fbcb4199da2e ALSA-2026:19066 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssl-perl-3.5.5-2.el10_2.alma.1.s390x.rpm 24ddc0444c3be3dd995ea4055e7203afd96369addd1b603e27bb00fb453cd412 openssl-devel-3.5.5-2.el10_2.alma.1.s390x.rpm cdeb6eab4cde572f63195b8dbc87325ab3fc04925f7aa7ea00c9ac8537592d11 ALSA-2026:19067 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Privilege escalation due to failure in privilege drop calls (CVE-2026-35535) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-4.p2.el10_2.s390x.rpm 9c1ad1a8061645deaf6d2da55663543eb4321b300483fd9353ee9302d7493747 ALSA-2026:19068 Copyright 2026 AlmaLinux OS 0 1 Moderate

systemd security update

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default systemd-devel-257-23.el10_2.1.alma.1.s390x.rpm aa54ff77c57f9a20b04e9a1916e3c8d0c79325b90fa7483b760c3814af509db5 systemd-ukify-257-23.el10_2.1.alma.1.noarch.rpm b19a2e5d5ceb000880e9a0b2e332123c6cc5f6052003d8b27a6230bc528bca3a systemd-journal-remote-257-23.el10_2.1.alma.1.s390x.rpm d596c2ce5cd2f9ed9fae594d0c736cb8ad76d65855fe64bf4d9b05cf2b3796ba ALSA-2026:19069 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode (CVE-2026-35385) * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414) * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage (CVE-2026-35387) * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388) * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssh-askpass-9.9p1-23.el10_2.alma.1.s390x.rpm 12838ae1a3e066ad4d7bb6da69c7175d911544a657778f47ff5716e7a83a0bbd openssh-keysign-9.9p1-23.el10_2.alma.1.s390x.rpm f99524a37392b799f8b8656a1f7bb9dc274829b946f1348971fa28257a2c2949 ALSA-2026:19073 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default xxd-9.1.083-9.el10_2.2.s390x.rpm 596f41912575d3e31d8e71624f524f28a6ec45735a8a5f3b6619e6d72fce0790 vim-enhanced-9.1.083-9.el10_2.2.s390x.rpm a61bfa4fe512cedfe48cc9345c7d84d37f57034cdbdf9cd139ca2543d342204b vim-common-9.1.083-9.el10_2.2.s390x.rpm c8628be9fee2cdf79802ace978f6fba13b9626f0ca8dc097bb578001b9088f3b vim-X11-9.1.083-9.el10_2.2.s390x.rpm de0c013fb03828deac8d90d4837cc5606dc6f3c48e93ef013fb0b3dd9d79bf4f ALSA-2026:19074 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677) * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-headers-6.12.0-211.7.3.el10_2.s390x.rpm 0379a64cdb434c01d6612fe4308a38898d6866a7785a5e9629d9c768251a024e kernel-doc-6.12.0-211.7.3.el10_2.noarch.rpm 2a68239ba7e1ffded8f59859942aad0efdfdc10912c47834975a6dd22a799961 perf-6.12.0-211.7.3.el10_2.s390x.rpm 36bffca631eb8d059bea485c91a048d9d7eade22618fe81856eaf6c52febda83 rtla-6.12.0-211.7.3.el10_2.s390x.rpm 6b6d460618086c25eaf67ef400cca3e27428c4f0c4d8ea9ba2337a12157d74a7 kernel-zfcpdump-devel-6.12.0-211.7.3.el10_2.s390x.rpm 7c08fc4dcbb877213445c2d659506ca11d8cc6b49a825bee10e89ae1b986c92e kernel-debug-devel-6.12.0-211.7.3.el10_2.s390x.rpm 951779e32c7ad8f72c7c044ea259ef05e3e9c9ae05321b2921bcb5aa1e324efe python3-perf-6.12.0-211.7.3.el10_2.s390x.rpm a352f24a8d2a5edc0ee0f1c819361d26a15c109a63c535c87cf6c218df501010 rv-6.12.0-211.7.3.el10_2.s390x.rpm a8eed96b22dbb0a9d7e7ecadc717cbab423895ec4be5d2847e1fc0db2c4052dc kernel-devel-matched-6.12.0-211.7.3.el10_2.s390x.rpm d82da2243c4c6ec149bb7719c8a47a119fc306c9c1ebf35c0765539200e682bc kernel-debug-devel-matched-6.12.0-211.7.3.el10_2.s390x.rpm d968d8dce5b5a96979cde72853ce9f2db67e0f839a1c2a138a55d45919c37ab2 kernel-devel-6.12.0-211.7.3.el10_2.s390x.rpm e022281fa0fd91898ac0ca273da2152aecabae4f820b5296aa86d3ca6fb1535c kernel-zfcpdump-devel-matched-6.12.0-211.7.3.el10_2.s390x.rpm f4c472e6f129e61bd9c8d343083ffa02c7aac29f23776392fa33b2adbe9f918b ALSA-2026:19125 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.s390x.rpm bd81c0706fdb94db3cf7b7da49d75cb50533a42393890ef1076120d066489141 ALSA-2026:19126 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default yggdrasil-0.4.9-4.el10_2.s390x.rpm 13b403a820c97a4cbacbc7c82f2b77461e2ee1a242387834bd431e37ef27e1b5 ALSA-2026:19127 Copyright 2026 AlmaLinux OS 0 1 Important

gdk-pixbuf2 security update

The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. Security Fix(es): * gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gdk-pixbuf2-devel-2.42.12-4.el10_2.5.s390x.rpm 2f51457695ec1b1e6448272091108175db2a4116a0d910abe9f32ac92c6db60a gdk-pixbuf2-modules-2.42.12-4.el10_2.5.s390x.rpm 3826a031b994065f511bf59db04ad3de12435bbaf45815c1d6ea8156a77f8656 gdk-pixbuf2-2.42.12-4.el10_2.5.s390x.rpm fea5defd34b3fa8a478dbb9905722e4c25a20ec0ecdfce3b9e0f009139bba7ab ALSA-2026:19128 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-6.el10_2.s390x.rpm a73de8fe33dabaa4e77f605339670aff9046f6d5574aab16cf5c4f106b60e5b9 ALSA-2026:19130 Copyright 2026 AlmaLinux OS 0 1 Important

libcap security update

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities. Security Fix(es): * libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libcap-devel-2.69-7.el10_2.1.s390x.rpm 9e75f589c9846e5c50b72738f300647729789f3f2f4518652dd5589803296bfb ALSA-2026:19133 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default git-lfs-3.7.1-4.el10_2.s390x.rpm 35d62d28820cde544a2048e78eab5c687648c2e7aa147c2fab18015bb09b62be ALSA-2026:19134 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default grafana-10.2.6-26.el10_2.s390x.rpm 64472fc2335caba4fab3d0bd1300f3de0b6ab7e76731365e85d06e42c878d7f6 grafana-selinux-10.2.6-26.el10_2.s390x.rpm 7cd33e4287322557731876040826e89c2a3ddd4009b1e39ae254ec9b7da7b37a ALSA-2026:19135 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default opentelemetry-collector-0.144.0-2.el10_2.s390x.rpm 8545fefe3c20ab87e20ac41f0048e7c522f4b471595e43d827cfa06fa213f152 ALSA-2026:19136 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default grafana-pcp-5.3.0-5.el10_2.s390x.rpm 7c353bc73600873278d8b65adb5f1c1381c2dd1f9305796f3aa53e456d7f2a4f ALSA-2026:19141 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default PackageKit-command-not-found-1.2.8-8.el10_2.s390x.rpm 0e26f57bdca0dffad054f9937a3396afe7a4a6dabb99ca528dc3eceda603ba67 PackageKit-gtk3-module-1.2.8-8.el10_2.s390x.rpm 0e29d09b3087af259a2c42be6db5af675c506682f27a711c1774b1edd4d6681c PackageKit-1.2.8-8.el10_2.s390x.rpm 4fdabe3a2b966f0575a5bde61ebf5017f0f4a64a552ba71bb4102962a9b1725c PackageKit-glib-1.2.8-8.el10_2.s390x.rpm 824558a7f3b96e915f1669a30c2deb032fcb578bd7b8115a9304268c8f6cbecb ALSA-2026:19143 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271) * libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libsoup3-devel-3.6.5-3.el10_2.11.s390x.rpm a9aa6144bba1fe96d10fba0c5c3fd727dae58853d7090430e5bf9d41b8bead08 libsoup3-3.6.5-3.el10_2.11.s390x.rpm ac1e6d86d494bbd3f54c7a85f5cdfb44049e5f784c33bea6cde39bff1cac9683 ALSA-2026:19145 Copyright 2026 AlmaLinux OS 0 1 Important

krb5 security update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). Security Fix(es): * krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356) * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default krb5-devel-1.21.3-10.el10_2.s390x.rpm 15138dd101de09e6b1fd19770c4d7d4f05f57f300ee82dd66c057eae58cc520b ALSA-2026:19146 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openexr-3.1.10-8.el10_2.2.s390x.rpm 7582d0e27dd1a02a1dfc41878f62b604bd1c5588ed96f5bb46319dd6171f7923 openexr-libs-3.1.10-8.el10_2.2.s390x.rpm f6d0929b788935994804dc31aba6ac457ffe2b6494219824ed4e656a45abe1a8 ALSA-2026:19148 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.13.s390x.rpm 254325c7bbbc4f59bf4b26bf5b5adc1e4ba63d12134eb6166e5639433e56b60a glib2-devel-2.80.4-12.el10_2.13.s390x.rpm e016151ae1189231a87d9f7b6ce91310c9a0811a1d3fa9acaa2eeed317030d12 ALSA-2026:19149 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dovecot-pgsql-2.3.21-19.el10_2.s390x.rpm 121d20b4d3b83dbf751b740bf49abac9f255cae28c197676ef426442d1041f6c dovecot-pigeonhole-2.3.21-19.el10_2.s390x.rpm 1647928d1a366e1089cf78274c3e5b31a3ab3065eb74023bd5869d3161e1643f dovecot-2.3.21-19.el10_2.s390x.rpm 3cbd2c661b6354aa8bc69e904a605b38214b925b6c2704eec09520c99f02f3df dovecot-mysql-2.3.21-19.el10_2.s390x.rpm 41e24d206170f151984014a607da6c4361dfe3eddf27d01141273b1b9c87aba5 ALSA-2026:19150 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libtiff-devel-4.6.0-8.el10_2.1.s390x.rpm 5a228952180bb2e8efb41aa4bece79c5ce5e1aa1efccfd0d4b187caaf175de4c libtiff-4.6.0-8.el10_2.1.s390x.rpm 5aaa4060f70b2a41034e762ded09ebf594c9d505fdad35c6b8175656e0555c8c ALSA-2026:19152 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rsync-rrsync-3.4.1-6.el10_2.noarch.rpm 6ce73c87a6758941f9efbd47f3a5dd2a2ea31d8602fe86d9b50d137c2939e69a rsync-daemon-3.4.1-6.el10_2.noarch.rpm 9f76d6a1f61310d5e7fb2cad97fccf750d8a2777db08a53fec77160350cf917f ALSA-2026:19153 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323) * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320) * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322) * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default thunderbird-140.10.1-1.el10_2.alma.1.s390x.rpm 941135fa79a4a26b1b1713bff2eb68d6f526aefcc0d9c596d70cbd19e4715c04 ALSA-2026:19154 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default giflib-5.2.1-24.el10_2.s390x.rpm 23ce7c07af879054ffc28209cb25687cb0cd1094bc9dc7731e774667acc539c1 ALSA-2026:19157 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323) * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320) * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322) * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default firefox-140.10.1-1.el10_2.s390x.rpm b872e935534af4501b1c9163c961015fc0a46905bfb1fc5ea2a548852136ca15 ALSA-2026:19158 Copyright 2026 AlmaLinux OS 0 1 Important

dnsmasq security update

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dnsmasq-2.90-7.el10_2.s390x.rpm 15a332757188f31e4aadfb55e33410c7ef2c50ac9c822325b534ac6479d0a5d2 dnsmasq-utils-2.90-7.el10_2.s390x.rpm c40e80f425a0b4cec1019c5afc1b24c10d0cacc8d4c8821f56b62e8130e56112 ALSA-2026:19159 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nginx-mod-http-image-filter-1.26.3-6.el10_2.3.s390x.rpm 0719461e191ccd14c525201f83e9d9970051b16a9df47870927e82643fcc2360 nginx-all-modules-1.26.3-6.el10_2.3.noarch.rpm 3f0c16ba9b852a8917cd5d6999e2c127f547446efc3c0f2cf3c5eefc43e389c4 nginx-1.26.3-6.el10_2.3.s390x.rpm 444916c9967ab47dabedd478b07aa9bb865b6b4db376dcda643b4c6509d71fe5 nginx-mod-http-perl-1.26.3-6.el10_2.3.s390x.rpm 5eb12f5711d605a52ed984f2b0cf36c64a45663f1cafc1762c30187b51a8971c nginx-mod-http-xslt-filter-1.26.3-6.el10_2.3.s390x.rpm 75bde0e1d3760b25be2bd544f3b4d4851a61681da9860b8d3ddb174ccd999d5b nginx-core-1.26.3-6.el10_2.3.s390x.rpm 7b0d39a69c67775c66eacaf8f168c3275d27e36456691e6e056eee691952f8eb nginx-filesystem-1.26.3-6.el10_2.3.noarch.rpm 8890f406349040013ca50201c62964d631bbd50b288c439c5ab1bfd5bafc9330 nginx-mod-mail-1.26.3-6.el10_2.3.s390x.rpm b7d267be65f17dbab714e4d0bd183a123899b7189a3f9b9e916f4bf01bba3558 nginx-mod-stream-1.26.3-6.el10_2.3.s390x.rpm f28d4d0db88f060f52e9dede6082f810940865bfd01b8b171492e59cea6cb27e ALSA-2026:19160 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Other issue in the WebRTC component (CVE-2026-8094) * firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092) * firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default firefox-140.10.2-1.el10_2.s390x.rpm e2795bcc4a4c1a0b5d6e96537b553656e40d8c1fd794cfaecdce1486da3c0394 ALSA-2026:19560 Copyright 2026 AlmaLinux OS 0 1 Important

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libsndfile-utils-1.2.2-6.el10_2.1.s390x.rpm 54caaa1fab4006206a57dcb94d205bca8f8d2926cf8c26546c5e111cb84936da libsndfile-1.2.2-6.el10_2.1.s390x.rpm a49fcd408456b0363f15bb8ded9269a685a467a5f01c8395e38cc12a565377c7 ALSA-2026:19569 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-headers-6.12.0-211.16.1.el10_2.s390x.rpm 1976e46ba315f68c1c900c67b764a09fa9606436b6f28b60c6aabc30de93a8d1 kernel-debug-devel-6.12.0-211.16.1.el10_2.s390x.rpm 1cad4ad2cb7e3ed5620dd75c936f0da764d7e6a2e44c60c1f29adbc0cc049845 kernel-zfcpdump-devel-matched-6.12.0-211.16.1.el10_2.s390x.rpm 262afda1a724b6efb31b306328964fa936a95fedc5bd53ff62d73af15d9fe2bc kernel-debug-devel-matched-6.12.0-211.16.1.el10_2.s390x.rpm 3e846017be7479fa70ad444f368a7ba22ad7acf5de48bdea6854fa33295b6fa8 python3-perf-6.12.0-211.16.1.el10_2.s390x.rpm 426f7566f0c494f4eeced7c6c154710766cb24a245c9436a11bd034c7ff6e175 rv-6.12.0-211.16.1.el10_2.s390x.rpm 440a55796ddb1800ec50a5823a98453b2b27d69384c4904fed002b38bf593ce7 kernel-zfcpdump-devel-6.12.0-211.16.1.el10_2.s390x.rpm 908a5c82eb98827b1bb3a07db31a0145c05dbd3cbb978e2ee42de3f69572facd kernel-doc-6.12.0-211.16.1.el10_2.noarch.rpm a30d005f590aa010563453b7942bdd2cfa63cee5945427cf1bda74dd421aed6b kernel-devel-6.12.0-211.16.1.el10_2.s390x.rpm a8de058ae17768592946d6f89c5c046fe89f948dfdd24ed0668aa183aef2557e rtla-6.12.0-211.16.1.el10_2.s390x.rpm ab4acd909c9298a9df5dfb037ba825fb8d33b622b7b505524b4615414f885cbc kernel-devel-matched-6.12.0-211.16.1.el10_2.s390x.rpm d94ad4445a0651b1e27a851bb47d0912a14c2de5b5495fb93075d42c9eaa4d0b perf-6.12.0-211.16.1.el10_2.s390x.rpm f920d0504bfb513e5df961d23466da678e3b786d2e8013a62b34a7756fdaf0ed ALSA-2026:20594 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glibc-devel-2.39-124.el10_2.alma.1.s390x.rpm 5524e433a17775286e92a2a88c91bcbd81b972e069649ee4723d7d16fe24628a glibc-utils-2.39-124.el10_2.alma.1.s390x.rpm 8e36ec3487a20d4866a9948eb4359b401ab4980b524b99afbd7cccfe0b1645df glibc-doc-2.39-124.el10_2.alma.1.noarch.rpm c589ecc76ade948f7fc3324ba9ed3bd004cb7f413e99688e10998fd997695708 glibc-locale-source-2.39-124.el10_2.alma.1.s390x.rpm fa724f109005c4b28fbd42c3013fff84071834a4f1033dd0819512c6477f637e ALSA-2026:20600 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405) * wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVE-2026-5656) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default wireshark-4.4.2-10.el10_2.s390x.rpm 3cbb04c7684d7bbb81950e75c235812a7a8cb7de578305ce8046ec3cd0306131 wireshark-cli-4.4.2-10.el10_2.s390x.rpm 7ed07c26cf177b6d691d8ee6ce4c0fe2c359746ebf3a8ee23fe80578dbc3c47d ALSA-2026:20606 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ruby4.0-rubygem-mysql2-0.5.7-34.el10_2.s390x.rpm 3a6283d7c3aa38fdf4fb7ffacdb86e45dfd316cc3de7bbc63674af727dddb48d ruby4.0-devel-4.0.3-34.el10_2.s390x.rpm d08f60f12e19daf32d23c29100eae2256705b94b7156815a4fbbea82d897dcfb ruby4.0-4.0.3-34.el10_2.s390x.rpm e07cc1c12f36687114b405b936c3f7fc21390f55ce669a868346a3d38425687f ruby4.0-rubygem-pg-1.6.3-34.el10_2.s390x.rpm e492ac20feffd666d69a6a614abbb6735951a1189b52f5074c6482a12d517039 ALSA-2026:20613 Copyright 2026 AlmaLinux OS 0 1 Important

gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009) * gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845) * gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010) * gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833) * gnutls: Fix intersecting empty name constraints (CVE-2026-42011) * gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gnutls-utils-3.8.10-4.el10_2.s390x.rpm 60757effda46afbb6fca0755ea6af28ca96ce81ae4fba96c39d4efc98ba1b954 gnutls-fips-3.8.10-4.el10_2.s390x.rpm 94103e73cfd4805cf4c55b24a7c4b061f692a457d9dc9f5ee56310cb2ad44b19 gnutls-c++-3.8.10-4.el10_2.s390x.rpm a69a813ca7d4d8766dada811b02814cab9fd3f55f92496ecd48c5468ef8e2895 gnutls-devel-3.8.10-4.el10_2.s390x.rpm a7b0892ec516bc3998611c6f57350d49e1b44a4070fc79a82ebfdd588ea108ad gnutls-dane-3.8.10-4.el10_2.s390x.rpm f1a3c6b05883932c2eb5b9f8d80a37653f6d593ed47aa458f5b461e1ab9b8c49 ALSA-2026:20693 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236) * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mysql8.4-common-8.4.9-1.el10_2.alma.1.noarch.rpm 0d7ccc94e1089ffb6b3fbcd721eec0fed9e1f3494a20fd6d6458a4b6df88a845 mysql8.4-errmsg-8.4.9-1.el10_2.alma.1.noarch.rpm 1be911010c4913a85c01b874457f48ba4933cb9701ec3fe5760128223f810f45 mysql8.4-8.4.9-1.el10_2.alma.1.s390x.rpm a9d158aba6eafd9a428138f5b2c499effa3604e88a07d80b67e23b9efd0f8843 mysql8.4-libs-8.4.9-1.el10_2.alma.1.s390x.rpm cf1eb4931760830aa4f73a410e07a933a4f408ec584b970535e03b12214dc03a mysql8.4-server-8.4.9-1.el10_2.alma.1.s390x.rpm fcdf40a0d8e68467c847fc237bc878b60d81414c86ffdaaff42dc2b4116642cc ALSA-2026:21286 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-sdk-8.0-8.0.127-1.el10_2.s390x.rpm 0352d4f7fe621012ea0ef32be7c8811ef21cef81f959a1ae598a9f61de663b5f aspnetcore-runtime-8.0-8.0.27-1.el10_2.s390x.rpm 0c1aa056767ba5bee42aa9fbb87d2d82890bd299164feee74919a1c732068710 dotnet-hostfxr-8.0-8.0.27-1.el10_2.s390x.rpm 107002b0186c79b814ecc9d0adcf946837cd43c389f8922d5bbbfa2167f5306a dotnet-runtime-dbg-8.0-8.0.27-1.el10_2.s390x.rpm 399f26a64e557edb15a747e8054d6d81af5cf2fbed14c776fca7dd2e545c5ccd dotnet-apphost-pack-8.0-8.0.27-1.el10_2.s390x.rpm 69c0179cc805ffb77fb545a467fb9111c4e281e329dcd7e0925fb8f36600a7d7 dotnet-templates-8.0-8.0.127-1.el10_2.s390x.rpm af22ae34dc5a0275ec7a6fd5143c97b8d33f9f06dd19fc2722a491aac93d08a1 dotnet-sdk-dbg-8.0-8.0.127-1.el10_2.s390x.rpm afa4ca2cfad996b9a10933656b56f363c800bb9f3e8e87a3b5215aa6412e8dcb aspnetcore-runtime-dbg-8.0-8.0.27-1.el10_2.s390x.rpm c8059caa1d16655f41ee5293a904c147cbecbf78e2e897383ce556479b0270e9 aspnetcore-targeting-pack-8.0-8.0.27-1.el10_2.s390x.rpm e3b368c03d0145504bd178241fb340427ae717694a86ca021dbaa370de225aaf dotnet-targeting-pack-8.0-8.0.27-1.el10_2.s390x.rpm edc3a0d47944313d7a40345fcb96fcfdf7be23a447b7ffce63a109025e6d1c0a dotnet-runtime-8.0-8.0.27-1.el10_2.s390x.rpm f3207656bc716c290caf72eb520f7962837c024f49c391a4b2bcec2fc8cd7168 ALSA-2026:21380 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default firefox-140.11.0-1.el10_2.s390x.rpm 736e1c006605fc107d3cc759b21b614ecbe36d89f2c5de76a45a0015d38d7085 ALSA-2026:21433 Copyright 2026 AlmaLinux OS 0 1 Important

httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default httpd-2.4.63-13.el10_2.1.s390x.rpm 1e312bf7b1f2faf0af7162e7fa3cc225f1aeb2c3cee10aa1ef4f59da1cd30fe0 httpd-tools-2.4.63-13.el10_2.1.s390x.rpm 221c3c5189a5475ca363699ac9dadb48c69567b8b3c0e4904daa64ac5f145fe9 httpd-core-2.4.63-13.el10_2.1.s390x.rpm 56c608361ddae54c76b46546518470ae869844cf664bbe1ee10d242d2ff94b6b mod_session-2.4.63-13.el10_2.1.s390x.rpm 6073a7f35f75b20bbc9a99913fd0bae0deea96f8b5837a20ee3e4121a41197c8 mod_proxy_html-2.4.63-13.el10_2.1.s390x.rpm 76dfb82d6ac4f3c1d47fd54e6d48f1fa79f2352ff0292398f456fe8fa65393cd httpd-devel-2.4.63-13.el10_2.1.s390x.rpm 884ee45aa438095e5331683cabba47564bc776c91d6d9850b4e93f24a7960761 mod_ldap-2.4.63-13.el10_2.1.s390x.rpm bbe22201a21aa0deeaf4e796a367201dd38b694ebd1ca3c2b7a4a8165b27c87c mod_lua-2.4.63-13.el10_2.1.s390x.rpm cea3543f5c0f602f9eb8661055f42c9b1f11edca2f1dde7edfc73fa653db55c7 httpd-filesystem-2.4.63-13.el10_2.1.noarch.rpm e031b93501860443509180fc94ca9fd2f55bb1e5c48013833c3648cf8b45ea9f httpd-manual-2.4.63-13.el10_2.1.noarch.rpm e3cfbdbc5fcf4512653e1a0be2d6396861efc9b9c15498e4543c0fcbc556c07a mod_ssl-2.4.63-13.el10_2.1.s390x.rpm e8686bd0a8a44651a2d3b7aae5cbd55bf09f0c00b71c3ebf628a831247cb07d2 ALSA-2026:21557 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375) * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392) * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006) * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020) * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051) * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023) * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110) * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190) * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205) * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.18.1.el10_2.s390x.rpm 001b9132c45fb050412c1ba4ccffe6aa7239d1f6c129010615edaa817adecc59 kernel-devel-matched-6.12.0-211.18.1.el10_2.s390x.rpm 1fbc4490ed73850224ec1ecb2301034b8fd85dea7b6fcb8bdbd981cb66fa310f python3-perf-6.12.0-211.18.1.el10_2.s390x.rpm 44140f6a7da815ec4f1127eb5e4b7b9ecc54e00316708dd4f7a60832e3915d13 kernel-debug-devel-6.12.0-211.18.1.el10_2.s390x.rpm 4b063fc15d8c7a872c77263b74d2d5e37d58400c5634848bb955624efafafa4e rtla-6.12.0-211.18.1.el10_2.s390x.rpm 4fe5e7ebdf22c02406609a230ad652b28f0d3d8beef26876ac3e1a3be4bc7120 kernel-zfcpdump-devel-6.12.0-211.18.1.el10_2.s390x.rpm 6d3fdc6b9af8971f924e0a5efd6f3f4f9f0ee2e62f716925998f86ad2821acf0 kernel-headers-6.12.0-211.18.1.el10_2.s390x.rpm 8c2061c55472de46ff721ff744a9088a390743450adbb774fc2cc2a6e90e7b40 kernel-doc-6.12.0-211.18.1.el10_2.noarch.rpm d65ef7f528d990c65a6b7fb8ffc6e3ded25ceee509be5fa08d627d0c203045e9 kernel-devel-6.12.0-211.18.1.el10_2.s390x.rpm ec9ad96f4cecebcb56727e504586ac29874881d14517dbd7c94698fa9dc77d50 perf-6.12.0-211.18.1.el10_2.s390x.rpm ed836f6f673b9edc44de8537914b1ddd56cf25387673f4becd09bafba6a577c1 rv-6.12.0-211.18.1.el10_2.s390x.rpm f545245b4a94f59f97bc3a53f10f7f9579723f65233cbb08bb15e5b0e2217815 kernel-zfcpdump-devel-matched-6.12.0-211.18.1.el10_2.s390x.rpm fea3cf0cb8cedb0666ba44e2f3da879c5775e7322eecac01f1b2179b9a916e11 ALSA-2026:21676 Copyright 2026 AlmaLinux OS 0 1 Important

cockpit security update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default cockpit-packagekit-356.2-1.el10_2.noarch.rpm 29bea62d6da80ffe7185c0a5c07130c9f8bdd8cf3db5e6956ab11f4675ba353b cockpit-storaged-356.2-1.el10_2.noarch.rpm db2a2a221c93a54b55c9d8c46acdea7e845e9d978c1572d583e9113742dd59f2 ALSA-2026:21754 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-sdk-9.0-9.0.117-1.el10_2.s390x.rpm 1e366b42236a6be555ca43c61ef09934f420433a31a5eca0d7f267168d63d3a4 aspnetcore-targeting-pack-9.0-9.0.16-1.el10_2.s390x.rpm 1f8d666bf655fc0f88384c9926c97bfbdd7ec821ee4e7fcd457ec0375bdeacf1 dotnet-templates-9.0-9.0.117-1.el10_2.s390x.rpm 294e17f4bedab21e0c52da405b2f1df2898d30c0e74b5ee18cd047a3ad017bc7 aspnetcore-runtime-9.0-9.0.16-1.el10_2.s390x.rpm 296107f06b0124c049560249deb04300e0e533cb85b8f8984539683e19eeee03 dotnet-targeting-pack-9.0-9.0.16-1.el10_2.s390x.rpm 38fc64bc8a2c355ef67e0917f21c3c21510b8486c248820526e8b001bf079259 dotnet-sdk-dbg-9.0-9.0.117-1.el10_2.s390x.rpm 3ea87e4e11e543da99e15e1eedb5c18333eb964f8bf58317946a83e3cd153629 dotnet-runtime-dbg-9.0-9.0.16-1.el10_2.s390x.rpm 73318b5bf3466b7c9c8c6229c84249fb879d8766a632eadadc2fca26155fea7c dotnet-hostfxr-9.0-9.0.16-1.el10_2.s390x.rpm 8341acf57b992bc97f17aa55582a74b6dfa676c4832a8d2a5a79c972ca565aa2 dotnet-runtime-9.0-9.0.16-1.el10_2.s390x.rpm 936b770f3a3180bb7927d76d598c5f7b9c391a7004d765eaf42facc3342d6bf8 netstandard-targeting-pack-2.1-9.0.117-1.el10_2.s390x.rpm 9733dd47f33df8d1115aeded1d83ff671a44037bb642e42ce6c65a58f2c77887 aspnetcore-runtime-dbg-9.0-9.0.16-1.el10_2.s390x.rpm 9838ef6b0aef4a21b3ee45f46e3190f30ae4ae8e8f96a22067df5637b6a1b85c dotnet-apphost-pack-9.0-9.0.16-1.el10_2.s390x.rpm ac2e8bc89adc97c48a00c43104a7701017960ef90ae218b094a66a657c045821 ALSA-2026:21757 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default flatpak-session-helper-1.16.0-9.el10_2.1.s390x.rpm 0a555a3e1c06fb69b9b9fb6417bbcd02eedc2f8234ff4567f58f8a066e0c75ac flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm 22949ff4b832a5fbaf79d354cfc73af59a6746d662dcf4d0c294b24dcd69a9c7 flatpak-libs-1.16.0-9.el10_2.1.s390x.rpm 998ef1ea45ab9c894d9dcf41193d021d3de8440d3641ee42414854c18d4d5760 flatpak-1.16.0-9.el10_2.1.s390x.rpm a180a0911c507de60e220aa731d78fb8615a1600506f3afd5716d063f5ac0411 ALSA-2026:22141 Copyright 2026 AlmaLinux OS 0 1 Moderate

go-fdo-client and go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default go-fdo-server-owner-1.0.1-2.el10_2.noarch.rpm 2f5a8bd1401f47c152f97edd4dcc2bcfe5b02e9edea564cd3f27e4152facb328 go-fdo-server-rendezvous-1.0.1-2.el10_2.noarch.rpm 843e6a44fb5ab7ca974b5dc823978d86e2f4d3d2a91a9aef3292f97beafc75f3 go-fdo-server-manufacturer-1.0.1-2.el10_2.noarch.rpm b1739b5cbc00a312407f39f5c8b72d26a9a88f099f93f00e1d68db826a024bb9 ALSA-2026:22145 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default aspnetcore-runtime-10.0-10.0.8-1.el10_2.s390x.rpm 0de15b13f95d30c0200109a7b9a83eec03c13b7a6dfe2a2c3f505bfee98860de dotnet-sdk-dbg-10.0-10.0.108-1.el10_2.s390x.rpm 3d9a4c2f8d47b756efe71446e78a09558ca4850cb4e153719ba4047244fcc26b dotnet-sdk-10.0-10.0.108-1.el10_2.s390x.rpm 4d714530615aa52bf057c9cf54b72c8911bd85387605d8d3135218bb61699b71 dotnet-runtime-10.0-10.0.8-1.el10_2.s390x.rpm 5718f777fc613d73efc3868ff07fc72df66924a07f0dabd83cf90f2e0871e0d0 aspnetcore-targeting-pack-10.0-10.0.8-1.el10_2.s390x.rpm 5cb1887819097432c93087cf1e9ddc95525af0feebb887e7985ca9d44e59a375 dotnet-runtime-dbg-10.0-10.0.8-1.el10_2.s390x.rpm 81a7d876fe56ed1ca7a4ccc4b3703f9fb6d07b9909b372f27a23513e77132ab9 dotnet-templates-10.0-10.0.108-1.el10_2.s390x.rpm 9af9a014a2bf6fc34b23483675f9eab54e68ff0a9be882557646a6bb8280cd89 dotnet-apphost-pack-10.0-10.0.8-1.el10_2.s390x.rpm 9f678063f19c5e136106f5cef298f3755165d24340c77920d4c029f14f4a13a9 aspnetcore-runtime-dbg-10.0-10.0.8-1.el10_2.s390x.rpm ae250f226a6f6e3bbd9b133825baf855fd27b1ec9e482f7e72bb201043790b9d dotnet-hostfxr-10.0-10.0.8-1.el10_2.s390x.rpm da0aea9b2e95a8e1d590042d21fc03064f2d263a5da21ef14455e87bb24fd537 dotnet-host-10.0.8-1.el10_2.s390x.rpm e92a0f45a95669f6905069cf12c5401ce0a23544f85df7e815491039cdfaecc2 dotnet-targeting-pack-10.0-10.0.8-1.el10_2.s390x.rpm fbad483f0559a8dcf19313ddc3836736667404df20a29eb55e4270487ec53814 ALSA-2026:22314 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssl-perl-3.5.5-3.el10_2.alma.1.s390x.rpm 50e505072c0ab7fb4d1792ac17fb7e4e5c12fa3661a052039363281c02c729ae openssl-devel-3.5.5-3.el10_2.alma.1.s390x.rpm 6fe76e588d1767eea1f0072190e02a3380f16d27e96ac73c55b27aa167d075c0 ALSA-2026:22325 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default thunderbird-140.11.0-1.el10_2.alma.1.s390x.rpm b24ff0ddba5569ee5f4d965b3d38c99e6a68b53d7a203843aaeeb641f0a90e9b ALSA-2026:22528 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_http2 security update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.s390x.rpm 9e2b105a5cbfa0992b15c882fcbd4c13595656a385d01b4fdd6a773807fe1042 ALSA-2026:22529 Copyright 2026 AlmaLinux OS 0 1 Moderate

libexif security update

The libexif packages provide a library for extracting extra information from image files. Security Fix(es): * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libexif-0.6.24-9.el10_2.1.s390x.rpm 93a9305c5ee7444221ce7b1572f147f686d5d4d1c238a12cd1642ec9c53a8a20 ALSA-2026:22649 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) * php: denial of service via DOMNode::C14N() (CVE-2026-7263) * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default php8.4-bcmath-8.4.21-1.el10_2.s390x.rpm 043ae8743defda268dff0b35959c810fe3d234cd453a74bb8e71bb77b95f47f8 php8.4-devel-8.4.21-1.el10_2.s390x.rpm 0afd6bf41c5468fdf7e54725964fc5c4fd5fca994776f838f1126729656c3db2 php8.4-process-8.4.21-1.el10_2.s390x.rpm 1d0b65994651e6ceed688d78e97bf4044212de21d4707178113f599e98514fe8 php8.4-soap-8.4.21-1.el10_2.s390x.rpm 1f78115d9074ed54564a7f4c117ba8c0450998fa4b2d3b9061187e1192154969 php8.4-enchant-8.4.21-1.el10_2.s390x.rpm 2255cf5b5ed97d52b000f19aaff5e715fa0b3ff7abf5f5761a9eac096f308817 php8.4-ldap-8.4.21-1.el10_2.s390x.rpm 2bd43135fd374b723cb8c304872f69bb0b4265d79285e891e557de85ad6f91a1 php8.4-gmp-8.4.21-1.el10_2.s390x.rpm 36500d338acad7e32bbf277903f2962ddcf4c7be466f8ba67932fbec8fce6adf php8.4-mysqlnd-8.4.21-1.el10_2.s390x.rpm 483d3829d1a1cb4344a8cbaecc6c527cd656154158a23a632274a9905de24315 php8.4-cli-8.4.21-1.el10_2.s390x.rpm 52a55162cca1442841350132d76d211ce8715db2844e40226d46c76505ff74cf php8.4-fpm-8.4.21-1.el10_2.s390x.rpm 66e293a0dec3ea98e6fe6950c3aac3d0e3063bc92adb071f00daa3cf5a6be852 php8.4-dbg-8.4.21-1.el10_2.s390x.rpm 6d7aca327820ee74c2538ed1d1e0f5b63c03fac31c1f82bad0e7944a3dd8d778 php8.4-odbc-8.4.21-1.el10_2.s390x.rpm 7848fb97e89fb0d60b916282e71dd5d329d5d3f68bf66a92c6825b717c4b6b98 php8.4-xml-8.4.21-1.el10_2.s390x.rpm 7afc57fcf25f8da16bd46bfd45084801e7e39b2882b4790c5ff496f93ee7e117 php8.4-snmp-8.4.21-1.el10_2.s390x.rpm 81921d685be769342f3b7e34876972cea622daeb1403e574c479f8c1ae88dcc3 php8.4-8.4.21-1.el10_2.s390x.rpm 823778d8feaa6aadf53bd8b507e30c82b983ce029b8356554fd5f6f4fb9bc097 php8.4-intl-8.4.21-1.el10_2.s390x.rpm 87f1e6b2d09e6192bade663f7132a669d2e111706af42fe95ff907f23cf6c499 php8.4-pdo-8.4.21-1.el10_2.s390x.rpm 8f739cb041418d63a6408125d697cce0a1bbe254641a8880f30c316c975e9e64 php8.4-opcache-8.4.21-1.el10_2.s390x.rpm 9e7c295cd5d2ba4f7392ad75b4be6bfe2b93577eda605f6cecd4b785e54e1ff9 php8.4-ffi-8.4.21-1.el10_2.s390x.rpm a35389da8860d91e2f293adf86865add4264b905675e45577216e7c4fe2ea2bd php8.4-mbstring-8.4.21-1.el10_2.s390x.rpm b8d59be89f2b1811136ea706a5713ee7bed9352634fec520d6e1b40ec138fafe php8.4-pgsql-8.4.21-1.el10_2.s390x.rpm c74b97da140f84989978ec87b2ab05078be0f2778e111824289ea8b1c65b81ec php8.4-gd-8.4.21-1.el10_2.s390x.rpm c78f8bd43574e8d33a97e6f9ede76890011fea3f23b3476f6daf460d9fecc497 php8.4-dba-8.4.21-1.el10_2.s390x.rpm f33b7746fde496ba8229d7e9a003986e83110b7f759a6a5dd2a8d19d745d9adc php8.4-embedded-8.4.21-1.el10_2.s390x.rpm f5989bf17107114213b448838a8faa2958d5833513d11f8956b33322d0b82013 php8.4-common-8.4.21-1.el10_2.s390x.rpm fdd1427d713c0017f146223ee8ae15b80ad5f9941735dc70295a5df6b0a20c68 ALSA-2026:22711 Copyright 2026 AlmaLinux OS 0 1 Moderate

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default vim-X11-9.1.083-9.el10_2.3.s390x.rpm 1b70d72e6c23712a1375330460890e6f08d2235f3dd27b12767b8018269b0da9 xxd-9.1.083-9.el10_2.3.s390x.rpm 1c043aef1f72fb803ead9b92c27cec5c233b2ac9b026d6ff21a62eb93ce58335 vim-enhanced-9.1.083-9.el10_2.3.s390x.rpm b2f8c55035afe2658149c07d13469d7f6867d63ce3bc63fa257101178be08f16 vim-common-9.1.083-9.el10_2.3.s390x.rpm b9255086b06acae84b0599affbc0b1d2823130f9ebbfb536d1e670055a65767c ALSA-2026:22715 Copyright 2026 AlmaLinux OS 0 1 Important

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.1.s390x.rpm 5cda6b5ec9eabb5b5aa05c5b6d4fc597a4c99e4742eb1ce75127b725835040e0 ALSA-2026:22963 Copyright 2026 AlmaLinux OS 0 1 Critical

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012) * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170) * samba: Remote Code Execution in SAMR (CVE-2026-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default samba-gpupdate-4.23.5-109.el10_2.noarch.rpm 02ab33c4186fb468d4de6cffac56cd285836279fe4e2d03245fef1dcf26dd611 samba-winbind-clients-4.23.5-109.el10_2.s390x.rpm 16aa85d8a14b1cbe7234269e45e7c4db0562e50503d230e2272ac365ce2536c9 samba-client-4.23.5-109.el10_2.s390x.rpm 1e4ddc03f67645bb175211e6af2c12a92a6cf00edf01a7f08c69b278aadfbba3 samba-krb5-printing-4.23.5-109.el10_2.s390x.rpm 529a87beb6ea24ec4448082cac595c79284ee39e4a73e8581e259a7cf222cd76 samba-winbind-krb5-locator-4.23.5-109.el10_2.s390x.rpm 7a3f087a7e6da48e274617252fce1d325f97c512ff17e1037ff808e4b843d4b7 samba-vfs-iouring-4.23.5-109.el10_2.s390x.rpm f8758cb699208aa6439e38a3362bcd3cb0e6999f65940915e7807c694aaaf932 ALSA-2026:23231 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959) * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default unbound-utils-1.24.2-7.el10_2.1.s390x.rpm 06a0879427b8759aba8de36707ce8d3226f120a7718aa29e3927bebc7a4b3a1f unbound-libs-1.24.2-7.el10_2.1.s390x.rpm 21eefce0b2062093e46ee824f08ee2152ca6c9b03432f1c6974bae9be9212976 unbound-1.24.2-7.el10_2.1.s390x.rpm 454d9a91195207496da1d915c8303304ff9ac1378d19b57f18b7b5f7cd20e080 unbound-dracut-1.24.2-7.el10_2.1.s390x.rpm 7f26ff8476f93df050cf7c67411444de648905729c64e1b28ca554772ec37955 python3-unbound-1.24.2-7.el10_2.1.s390x.rpm 9d4b85648a6990e34b8b21e7ef744a24780e549164f03f21b96e511e524513a5 unbound-anchor-1.24.2-7.el10_2.1.s390x.rpm a42309b51c072a3a357614d0d3cea00599edaf22bb37f40f53b26ae133d2f458 ALSA-2026:23329 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-headers-6.12.0-211.20.1.el10_2.s390x.rpm 09f0eb2cc74b91f9f2188aa487a1e703f7b823237c1c61c5832d88cd9da45c5a kernel-debug-devel-6.12.0-211.20.1.el10_2.s390x.rpm 0dac9449da98244aa831b9327a5b7db823aed279eacb3635d3b9256fecb14a86 kernel-devel-matched-6.12.0-211.20.1.el10_2.s390x.rpm 0f0fc319645fd61d15597318acb4a34e3521fd0f92eba11696db6c74f27a1567 rv-6.12.0-211.20.1.el10_2.s390x.rpm 26a1e7f29d23ceb3fa3298abe7056b166379d82178eacad9388acee30e51ec82 kernel-debug-devel-matched-6.12.0-211.20.1.el10_2.s390x.rpm 4fe8fc8ed5a059989439c3d414b92aa6be1e64eaeadfadd1a7fb7913d9ec6e06 kernel-zfcpdump-devel-matched-6.12.0-211.20.1.el10_2.s390x.rpm 510adbf9274f1b634cf89326fa1a411382569bd87a8c022be89024b7f7bad9b1 kernel-zfcpdump-devel-6.12.0-211.20.1.el10_2.s390x.rpm 57c64cc383852644b8d7a4bd73d4018e107c73a784b4e241000f9f081e945a8a perf-6.12.0-211.20.1.el10_2.s390x.rpm 854094b69c6f3e3a2c69e65fa355dddab39f40b2f4bf19744e4bb621517ed5cf kernel-devel-6.12.0-211.20.1.el10_2.s390x.rpm 9d5fc70b7374520e454c8e7aeb140ed6a22244863c67402e6a65dc053240d3f1 kernel-doc-6.12.0-211.20.1.el10_2.noarch.rpm a836026e76d4d01a4cd956f4ff3470e96d192b18c9b27f6d4d5b5e46c6aa8694 rtla-6.12.0-211.20.1.el10_2.s390x.rpm d1d0693c9e1e4994fa500e0aadc3e83a36ea8c3d9f896beb09c878bdf24193ed python3-perf-6.12.0-211.20.1.el10_2.s390x.rpm de70ab1717879900d4559e58a574f0d245ee79803e99b56ef3bc2007f5948c9c ALSA-2026:23388 Copyright 2026 AlmaLinux OS 0 1 Important

php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default php-dba-8.3.31-1.el10_2.s390x.rpm 0056753333df124320cfe2006623636b356a5c50a0610ccfe1e5616ff339d768 php-xml-8.3.31-1.el10_2.s390x.rpm 0667074802d37a3cd634fc1926b47647422e1de528185a1713debf52a289f1fe php-ffi-8.3.31-1.el10_2.s390x.rpm 0cff84d0e09b07be1a6264fd4bb14d0cccf01e95f6fb52320da73f47cca27625 php-pdo-8.3.31-1.el10_2.s390x.rpm 100d7969c1da418776cdaa55a089ec4dd4c3d5690c49e41615be58915ea9ae08 php-fpm-8.3.31-1.el10_2.s390x.rpm 2c403bee1957087e8bca54e743c4f8e42b3d5524db7f63160c8b2a9d8001f0de php-dbg-8.3.31-1.el10_2.s390x.rpm 494322081fa7ea88a0524a432982446cae334b3a43960c61f549607960fc3c55 php-cli-8.3.31-1.el10_2.s390x.rpm 53133d9088a4467f8800c72a3fee50ce248bd95ea2777ea972c08590f47a3c89 php-mbstring-8.3.31-1.el10_2.s390x.rpm 60e28803933eb2fb19e1e14bb059a0fca4fc02c22041eca3c401463274132fe6 php-devel-8.3.31-1.el10_2.s390x.rpm 62a3f87555a16454ab7b8b925d0809e8b1739b45a8caf31f1b7a50c69dcd2981 php-process-8.3.31-1.el10_2.s390x.rpm 6b0f0a2b3564118d082551822cb77c62e20f27b88db93c796eb67e3d631f571e php-intl-8.3.31-1.el10_2.s390x.rpm 6da867976a7cb0a6226765d917d48a6c9b22f4041d6cfc50fd84c98f933f75a7 php-soap-8.3.31-1.el10_2.s390x.rpm 702d701a426ab36c72a47b9f45ab22e1e7bdc93ea6f7345be32707f309ce6cb2 php-8.3.31-1.el10_2.s390x.rpm 73a82e2b045539c4aeb05b9d33c237ea0498d2efa99cded932eff2798e5a4a64 php-gd-8.3.31-1.el10_2.s390x.rpm 7eac6093de9a4b80ec323377dd25330dc50ca8a6721afa3c0d21be65e4ddd83d php-common-8.3.31-1.el10_2.s390x.rpm 9219af80cefdf784d53706433d1ed110a5adc6d4fde55054f471de412cdc1584 php-snmp-8.3.31-1.el10_2.s390x.rpm 9853afeff9ea9c5278cc6235c7845596d11d5ee05724b49b005e39d0dbf6311c php-mysqlnd-8.3.31-1.el10_2.s390x.rpm a278673c301feae3ba160e45d4e5bf8f8e294d4f288efc567753d990e81d48a9 php-bcmath-8.3.31-1.el10_2.s390x.rpm a634a7f2ff75bc3ee1a65701f5564e685040002735cd751ff6351adf18596be0 php-enchant-8.3.31-1.el10_2.s390x.rpm ad03983a2ad5090577b250f66dc4acd16525c2f75f2b17c49828f6aee49ff7a2 php-opcache-8.3.31-1.el10_2.s390x.rpm b34f899625d4da954982e7cf0a58c9334ae6eb956dc57974109bef0b9f07c0b3 php-ldap-8.3.31-1.el10_2.s390x.rpm bc9170c1ccdee3cb96f05b63f3905e03558d48bdc05e675ad9a14d0b063e1519 php-odbc-8.3.31-1.el10_2.s390x.rpm dc81f9e339350e1637b92147c825d74dd16f45c3a59e3138a2efaf92f725a763 php-pgsql-8.3.31-1.el10_2.s390x.rpm e93866923b0bfde630d99d2bf405d21ab29bf10a77eb30b6ee208eae6a0b4bd4 php-gmp-8.3.31-1.el10_2.s390x.rpm e95e19e9b1f299ca6199e653731084c74eaa25ef1a9ffcc8bed07749c9ac9565 php-embedded-8.3.31-1.el10_2.s390x.rpm fe52c382ed298919a65fd70b1f92050c15ce49da36680384084956d9b52bcb1f ALSA-2026:24338 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default bind-utils-9.18.33-15.el10_2.2.s390x.rpm 1be4cd9d27a658a063eaa6b9909df7ece367a5e0d78a5d6bbbeeb29ee773301e bind-license-9.18.33-15.el10_2.2.noarch.rpm 25696570fcae21d95d2b7b7d02efd735482defa1142c62286c36eabb4f6c2997 bind-dnssec-utils-9.18.33-15.el10_2.2.s390x.rpm 75bbc2db699b1c7c8a50e14028cd2000cd29d5d4878d6c90994e48185a498ba1 bind-chroot-9.18.33-15.el10_2.2.s390x.rpm a33d89844e6ceea671ee1ba8d11acee7915a6e10a34f9c327820dc233969ec4c bind-libs-9.18.33-15.el10_2.2.s390x.rpm e96932d92894265e3b8ab14786348f1b7930cd601e141b3c9da7a1b49f907f0a bind-9.18.33-15.el10_2.2.s390x.rpm e97a02e77c8856c7f45765207c6e290a2e5ece4876c4e4c9d2a79ca6eea358aa ALSA-2026:24347 Copyright 2026 AlmaLinux OS 0 1 Important

frr security update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * frr: denial of service via crafted FlowSpec component (CVE-2026-37457) * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default frr-10.4.4-1.el10_2.s390x.rpm 491a695523827486e85e428a4b82850d98305282e87087383bc9a4d0e9eb398a frr-selinux-10.4.4-1.el10_2.noarch.rpm e52027fd1714316b10d57ad6d1986270e9103048cce6f181fddac53f9ff01c8c ALSA-2026:24348 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postgresql-jdbc-42.7.2-1.el10_2.2.noarch.rpm 12ad5a0377cc543161f693dbedf80444ce6430610d3c37c638d24895a91baf32 ALSA-2026:24470 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default podman-5.8.2-3.el10_2.alma.1.s390x.rpm 899baafaf61f4ddde13f09b4203a12e30f715991cc5946716c64aedaead2324c podman-remote-5.8.2-3.el10_2.alma.1.s390x.rpm acca041a2d30616bf40ab90d5f2e41679c7f47b12a45693bbe51b582b99635c0 podman-docker-5.8.2-3.el10_2.alma.1.noarch.rpm e205f2f26c5534f264de80514cb994d72b05f6a8fdd0b52239e7998ed355f6cd ALSA-2026:24758 Copyright 2026 AlmaLinux OS 0 1 Important

libyang security update

Libyang is YANG data modeling language parser and toolkit written (and providing API) in C. Security Fix(es): * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libyang-2.1.148-4.el10_2.s390x.rpm 21000f2e4247a35dbd5a02ae60a95d28b81dc51bef2cb65c3d0dd56e2e7e668b ALSA-2026:24985 Copyright 2026 AlmaLinux OS 0 1 Important

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default poppler-qt6-24.02.0-7.el10_2.2.s390x.rpm 3af05d0a5a78047b914cacdb20b846bc78448401461583959bef08e8542d7e92 poppler-glib-24.02.0-7.el10_2.2.s390x.rpm 643cec82adde88068dd8f4a451bb3e265407bb6aebaf2143be099b5dbd82db9e poppler-utils-24.02.0-7.el10_2.2.s390x.rpm ac6211c5216fcfa1cbf7cb5356f58a23331366da353424e8a541f74e1d3fb944 poppler-cpp-24.02.0-7.el10_2.2.s390x.rpm b56ebe739d6667b281a578a7da2c9acb8b359690d6d5c930967b075123646518 poppler-24.02.0-7.el10_2.2.s390x.rpm ffbac0c6c77daa3e6d0f1150954e187912b47d5dbba1081cb67c8df2e74e4a06 ALSA-2026:25111 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_2.s390x.rpm 22689b20391f3e12f3d7983966bbbb42ca3be4235218d38f2e787f02ef951dbc dotnet-hostfxr-8.0-8.0.28-1.el10_2.s390x.rpm 2677719b127c858511b6cafd73112b2f3980b49624cfcf36822ffeaf885be3ba dotnet-runtime-dbg-8.0-8.0.28-1.el10_2.s390x.rpm 283ca16ad4957b57d47ebf9c24b0acd96206882a2a62c8c9a64663935f424c34 dotnet-sdk-dbg-8.0-8.0.128-1.el10_2.s390x.rpm 4e0d0a6e721c1d617a4f69eeef7acc08116989054256f0701f99936c90f2956f dotnet-runtime-8.0-8.0.28-1.el10_2.s390x.rpm 93d4a1986a83a73f860245ba90f2e9a676141631af6dbc732fe77f006989d588 dotnet-targeting-pack-8.0-8.0.28-1.el10_2.s390x.rpm 99c306cbcd9476cc3a5648a5541fa62b9d00ab80f816b8597b5f0b362eb3ebcc aspnetcore-runtime-8.0-8.0.28-1.el10_2.s390x.rpm abf3abf94abc8961a27eb66a2c30d100af4af79e4055606989107671da00f29a dotnet-sdk-8.0-8.0.128-1.el10_2.s390x.rpm b878b2aeffbf36b3017f7c0d8ad7eb77d8ffc846bef86fd50dfd929d5eec7b30 dotnet-templates-8.0-8.0.128-1.el10_2.s390x.rpm f49d5fc74f3fe1d8026afbe03184b91322a80af679ff26a074608e2093914f68 dotnet-apphost-pack-8.0-8.0.28-1.el10_2.s390x.rpm f7e94bb76034a544380ed341803a50d063ffcc1b6bcf4df204ebb37704cc65af aspnetcore-targeting-pack-8.0-8.0.28-1.el10_2.s390x.rpm fdda48617fc0b1921e328a6d4acbe1e0c279dab9e3ab99d6de07928b950b6bbd ALSA-2026:25112 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default netstandard-targeting-pack-2.1-9.0.118-1.el10_2.s390x.rpm 09647a5b59908e1a3e8af8207816fe5fde3de8abf1f362a71aa1068d17d80455 dotnet-sdk-9.0-9.0.118-1.el10_2.s390x.rpm 306657baad6f4279fe6c4e67a0749fc197c8fe8c97fa5defbd6f17043d0f8fbd dotnet-hostfxr-9.0-9.0.17-1.el10_2.s390x.rpm 401273eaf0a4a52cfe862a4baae89c51526aa99e4dd1bd82064e6af0fb1d9a94 aspnetcore-runtime-dbg-9.0-9.0.17-1.el10_2.s390x.rpm 61dad1811d3dc6f861f19892bd2baa170589d17aee8c7f88c1402212db88dbf0 dotnet-runtime-dbg-9.0-9.0.17-1.el10_2.s390x.rpm 685cabd3dabbac0d7ab768c796c55f6e5ee09c5f4f2a5406c468e200a864980f dotnet-templates-9.0-9.0.118-1.el10_2.s390x.rpm 6ab746190cf083971a13ce4b172e6f7d4ec958cb5b1936e85db3d0699a5b1999 dotnet-sdk-dbg-9.0-9.0.118-1.el10_2.s390x.rpm 6e9d81c117c81c986deec5c73aeaeaa13fc5e40650a0b31b91e9d8193d63af79 dotnet-runtime-9.0-9.0.17-1.el10_2.s390x.rpm bc6e36abe656e5092d9e5cadaf4b87c772c2495301e86eb09d07ac5b14054c6e dotnet-targeting-pack-9.0-9.0.17-1.el10_2.s390x.rpm bf92b43276c45bc2d409a82038736ee3a973ea36cb8d9e1de1d9c48d057bb033 dotnet-apphost-pack-9.0-9.0.17-1.el10_2.s390x.rpm c8af7f15feb90f44840a0689846636c7927e9a38a1c2d7bbce63f135bcc0898c aspnetcore-runtime-9.0-9.0.17-1.el10_2.s390x.rpm d20dca5467e963060fe944ce4d57a197d0fda4b0e775ea5f5c9e5c2ff41f166c aspnetcore-targeting-pack-9.0-9.0.17-1.el10_2.s390x.rpm e82c2057c9daa825547eba06a472d593eddaac6d5848e76b69ffbe258ee4e0c9 ALSA-2026:25115 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-runtime-dbg-10.0-10.0.9-1.el10_2.s390x.rpm 2393f68d6727017ce5cbbe61b465884e682c37e18e5c7200a0cd1f96b2ecd351 aspnetcore-targeting-pack-10.0-10.0.9-1.el10_2.s390x.rpm 496211fbbcd5278bcd57827c55337ae37a7bde23aae90180d46985eecbcc855e dotnet-sdk-10.0-10.0.109-1.el10_2.s390x.rpm 60d5463fc9b68f43c05811c3ef719aa9bac6f5a646eeda9e60d67bd231daa96e dotnet-host-10.0.9-1.el10_2.s390x.rpm 6d87746fa976fa1aa86471695159a23a9005fa37e91e2d535b0f06da29fdaa21 dotnet-runtime-10.0-10.0.9-1.el10_2.s390x.rpm 7288980cd05f2f61772368862f54ced41cc3672587dcdd1c7623d3fe3bce5f55 aspnetcore-runtime-dbg-10.0-10.0.9-1.el10_2.s390x.rpm 76a1036a615ae1ef6edabb8d0afb9e2867af02f4c1bf35e9154771b4a8a513b7 dotnet-templates-10.0-10.0.109-1.el10_2.s390x.rpm 93c6c298752dddb548e323989ee92c00ac732584ff6579c1efbccc46dd31ba08 dotnet-hostfxr-10.0-10.0.9-1.el10_2.s390x.rpm 979e194e09eff8cbb3c1a88e2c21533f969baa6aaf2236fbdae856479ee71dac aspnetcore-runtime-10.0-10.0.9-1.el10_2.s390x.rpm c54b9add89234aad0a54adecebe08cf971d5dfdf7c4cd120e41ba50e519a40f9 dotnet-apphost-pack-10.0-10.0.9-1.el10_2.s390x.rpm ccb8de86787209dea955b077752129cae857d4499a09d9e9672f98514c000529 dotnet-targeting-pack-10.0-10.0.9-1.el10_2.s390x.rpm d027b3bc4ecfd1351be4575872e6df37b68d26f5a0aed833d40888ff9da8a349 dotnet-sdk-dbg-10.0-10.0.109-1.el10_2.s390x.rpm d6eee2a7ea77aae5b8b2ff0afc9ea7ef13e2f7b267d41909e3be12bf47ced94c ALSA-2026:25191 Copyright 2026 AlmaLinux OS 0 1 Critical

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.22.1.el10_2.s390x.rpm 159164cb903b37394f9d0e191d36874744fa76112c25146198a8f5329d7929d2 kernel-doc-6.12.0-211.22.1.el10_2.noarch.rpm 1cb3d93030aca010c6182c61bd262ffa6d526fb1b80f5cac5d3a4e0ddfd0923a rv-6.12.0-211.22.1.el10_2.s390x.rpm 525751669a278a819b4e070eedc8eee2507358af677e3a426e890a4c945fd23e perf-6.12.0-211.22.1.el10_2.s390x.rpm 7f281a3f9916a052d9d7918d09f714def99190cee65a42bbae20646b4a53153d kernel-zfcpdump-devel-6.12.0-211.22.1.el10_2.s390x.rpm 923436185139f13c3b3b19a9d3e355f0d64d3aa5f1144ae564fc81dcd94148a2 kernel-devel-6.12.0-211.22.1.el10_2.s390x.rpm 92c8ec4ec14ab56936267aa38812141b18bf6352e1bca33838fac459f645f634 rtla-6.12.0-211.22.1.el10_2.s390x.rpm 9bda59100ececec4b2a73daef989f0bbb0314bb89df8a013914c97d9c8e558a1 kernel-zfcpdump-devel-matched-6.12.0-211.22.1.el10_2.s390x.rpm 9d7858d5184e67da6a4944869462199e24a51a3aff73b08030e3b99faa3796de kernel-debug-devel-matched-6.12.0-211.22.1.el10_2.s390x.rpm a836280bfa0d7c6a9216e59bd5052357af19f2cded27a497af3149ea085b0eba kernel-headers-6.12.0-211.22.1.el10_2.s390x.rpm ce40bf7e4ceb91b053fecb034f27680d9f761b1cbdd04c55d4dea9e9d59755dd python3-perf-6.12.0-211.22.1.el10_2.s390x.rpm e8df21a3fb16476121fdc8811dde39c6f96bb4233132a05979730abb8bd48e0c kernel-devel-matched-6.12.0-211.22.1.el10_2.s390x.rpm fa53d0f0929c88146bdcae6f63b9d7d0127f7148cd7582072b2ee040c9287479 ALSA-2026:25216 Copyright 2026 AlmaLinux OS 0 1 Important

valkey security update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479) * redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631) * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default valkey-devel-8.0.9-1.el10_2.s390x.rpm 581a82171a3dd30d5bee7c247dc479a632406bf0824bf093e060257c14d4d55e valkey-8.0.9-1.el10_2.s390x.rpm a4180b9d3df542d7ffc114eb61d08c4fc6d83262e891e250a0623ecda83a956b ALSA-2026:25225 Copyright 2026 AlmaLinux OS 0 1 Important

mod_http2 security update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.1.s390x.rpm 430e5e90019830b4bf33ee9f9ccad35b567bc088c402fa48a35d75cc5f358cc2 ALSA-2026:25237 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383) * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076) * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180) * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181) * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182) * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183) * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764) * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766) * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767) * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768) * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769) * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770) * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445) * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446) * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssl-devel-3.5.5-4.el10_2.alma.1.s390x.rpm 73ce18b8ac9f44abbe3913ab36d9f01d78ac279ba4ff16104669790136bb5a09 openssl-perl-3.5.5-4.el10_2.alma.1.s390x.rpm b2f8aec19c8118d65134f747ab589c64c6427df5036a2797d056be559fca479e ALSA-2026:25341 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat9 update

Certificate revocation bypass due to improper OCSP response validation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default tomcat9-9.0.117-1.el10_2.alma.1.noarch.rpm 05aa3bf0312387311b2ebee667eac72d7e7edec61d6304c2887bb89dce956ef9 tomcat9-lib-9.0.117-1.el10_2.alma.1.noarch.rpm 112016e28c5036aafd2dc2c8c1106032281ee655ecf0ed4660e6a407a2be6530 tomcat9-servlet-4.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm 20c189635df0064ff555758bfe0c95f21fb6875882b9d0af0d6a358047d9cf2b tomcat9-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm 4c2a31f2ac55f524c85ddedcf6348fb52bf25e3a8c51aa42bd636a679bc061ba tomcat9-docs-webapp-9.0.117-1.el10_2.alma.1.noarch.rpm 69e8e77be4f060182be8e233a029cdac2dc6d78e5dede107e51f129760e53834 tomcat9-jsp-2.3-api-9.0.117-1.el10_2.alma.1.noarch.rpm 8f03c1fb22b9b899ba5241ba26943941828f4092d11c3bf45acdfe457b177f1b tomcat9-admin-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm cc3072eda709f80d8c5d5b108fe2a57d3bcc068e817a6dad877191d45431c79c tomcat9-el-3.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm e88ff8acc2245391a6ac44a4bfd50bed1fb73d897208fbb93ff98452651fb8d6 ALSA-2026:25902 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default fence-agents-scsi-4.16.0-21.el10_2.2.noarch.rpm 09ff1477d7c24e095b83789574d84696975330f2d0de542d54792c26e7974c16 fence-agents-lpar-4.16.0-21.el10_2.2.noarch.rpm 12c9076e50ad52eac0fa9c9653ce73fa79643aee1f969bc507af2d7ff138569a fence-agents-apc-snmp-4.16.0-21.el10_2.2.noarch.rpm 298e8d7a3cc1d82a186ff6a6892e4568c0979e88cd2baebaf8d23a9e24fea0a9 fence-agents-eaton-snmp-4.16.0-21.el10_2.2.noarch.rpm 3e29269bd4baea6327c3f106e567ba79252914196c7d9d6de1691b9b887f5016 fence-agents-ifmib-4.16.0-21.el10_2.2.noarch.rpm 3eae36839b0c37587393fedd0a94d391c7c1b32d4e0038aeb872ce77dcbeac65 fence-agents-drac5-4.16.0-21.el10_2.2.noarch.rpm 3fd2c64de218b8f14a264b6d4c513527490c25f44ac7974c6ef31fb84798dd4c fence-agents-redfish-4.16.0-21.el10_2.2.s390x.rpm 4f739002b40625e4f8e622ed9b7f1e5fb0df032735c32d16ba315c1b0f8b251d fence-agents-eps-4.16.0-21.el10_2.2.noarch.rpm 50471bc1d7292ee0054f58620f7119f9f2224ef4260b8a953fba66633ec4adc0 fence-agents-rhevm-4.16.0-21.el10_2.2.noarch.rpm 526fcda8f27eca140ad19bc1b50f05fde1e332027a94e23cb2595e6544c91903 fence-agents-cisco-ucs-4.16.0-21.el10_2.2.noarch.rpm 5f0c4629ad31c1b9bd98c26300a2555a858e7da9be98323d3705bb2a17d23d33 fence-agents-apc-4.16.0-21.el10_2.2.noarch.rpm 600b0a86968f0aaae3296c8da0b70e18f2cc7836e9b007c314dafa38da84a8be fence-agents-ibmblade-4.16.0-21.el10_2.2.noarch.rpm 614315d7378c63e0844826317ca53254844a3938c32f3665bf1df10dacb31d62 fence-agents-ilo-mp-4.16.0-21.el10_2.2.noarch.rpm 6731b497ac7785ff2dfa81e440a312e85ac8e725199bb261a3290e15f4a3d6d5 fence-agents-kubevirt-4.16.0-21.el10_2.2.s390x.rpm 68d1d976be1b608044b632ab8569c129b528677cd6e8b13e6bee388c148598aa fence-agents-ibm-powervs-4.16.0-21.el10_2.2.noarch.rpm 6ce383af0646539baeb184e2641a29ae6df028240286e91f57c016285057771a fence-agents-ipdu-4.16.0-21.el10_2.2.noarch.rpm 8368915fb9a5f0e382da7f974a5e4bad3c7a34142bd9ce52c57c100697a5e366 fence-agents-common-4.16.0-21.el10_2.2.s390x.rpm 8994e71cbbb68031c6a7aed4a9e482e66ed0fa54ff69d3720a70807278c3c20f fence-agents-zvm-4.16.0-21.el10_2.2.s390x.rpm 8adac078a47d3791e8166328f58871cc27ddcbee956555817726ad8491136967 fence-agents-ilo-ssh-4.16.0-21.el10_2.2.noarch.rpm 90c5f69dbd53eaddbb46b7de1584000376afcb442f82782208b63a07ddfc9bdf fence-agents-nutanix-ahv-4.16.0-21.el10_2.2.noarch.rpm 970f4b76795e517102ff1e870b5e2a7be172ef477fd8821eb3e190b99f0af539 fence-agents-all-4.16.0-21.el10_2.2.s390x.rpm 986f7fc28893c8cef8703d9d99c5e16c8bdda7ec8e9cccc8ff684c156abafd6c fence-agents-hpblade-4.16.0-21.el10_2.2.noarch.rpm a12bb2e9542b76485ce1221906f35e37ff7d6a8f2a241d21f6547347683b5a4a fence-agents-vmware-rest-4.16.0-21.el10_2.2.noarch.rpm a236afaca18d09d042be0d498c52c254bca90aa39d7048b9c3d72fbe2a966a76 fence-agents-intelmodular-4.16.0-21.el10_2.2.noarch.rpm a2bd565e1af480ce00436ca7608818bf704d05480762acfa13b190ec1005bfcf fence-agents-ilo-moonshot-4.16.0-21.el10_2.2.noarch.rpm ab44451f3d94da168a7e3b360f7b9aedaa9e42107bdc97e68befbf4d4ee759d3 fence-agents-mpath-4.16.0-21.el10_2.2.noarch.rpm b2ccee8dd645e52151c781abd778eb861ab3d54b5f99a252ce703f56bd144800 fence-agents-emerson-4.16.0-21.el10_2.2.noarch.rpm bab15153adfef696f0496913ac9161a048bd71b538b1691aa0bf3c8d8ada5590 fence-agents-brocade-4.16.0-21.el10_2.2.noarch.rpm bb0c8a0011dacba56e4874d5634add35a6f754e354513e4b6cd736bfa70e0cf8 fence-agents-heuristics-ping-4.16.0-21.el10_2.2.noarch.rpm bce9f617920cf266311a3e70eabdf9efc748e71a34550fc398f1d09a1f866c3c fence-agents-amt-ws-4.16.0-21.el10_2.2.noarch.rpm c1311ad03e9d6aaecf221246f0a33f34e04186c91c4f94936a73ce91f0b8db62 fence-agents-sbd-4.16.0-21.el10_2.2.noarch.rpm cf3c3cd8d2407a4b215021e252553d437c3251f3f621c8600b1df2d2bf4c1be4 fence-agents-rsb-4.16.0-21.el10_2.2.noarch.rpm d1087cec15bbee8464f580cd85448b7b671ec9b6b50e7f414c01cebf25a27af6 fence-agents-wti-4.16.0-21.el10_2.2.noarch.rpm d4442641c3bdb9695e3303315183f9df36ea59d0979749e0fa73a2dc062a307c fence-agents-virsh-4.16.0-21.el10_2.2.noarch.rpm d4ea6c9d27d6b72c2ec4588d5b86ece102a2e5b5189970f0da144bdea249084d fence-agents-ilo2-4.16.0-21.el10_2.2.noarch.rpm db55586c824957f510c58c45bb2f1e13b97c5a8e23cec28841a2fde724ad0cd5 fence-agents-ipmilan-4.16.0-21.el10_2.2.noarch.rpm e115cb7a9584a1268df698f1c2808d858f01ae1dcaa9502ab776538cc16b7458 fence-agents-rsa-4.16.0-21.el10_2.2.noarch.rpm e50d48d8913ec8dddde456634ae7d0fe1110e61c50c0b31dc281bfc30173a4bb fence-agents-vmware-soap-4.16.0-21.el10_2.2.noarch.rpm e5953455691ce0520db86e36d4a0520df1aa88bd8345553743a6c5d9eab94360 fence-agents-kdump-4.16.0-21.el10_2.2.s390x.rpm e632c56a16e390ff87bc767a4a28e9bb0a1bb65aaad0de1bd8a6057b415a32f6 fence-agents-bladecenter-4.16.0-21.el10_2.2.noarch.rpm f2c5425b489f9273f19850815a2fd2af26422f93e9111fa72c09114aa8974593 fence-agents-cisco-mds-4.16.0-21.el10_2.2.noarch.rpm f65d2ca2ae09bc957279acfab3819afa89a6b4fad45c221655d3f53ba90126d5 fence-agents-ibm-vpc-4.16.0-21.el10_2.2.noarch.rpm f86bf5b2eee3fe4a01366a531f4012957b6b7a9030f7c02c9ebae1fda6d2874f ALSA-2026:25930 Copyright 2026 AlmaLinux OS 0 1 Important

postfix security update

The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS. Security Fix(es): * postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postfix-pgsql-3.8.5-10.el10_2.s390x.rpm 1871f6f1f49e8a93615f1f68c2cebb3473aeeb9771f1cde9d87e31f2fe1b681a postfix-pcre-3.8.5-10.el10_2.s390x.rpm 2891c9c415d5bb2272952b4a7e3d79a5c9c7248715d407245388b6344a2dacf8 postfix-3.8.5-10.el10_2.s390x.rpm 29d4eaef9f48137ba1f97158c86c4abbb34856b5baa7bdf64ef935f6888c200f postfix-cdb-3.8.5-10.el10_2.s390x.rpm 35b4364944b9b1c52260b7858b4d0c2eb9d7008e0b7adb2aa05043efae7250d0 postfix-mysql-3.8.5-10.el10_2.s390x.rpm 516daf0e00cc89ccc73c6d19ba097c9880e1321e45e3be7a292add3fc8986dc2 postfix-lmdb-3.8.5-10.el10_2.s390x.rpm 636a1f2300aec5c2375c1a7b2af8f842c4829625a7739d6217891d7ece473400 postfix-ldap-3.8.5-10.el10_2.s390x.rpm 7a7c59d7bce868a90eb17cb356569c36cc453203ad96f5b7162786db5cb37774 postfix-sqlite-3.8.5-10.el10_2.s390x.rpm 9979c51f1e8e3c571234c92ee9e8f668737062764615f94a76fb2fac5e5d3f67 postfix-perl-scripts-3.8.5-10.el10_2.s390x.rpm 9d418a41a87ae00f000fef395e7c54d6329b65bbc736b39eea995a3f4693ed49 ALSA-2026:25999 Copyright 2026 AlmaLinux OS 0 1 Moderate

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-7.el10_2.s390x.rpm 19eb9dab8d712df6b769b45c4531d57cc3d93ab3023ce4d5c84e8113cc277626 ALSA-2026:26332 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618) * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518) Bug Fix(es) and Enhancement(s): * Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rsync-rrsync-3.4.4-1.el10_2.noarch.rpm 540a428308cad863c69c33ed960b0bc940301aa9b2b59258a14f1fc3273c97b0 rsync-daemon-3.4.4-1.el10_2.noarch.rpm c41feb2a21f43ce9aa84fc833bcabb0d96f6b707a7ee6ccbb51ade3b02c7e18a ALSA-2026:26532 Copyright 2026 AlmaLinux OS 0 1 Important

dracut security update

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dracut-live-107-7.el10_2.s390x.rpm a1f98eee29b09f440d8c97c57191ce4e2ce0fc221050b06096c511270c6f07db dracut-caps-107-7.el10_2.s390x.rpm e2f34bdd0a622fc06477dd5e5a0dbd31de74cf9e12ad0ae7aaa51b346007f334 ALSA-2026:26566 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security, bug fix, and enhancement update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xwayland] Backport other security fixes without a CVE assigned [almalinux-10.2.z] (JIRA:AlmaLinux-184290) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.2.s390x.rpm 83bd6f90e1c7fee653a34821d5312ba160128fc0b7224147d3877ead14a56bb9 ALSA-2026:27288 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) Bug Fix(es) and Enhancement(s): * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047) * AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774) * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495) * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723) * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127) * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319) * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.26.1.el10_2.s390x.rpm 003a3fb4e6345f0b95b14e5ba217b69bf03abcc73fa1fdf44900b3a394097c17 rtla-6.12.0-211.26.1.el10_2.s390x.rpm 068124a962dfb88cbedb3d8da6dfb92b75173f6c801112fd6e1459793bff829d kernel-doc-6.12.0-211.26.1.el10_2.noarch.rpm 11db01dd6e6ddd890f4d22adb09a488c7d4dc0295f2128ecd209e94fadbced54 kernel-headers-6.12.0-211.26.1.el10_2.s390x.rpm 1f50a3fc3376856497123c367d9f26d854c1827394670b16b5a82a74ec33d029 kernel-zfcpdump-devel-6.12.0-211.26.1.el10_2.s390x.rpm 41c49f32a3f8da734b8c92851a18acef06a7269c81fc880507f5814187f21e9a rv-6.12.0-211.26.1.el10_2.s390x.rpm 644202feea9d9017e33e1ee09a3140febcb1b0218e95ece8ec82feb1e5095aff kernel-debug-devel-6.12.0-211.26.1.el10_2.s390x.rpm 653211c153b3bcd18956ced6032b0a8b3ebdf74f0b88ad8aae0d1dde056808f9 kernel-devel-matched-6.12.0-211.26.1.el10_2.s390x.rpm 8d7b59d3ce7b380ef10b96214befdce5cd3a42e32c109114b45d49ba0d1b9b11 perf-6.12.0-211.26.1.el10_2.s390x.rpm 938b8e1882de6b19758fae1fa05a49674733a7119d7f1ec2c9d814732dfe7890 kernel-devel-6.12.0-211.26.1.el10_2.s390x.rpm 9942e3220c386996104ef0faf8759d5a33f327683a3cc001be517b11c946e025 kernel-zfcpdump-devel-matched-6.12.0-211.26.1.el10_2.s390x.rpm af914d367f10873207a52864f0649314605ed63563220af901b232ae26f75d12 python3-perf-6.12.0-211.26.1.el10_2.s390x.rpm ef48ec2c64831a273948a5a53a2ab3a3feda156d327a2c2c3c9bca47e541ea57 ALSA-2026:27733 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default firefox-140.12.0-1.el10_2.s390x.rpm e6ffe8a2c8cbe274e72c737a1c1742f79e953b5cce05be8dd38b385fc8dd07ce ALSA-2026:27742 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postgresql18-contrib-18.4-1.el10_2.s390x.rpm 275cf9ae64c59c1cc4536228a081a4e020b2c15961ac511e25fe5efc7ea1ffc8 postgresql18-server-devel-18.4-1.el10_2.s390x.rpm 278694bdde64b99726c2a1e4fb7032541ce1c15e895f972bcd6cacbdb5e5d7b6 postgresql18-upgrade-devel-18.4-1.el10_2.s390x.rpm 3b5de89b6369241071229f1d3abc4aff3b5cbaaf4cec0109f79b5fce2506da2e postgresql18-upgrade-18.4-1.el10_2.s390x.rpm 3e7ee85cce2e858b57f1049ac953c7be2f93706a0aece85778583b6a7a793bd3 postgresql18-private-devel-18.4-1.el10_2.s390x.rpm 42ec170eb16c7e7957a9458b867f1347c799aeea834080741b299a3f8bbfe628 postgresql18-plpython3-18.4-1.el10_2.s390x.rpm 5d3b06cebace3018046bd6ae7fbee2033ca7fa0d009aba2dc9eba504687151f6 postgresql18-static-18.4-1.el10_2.s390x.rpm 7c7477dfbcfc4eed3a3d9822eb00ba2c9c70c747ca9180f38dcac5989fee8377 postgresql18-private-libs-18.4-1.el10_2.s390x.rpm b20078844d93140697580dae480d62b22f8dded71c096fc8e50f9b893e7ac5c7 postgresql18-docs-18.4-1.el10_2.s390x.rpm bbb8c1deed4472d5f4b4418efbe875fc60118fdcf82eb0024f025d5bafd2866e postgresql18-18.4-1.el10_2.s390x.rpm be58502d250ac8ae129704c0b1224131455d6f0c4bb9028edd6ca845f4effdac postgresql18-test-18.4-1.el10_2.s390x.rpm c3fd29c67df07d3eb210cc5534022fc9c9f54266f8d73443feaad43019da3613 postgresql18-plperl-18.4-1.el10_2.s390x.rpm c44fc2ceb64b199567441f96ec926cb11d040846185bbbfa6175566cc7be3cb1 postgresql18-server-18.4-1.el10_2.s390x.rpm f3a46d2493776a59190cd2200cb00e974df9c4f5c0752f34a94379cfb08023f9 ALSA-2026:27743 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postgresql-contrib-16.14-1.el10_2.s390x.rpm 0baab2cad8ea81133fa8d7ad490db5c3d90881cb3346e14290a3d8e7ad6f5957 postgresql-plpython3-16.14-1.el10_2.s390x.rpm 0fde31ae146bf56ef9ad07416a834bed65785ef6bf03e0907fab566438c31853 postgresql-server-16.14-1.el10_2.s390x.rpm 13eb96f33a42a47ef03e7bbf41df53f9ffef515155dbe51c0e5626cdd01df930 postgresql-private-devel-16.14-1.el10_2.s390x.rpm 2eb072d9a2af2920e04d1fa739b6406c0d7c3467c111251506ae43eb8e141204 postgresql-test-16.14-1.el10_2.s390x.rpm 4618a374e83ea77732b43ffe090ef61caa34c5dff6255df26799d1a567f9ec51 postgresql-16.14-1.el10_2.s390x.rpm 5d262af47b746dcd7bdb6864e159e27632bad950061583f599ae069d73ef7520 postgresql-pltcl-16.14-1.el10_2.s390x.rpm 68d328d3aedaf7a17930faa49f9f98c7077189ab52ea5bf5ac8df534f1516eab postgresql-docs-16.14-1.el10_2.s390x.rpm 8383eed32f19299488b7cf39de46bd94c2520348197ae1ac56f780af3512fd15 postgresql-plperl-16.14-1.el10_2.s390x.rpm 8539ca91e6a50b7e588105dfc85a365823d01f82d0d105580380fce82eeb48dd postgresql-server-devel-16.14-1.el10_2.s390x.rpm b7e2518836f1fbb61615732bd87bbec468f4973bfcdb194a0a151489c2ad667c postgresql-static-16.14-1.el10_2.s390x.rpm ce2f5d03cb5357e74fd3caac4351264dbfbece96b638f42e81121e9750cd92f9 postgresql-upgrade-devel-16.14-1.el10_2.s390x.rpm f0c17b6b31f8ebcc37df46170d7d1e978635be96b036b64dfb4ea1ca67c84bca postgresql-private-libs-16.14-1.el10_2.s390x.rpm f4901e221cc9353ed780b1990b8018be7587a8d77519ef8ebfff5ee988de522e postgresql-upgrade-16.14-1.el10_2.s390x.rpm fc5294b71f56f9735731bfd73cd4d2ce1078c55b1dba4da9987827e3d07cc2c3 ALSA-2026:27842 Copyright 2026 AlmaLinux OS 0 1 Important

memcached security update

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load. Security Fix(es): * memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default memcached-1.6.23-7.el10_2.1.s390x.rpm 340d2a8014f55c26f8c739c767eb3c104612f696865844d9b995399ee468fb7c memcached-selinux-1.6.23-7.el10_2.1.s390x.rpm ff639028200a35b6a0a3c933e5be43a51ba074e1e8bc0e4b5b2c674ba72bdc61 ALSA-2026:27929 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432) * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3.14-urllib3-2.6.3-2.el10_2.noarch.rpm 57130c6cb8bb3cf561d8de37fc42674c447fb5b7868aa36aa521c9f85eb9cdd9 ALSA-2026:28210 Copyright 2026 AlmaLinux OS 0 1 Moderate

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default vim-enhanced-9.1.083-9.el10_2.4.s390x.rpm 236f2137b0fe7a7a7e47d7bf84de0a71d6f1859a9b878745bddd2472bd991331 vim-common-9.1.083-9.el10_2.4.s390x.rpm 4a03e59e586fa3e160bb7518a65eea877613ee823786ff899591e980b7c6c323 vim-X11-9.1.083-9.el10_2.4.s390x.rpm 928354c9c2545f90beebd2ff9b715d40f933844d10f0952a10c578c33c720faf xxd-9.1.083-9.el10_2.4.s390x.rpm d3e75de106bf7c29f1a0011d883cb73685eca9b6c8093cde2f66b070a1feb0ad ALSA-2026:28233 Copyright 2026 AlmaLinux OS 0 1 Moderate

libpng security update

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libpng-1.6.40-11.el10_2.1.s390x.rpm e33cc2b10e499e853820a56aa1e2c4e1093f46d2fae7cebb74b65377e47a979e libpng-devel-1.6.40-11.el10_2.1.s390x.rpm e50e5f04906c095f882085599f5df0061ef33fc994bb40fcd2194d52fd042e80 ALSA-2026:28234 Copyright 2026 AlmaLinux OS 0 1 Low

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c (CVE-2024-34459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.1.s390x.rpm f91b83c29dd38d197d65032558d6e4f4f2e86077d934cf932e787fac46263cb4 ALSA-2026:28235 Copyright 2026 AlmaLinux OS 0 1 Low

libtasn1 security update

A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions. Security Fix(es): * libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string (CVE-2025-13151) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libtasn1-tools-4.20.0-5.el10_2.s390x.rpm 24633465e15c53a639a6ba3e92b8840b10b6b6ba79425892233ad1fb57f812be libtasn1-devel-4.20.0-5.el10_2.s390x.rpm a8fa572d87638c2cc1567ebf3d8c0083027814b6d174ba9214ba343823c3e61d ALSA-2026:28236 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsolv security update

The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150) * libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (CVE-2026-9149) * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-solv-0.7.33-5.el10_2.alma.1.s390x.rpm 812de92093086f52a9aa1268bc55cca73397a5a40e761453146774f712d98857 ALSA-2026:28581 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019) Bug Fix(es) and Enhancement(s): * [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3.14-tkinter-3.14.5-1.el10_2.s390x.rpm 45a7d7ab5a445fd2df40b5cd3c26b90a7cb2003413cc8cc759fedec3f159bd94 python3.14-3.14.5-1.el10_2.s390x.rpm b90047718ed8a5b5524a3126c9b1f0dfafec628cfab6cedc055da17e53b8464d python3.14-libs-3.14.5-1.el10_2.s390x.rpm cc0a6f291c36e2e76bcbd56caabf0561a261b139775141fb0f30612e7d768c7f python3.14-devel-3.14.5-1.el10_2.s390x.rpm d731bf06340fbd27d7637577e7e5ce1d93a122ebffd0874ac9684f0330944bae ALSA-2026:28582 Copyright 2026 AlmaLinux OS 0 1 Moderate

keylime security update

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default keylime-tenant-7.14.1-5.el10_2.1.s390x.rpm 29ec9dc6552f51feea643feaeb8b6e1d3dcefaf17bb1a31aaaa242195ac70ac1 python3-keylime-7.14.1-5.el10_2.1.s390x.rpm 6990c93ba4613344b6b881fb3f0e0e2172e53721270535f8384ff71dbe410112 keylime-tools-7.14.1-5.el10_2.1.s390x.rpm 746cac69bfea3c6351e8be61f89a02e7f3add4ff89b095d3964e330aa585bb97 keylime-base-7.14.1-5.el10_2.1.s390x.rpm 7cd8ca612319ff2af53af28c696463de50413f5c76b41a205dd38d92ed679d8b keylime-registrar-7.14.1-5.el10_2.1.s390x.rpm b911ba1953e6f7376ec899a0486daccded037e0cf532cd657b4f460bcd0016be keylime-selinux-7.14.1-5.el10_2.1.noarch.rpm d087cd9f6da8c7f7422c92a84a47ffcc48661ffb612541d27410ec43622a490a keylime-7.14.1-5.el10_2.1.s390x.rpm fbb4fbb4da9477f07255e1791618bf9aa40ede1b34df5dd52c9740e7e1d6a097 keylime-verifier-7.14.1-5.el10_2.1.s390x.rpm fe4817350cb77459752f8d54ff78f03680ad867ee29055c1cbbf6dfeb0ae79d9 ALSA-2026:28584 Copyright 2026 AlmaLinux OS 0 1 Moderate

libxslt security update

libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. Security Fix(es): * libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libxslt-1.1.39-8.el10_2.1.s390x.rpm 519792d71c053869694d66e57478072f2d7547f1b79c28ed01be496c40274711 libxslt-devel-1.1.39-8.el10_2.1.s390x.rpm c2d45a822682123e01b43dcd89e470c45b33737ffe526ebe917fee8981a62a2d ALSA-2026:29035 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default skopeo-tests-1.22.2-2.el10_2.s390x.rpm bb5ca955a3b5b10fa5c42f8fef008f906dfc1c4ea74b85cd19974fe0565e2322 skopeo-1.22.2-2.el10_2.s390x.rpm cd899b50c761282d49140abbc6586bca6ab2c329d2f721011c4642b39ac3bfe5 ALSA-2026:29195 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default buildah-tests-1.43.1-2.el10_2.s390x.rpm 5a87d77a7afbc896d5551ec5e408bd30acefc227390ba397a4535745d82321c4 buildah-1.43.1-2.el10_2.s390x.rpm fadea9c5d607696f2ba4ced058a3f39bc533dbd825ce9a0a27a1c550326da64d ALSA-2026:29874 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nginx-mod-http-xslt-filter-1.26.3-6.el10_2.4.s390x.rpm 09ffedae6f8e708f72ebe69bbe5313eb1e4ed4878d0f07b38ab99301731bf314 nginx-mod-mail-1.26.3-6.el10_2.4.s390x.rpm 43de831ae9c55456ea1c110858af0c59e27b3026efbca2bc2266c8dd6e90ddbf nginx-mod-http-image-filter-1.26.3-6.el10_2.4.s390x.rpm 5372838df1cfaa58aaa372edfdcc0c5e79693aa8ed9589474a9acd7cc346500c nginx-core-1.26.3-6.el10_2.4.s390x.rpm 54f2b122e65fd7b1f16222d871e30e5ac1552365a97132b3dbeb3de1812926d5 nginx-all-modules-1.26.3-6.el10_2.4.noarch.rpm 562b83c5c4657fa12e3561c30f43284f0fbc49e4d410c9f9b7f57f8dffef487c nginx-1.26.3-6.el10_2.4.s390x.rpm 8bd48e2f5c7b38e3edca9eb9ae5711bdd055fa421418fe86b1ad2965fa94cf46 nginx-filesystem-1.26.3-6.el10_2.4.noarch.rpm 9f23da9e2b3a022ca250a77c0fe4ad02e555ea9d6fc291bd81545b117d01a511 nginx-mod-http-perl-1.26.3-6.el10_2.4.s390x.rpm b26f6b8687412f7e28ef77232fed37c6e888ee51f67ed68438fc05e0260e46c8 nginx-mod-stream-1.26.3-6.el10_2.4.s390x.rpm e870fb7d220e0afda3485c4845a250f4d1f0f7b3baf9917e7b3eed409beefb79 ALSA-2026:29980 Copyright 2026 AlmaLinux OS 0 1 Moderate

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.4+1 [almalinux-10.2.z] (JIRA:AlmaLinux-183347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default golang-1.26.4-1.el10_2.alma.1.s390x.rpm 1a8ebe155f0eb6b5110298d38bc83362b5425acda98a253a286831b28fac9cbf golang-tests-1.26.4-1.el10_2.alma.1.noarch.rpm 3726ef009f97fa8d5d3a2547243c897a2ad61b3d3bf8c47c5d2bf97663366857 go-toolset-1.26.4-1.el10_2.alma.1.s390x.rpm 37f72094370c6bfcef78a43c888a1df9126e3cde4510fbb2e5f53f0cc036b640 golang-race-1.26.4-1.el10_2.alma.1.s390x.rpm 5ca21a1f37a07a585e6d4a22b848b3a016c9574e24b8f531fba319ed16069efa golang-bin-1.26.4-1.el10_2.alma.1.s390x.rpm 804f449300f6091b893a0318ef662f955565962a4bab2eb35074de935c50c67a golang-docs-1.26.4-1.el10_2.alma.1.noarch.rpm 833fa429b2a24d184ef4308625d865d9e06a1d3211c741a966b78c83ea469dd4 golang-misc-1.26.4-1.el10_2.alma.1.noarch.rpm 902dcd6c5009e267bf17ad6a17c944bab1e8d0806d3951286a1e40c6bed7d271 golang-src-1.26.4-1.el10_2.alma.1.noarch.rpm cfe20b9d0486e89e04d2f4b28058235230bff4d282b1571fc4c5279579e60d21 ALSA-2026:30129 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perf-6.12.0-211.28.1.el10_2.s390x.rpm 114746fcb1a4fb44af878edcbb7ea30d66f1a7ac3e3158862dfeafe3bb9a57c4 rv-6.12.0-211.28.1.el10_2.s390x.rpm 1cdf7973482286760ae144c3a5aa396a180a3803ee6d7860b8ccdd7cb6615c2b kernel-debug-devel-6.12.0-211.28.1.el10_2.s390x.rpm 5c103e91a692449c08c04b40078954faaca25f8550065b6ffda628ad5e567584 kernel-devel-6.12.0-211.28.1.el10_2.s390x.rpm 6e0b8c84417ddca0fb82be3d6a8558f5f0330993e3f87f31ef3ad232446177b5 kernel-doc-6.12.0-211.28.1.el10_2.noarch.rpm 7017f858229dac25fead46f7a86ea9f48bda9ff21527d8dafd2ca37464130d2e kernel-zfcpdump-devel-matched-6.12.0-211.28.1.el10_2.s390x.rpm 7910b56ffed58d53760ca0600a7ff67017bb38157cff44f086a9a6e0475b3507 rtla-6.12.0-211.28.1.el10_2.s390x.rpm 91f6a23288ed11e58cdf65d7434c1efa8741a86343824ff6a1f16cd4d13a152e kernel-headers-6.12.0-211.28.1.el10_2.s390x.rpm aae43852b7311ef244dd9614009921b33ec2d25a9c6be8723e1a270920912285 kernel-zfcpdump-devel-6.12.0-211.28.1.el10_2.s390x.rpm b17f2ec858dbe4ed00616c21c2a523917e2066e9bb7e218ed3a058d74001c5df kernel-debug-devel-matched-6.12.0-211.28.1.el10_2.s390x.rpm ca090b1496945bc2b38c09ff07fa77062479cc7ef52b915319b4d008c4ac4021 kernel-devel-matched-6.12.0-211.28.1.el10_2.s390x.rpm cc61fa622336c8ed9df5ed7e938c9bfcbde4e4380629388e9e2fff5b650aefe9 python3-perf-6.12.0-211.28.1.el10_2.s390x.rpm cf026e4ce38704939f92d2ecbfa6a8359f34a854d6f48c6b864e8a29d769b436 ALSA-2026:30845 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_md security update

This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal. Security Fix(es): * httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mod_md-2.4.26-5.el10_2.1.s390x.rpm 31f18085f26d77a39db8c87b540e1d17fcbb9bce7d58a3f2ca01fbba6149b718 ALSA-2026:30846 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default thunderbird-140.12.0-1.el10_2.alma.1.s390x.rpm 7a5ea9360b175059b27953b8eff34341c5b2eca23ef6ff93bb14e6b664d35679 ALSA-2026:30855 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.5.s390x.rpm e3f6e603dcad1337f9822355114bdecce67052b5311f5dcad26a8a62efaaca88 ALSA-2026:30857 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files. Security Fix(es): * perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-Archive-Tar-3.02-512.el10_2.1.noarch.rpm e6efbbe6db7984a333245143097f48825a68f0f7cc2d488c57fd1eec9db1d08b ALSA-2026:30860 Copyright 2026 AlmaLinux OS 0 1 Important

perl-IO-Compress security update

This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. IO-Compress supports reading and writing of bzip2, RFC 1950, RFC 1951, RFC 1952 (i.e. gzip) and zip files/buffers. The following modules used to be distributed separately, but are now included with the IO-Compress distribution: * Compress-Zlib * IO-Compress-Zlib * IO-Compress-Bzip2 * IO-Compress-Base Security Fix(es): * perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-IO-Compress-2.212-512.el10_2.1.noarch.rpm 741508f5ad1fac081838f6f573ee7ee5aed1ab60be165fde7eab4c556b6b2f28 ALSA-2026:33092 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) Bug Fix(es) and Enhancement(s): * Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on AlmaLinux 10 [almalinux-10] (JIRA:AlmaLinux-174869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glibc-doc-2.39-126.el10_2.alma.1.noarch.rpm 07f1c0fec3d86d729f94febb97a600a9829176f2de6b4eac4354dc95cf165db1 glibc-devel-2.39-126.el10_2.alma.1.s390x.rpm 575ad4ccd077e2de590984710c39320560dca2f2799c30684e2bd18d1a19bd93 glibc-locale-source-2.39-126.el10_2.alma.1.s390x.rpm 8f397fa6316ff4ea86700954b1b113c51c0e6766cf7816120113deedb4151fee glibc-utils-2.39-126.el10_2.alma.1.s390x.rpm df45df29974b20e6d57bdc0cda13b694cb728f636f1bee0a48aee1eba5d20a10 ALSA-2026:33093 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb10.11 security, bug fix, and enhancement update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux10 (JIRA:AlmaLinux-183086) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mariadb-10.11.18-1.el10_2.alma.1.s390x.rpm 11503c641f2f5598f81d43f3b9fd40813f9e53fe21e7b45cbedc427924bc2454 mariadb-server-utils-10.11.18-1.el10_2.alma.1.s390x.rpm 1ea7cf2f9f14e091286b2bdb8824f42a674a47f000c9a158d96726100b2f1928 mariadb-embedded-10.11.18-1.el10_2.alma.1.s390x.rpm 35bb49b48406d6e2e2f04872783db8e80333f07dc07e0d0664c458da47ba8c22 mariadb-test-10.11.18-1.el10_2.alma.1.s390x.rpm 40906598a15ab2009919697b3e441f84e2c408cf523429f8270385452c95b6fb mariadb-backup-10.11.18-1.el10_2.alma.1.s390x.rpm 65741dfc1e60fe9ffec689bcb63a93a9f28e8418f90b2ee32b5c60e7fd6b1efc mariadb-common-10.11.18-1.el10_2.alma.1.noarch.rpm 681f8ea6830f9775d238ef434fe0cb1d7ae292f04e23bb51b564dd3396b48a53 mariadb-errmsg-10.11.18-1.el10_2.alma.1.noarch.rpm 714e7719347d3e47e8ad2c0770a97c3dca85f00f5f67c30868bbc81cbeae8dea mariadb-devel-10.11.18-1.el10_2.alma.1.s390x.rpm 72f31caea519be07c82819c76c7d9e34f705732893b18c894d27b94ac026551c mariadb-client-utils-10.11.18-1.el10_2.alma.1.s390x.rpm 8164630f76945d36b7d7bd57ef109bf6eda6080e176ea16c8ae55d6054aa5a5c mariadb-oqgraph-engine-10.11.18-1.el10_2.alma.1.s390x.rpm 929eef279f0fafa90b314bcc875774d91bbf35a34838c969298e575a18dd9e4c mariadb-server-10.11.18-1.el10_2.alma.1.s390x.rpm a19bce836afef2e0dc18d4f5638a18a870f9c51766bf49ec2fa77b44ee1656ff mariadb-gssapi-server-10.11.18-1.el10_2.alma.1.s390x.rpm b0326b1b8dfc22571b56bd4e6607a4392c3f0583def76fc31973ad178efade2a mariadb-pam-10.11.18-1.el10_2.alma.1.s390x.rpm b6a706c2224fef216b9a50e4fa59841a4216b4d582742b2d5216b18fe0a657c9 mariadb-embedded-devel-10.11.18-1.el10_2.alma.1.s390x.rpm d5437cf90ee11237992cb3f5184c266de18e56138a3f2a11af397be931a272d6 mariadb-server-galera-10.11.18-1.el10_2.alma.1.s390x.rpm e4c3200c5fbfab430cfab3b43f969a3087da3ab676498d909d809da670d8b8f2 ALSA-2026:33412 Copyright 2026 AlmaLinux OS 0 1 Important

galera and mariadb11.8 security, bug fix, and enhancement update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 11.8 to 11.8.8 in AlmaLinux10 (JIRA:AlmaLinux-183084) * Rebase Galera to 26.4.27 in AlmaLinux10 (JIRA:AlmaLinux-183259) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mariadb11.8-pam-11.8.8-1.el10_2.s390x.rpm 11e67086979e2e0b6d7cd5cc041c86441d412d12012ffd620a2fa228138a85c1 mariadb11.8-client-utils-11.8.8-1.el10_2.noarch.rpm 1b8213a94b5a803fee91159889715d18dce58d1206715acfe2ca987d9c88560c mariadb11.8-gssapi-server-11.8.8-1.el10_2.s390x.rpm 1edee3c72f8c7e2557c935b4da0233f6c11073408175539cf07dbcd12be3078d mariadb11.8-server-galera-11.8.8-1.el10_2.s390x.rpm 20b1bb21b49a0ab4b9edcb1a3af3d5f058561dfc8f68ab7b6685937da11d426d mariadb11.8-11.8.8-1.el10_2.s390x.rpm 3132001a0c27d7a5e24d7b865bf3d1ae9015774e1d629854f7435d26561fa7d6 mariadb11.8-devel-11.8.8-1.el10_2.s390x.rpm 41b7c6447730045bc7906f47d043665fd1877b51cc019fb7870b4866b2b6e5f4 mariadb11.8-server-11.8.8-1.el10_2.s390x.rpm 87f090af2ab3bc67f6839d55a0a609bb7cca4648c810b9da7d4ca0ad2a822638 mariadb11.8-server-utils-11.8.8-1.el10_2.noarch.rpm 9b959318939709d585735442a771104817080a3fa715a214b85e0185a5e94ac0 mariadb11.8-embedded-devel-11.8.8-1.el10_2.s390x.rpm a3d9c05d371e15919265ef7174c1df4ceb01c5725d497e5f5f1f1e51bc9821fa mariadb11.8-oqgraph-engine-11.8.8-1.el10_2.s390x.rpm a420d95c0a73fc709fd6386ffc6b42cfaeebb5375b8fe8d6f68e6b1507919d4a mariadb11.8-test-11.8.8-1.el10_2.s390x.rpm a6f218b2074878298b19d39275748a8a6e756dae991a009d0cb2911d4cef392a mariadb11.8-common-11.8.8-1.el10_2.noarch.rpm bf247857f833df313151be70c72cf6cc08b2708a50410ff68503d30347ea33e0 mariadb11.8-embedded-11.8.8-1.el10_2.s390x.rpm cb6f21155e8a978ebecc44d75b459e2cf9f536eb28fddcc9b2eec05afacdcc9c mariadb11.8-errmsg-11.8.8-1.el10_2.noarch.rpm cedb5ef493d966e6486d252d6067e6b53503d8ae6ebdb7dd3e8f68edfd7f05aa mariadb11.8-backup-11.8.8-1.el10_2.s390x.rpm e5a76e41be4f9a7d1869609e65391d71feecc4589f1dc5fdc80ef89c65ed9bea galera-26.4.27-1.el10_2.s390x.rpm f1412465ea2db76dc07a75228eaefe1d0d5cd4e9bc3ca0d1aead8930653d37a6 ALSA-2026:33502 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default giflib-5.2.1-25.el10_2.s390x.rpm c47b46116ac5a936df92e8e895b02a29c1bd03cbc43e38ddc4646eb68bf79aa0 ALSA-2026:33540 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ruby4.0-devel-4.0.3-35.el10_2.s390x.rpm b4e84a1a0ac3589d11c53b0732e5ad162ea0ca8b9d8adab3cdc92602fcc19e75 ruby4.0-4.0.3-35.el10_2.s390x.rpm d1b0ee0e5b7f237ec76bbd5cfaba7849cbb62413857e27d16fa3ceaba989804d ruby4.0-rubygem-mysql2-0.5.7-35.el10_2.s390x.rpm e7f032d0701fffeb92419f3091ed9535f47101686cd00660ecac5d39eba54f4a ruby4.0-rubygem-pg-1.6.3-35.el10_2.s390x.rpm ec2a2fa28df85d9a0b4840cd19af9af937615f559460e9e198f849cddc9b2b02 ALSA-2026:33565 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rubygem-bigdecimal-3.1.5-13.el10_2.s390x.rpm 14d516f2eb2aae8e6e7dc324e5d1104e847b0106136924b3fc37a58c39cbf2a4 rubygem-psych-5.1.2-13.el10_2.s390x.rpm 21c50900d3ce1cafdbf220608205359e58614ccad6d990860f6de85a4cd85f56 rubygems-3.5.22-13.el10_2.noarch.rpm 2f09c90f0b4981535ebbe0b5b7b4ba60dd9bf5785c27f0948403aee04d0d5b28 ruby-default-gems-3.3.10-13.el10_2.noarch.rpm 39ee09200809903651fa2e054e18cb445e9dae3f0c19984efe4045642eba7d34 rubygem-racc-1.7.3-13.el10_2.s390x.rpm 4d714465e3d4d4d77e1a7a1943c99cb831c2068ae970ef0c6ce2e00cc55c3ba4 rubygem-irb-1.13.1-13.el10_2.noarch.rpm 5fe9dfe4760320749f19a851ab422764bf54367af0eb5510c9e54a95549daba8 rubygem-rss-0.3.1-13.el10_2.noarch.rpm 77dbae3e8147ddc42bab5b6ea0d18c2e4118e0105e415dcfe6fde5793202bb0a rubygem-rdoc-6.6.3.1-13.el10_2.noarch.rpm 84f1915103438280abdc5b9e57ca39fb26ffae2bf1bc21027bd6ffc6d79f3a9b rubygem-test-unit-3.6.1-13.el10_2.noarch.rpm 866eeea21e0bb345ada37a03f5d13b57a0399196476d646d5eb5506909bc81d2 ruby-bundled-gems-3.3.10-13.el10_2.s390x.rpm 8764972f28ca486911da0e35a69c73cd25eb7617b131ef6759854cf9aa672ff5 ruby-devel-3.3.10-13.el10_2.s390x.rpm 8773b863300e7f11052c1a2cc890284cc52de07c19861f47c3e8c3c069c950fd rubygem-minitest-5.20.0-13.el10_2.noarch.rpm 8d9d188779b8666f560bb68d91edd4391c9dc0cf440b9130fc0564c11966ea8f rubygem-io-console-0.7.1-13.el10_2.s390x.rpm 8f8a67b32e473e44128601fd670a5f46865f13ded96a98cf2c0c4047955603bf rubygem-rake-13.1.0-13.el10_2.noarch.rpm 9b79c2f558b1658de031381b86dd753b030592a6199883a0022919c04b379525 rubygems-devel-3.5.22-13.el10_2.noarch.rpm 9c2bdfcca295e0d66484e9c97a77cd7f3e0ac57cfdb203043fc7933c70d2ca71 rubygem-rbs-3.4.0-13.el10_2.s390x.rpm 9e20986035f9c9f8e47305f402439b5764e6c639927b8af387d07eaef32b2376 ruby-libs-3.3.10-13.el10_2.s390x.rpm 9ec7dc51ad30d0d4768811f329840c9d65d829227b4db9793c7c3193513d685a ruby-3.3.10-13.el10_2.s390x.rpm b070618267d3de85335a0661027ef3590fbeafe47203aa33f9a52de3859bb7a5 rubygem-json-2.7.2-13.el10_2.s390x.rpm c5c1d65da68cfdec1896d0d8d378bff41f7a43ae3ee76977cf9f786268d24eb0 rubygem-typeprof-0.21.9-13.el10_2.noarch.rpm d3a54b16ced51c5e321382a648a7fb7a1a9cac1940df6d3e2b907de4669c5d3e rubygem-bundler-2.5.22-13.el10_2.noarch.rpm dd71e0f69e1f86a3e4c35e6fd46db1e3360041d19976243b46e4612a81b06606 rubygem-power_assert-2.0.3-13.el10_2.noarch.rpm ed105a1583192586a2f3343deb1cbc054e85193e938c0fb1822c3397f0e7ffa2 rubygem-rexml-3.4.4-13.el10_2.noarch.rpm f59082b3a7963f92107e82ec2557edc1e4be848f32ef1752978e61ea1311d1c2 ALSA-2026:33685 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) Bug Fix(es) and Enhancement(s): * CLONE - [AlmaLinux 10.2 Bug] qla2xxx flash image validation failure [almalinux-10.2.z] (JIRA:AlmaLinux-181887) * tegra-se fixes and updates [almalinux-10.2.z] (JIRA:AlmaLinux-182759) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rtla-6.12.0-211.29.1.el10_2.s390x.rpm 1072956cded8c995a37dd4e1f0689fe50579959282b7f7bd384747110e0927aa perf-6.12.0-211.29.1.el10_2.s390x.rpm 30b345d6703a4fb02384f2f5d0d2ecf22149a5847819ecfa6d2714602017fa1c kernel-devel-6.12.0-211.29.1.el10_2.s390x.rpm 3b7fcb3e4064500f06b340e23cd214f75fe5a3245e9d6cf2b54711de3830989e python3-perf-6.12.0-211.29.1.el10_2.s390x.rpm 6336e297ae77ea472c073e0d26f4c451629c5612e33bc9faf706e9d6002fa973 kernel-debug-devel-6.12.0-211.29.1.el10_2.s390x.rpm 64b6b332ca183b53aba90b78c7660db6899a2dcdd3ce5d7e69baf3417c77cca3 kernel-headers-6.12.0-211.29.1.el10_2.s390x.rpm 8ae20ec745fad542db86c341087dc6f0adf593d7915e0f677ef0cde99d928a11 kernel-devel-matched-6.12.0-211.29.1.el10_2.s390x.rpm 8bfb0bb0d1c72fdac4919c47fdb9bc7dca9b403baf1373d0a0d43f6b48c6ba79 kernel-debug-devel-matched-6.12.0-211.29.1.el10_2.s390x.rpm a2041c26aefba9256502fb3a66374e6c2c26e36399ce8ccf0cc4a21ce45ee4f4 kernel-zfcpdump-devel-6.12.0-211.29.1.el10_2.s390x.rpm a8841289329348c8538c54bacc01be7477d1d7c389a1e4753c17c86dec6696e6 kernel-zfcpdump-devel-matched-6.12.0-211.29.1.el10_2.s390x.rpm aeb03bf0f5643091fcdf6adb290a308fb7e4ca3ba8d5a5170f7704d6a60d2dfd kernel-doc-6.12.0-211.29.1.el10_2.noarch.rpm b836e329534f6755772c1ddbdf8b9206b050a9efd1b92e1c01c0d98fdd9037c7 rv-6.12.0-211.29.1.el10_2.s390x.rpm fc11f7dfe249668c42d330ae7321343a3db99a121890a945bff8c3cc90bdebde ALSA-2026:33731 Copyright 2026 AlmaLinux OS 0 1 Moderate

rrdtool security update

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density. Security Fix(es): * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rrdtool-perl-1.8.0-21.el10_2.s390x.rpm 5f9e0ac11ee6a95f475c5bc2c1c0e4f44888a5665ca6234e4dbb5b54c34f0141 rrdtool-1.8.0-21.el10_2.s390x.rpm cb32a4d09b9c80d2ea006e16161b238093322f1d0f9b67a9ba13c178d8d31d2c ALSA-2026:34109 Copyright 2026 AlmaLinux OS 0 1 Important

httpd security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) Bug Fix(es) and Enhancement(s): * address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mod_session-2.4.63-13.el10_2.4.s390x.rpm 1ea2283dc07624ccd46bb26c063903060d9ed4165f26b21ed16d8d177e4aa4c8 httpd-tools-2.4.63-13.el10_2.4.s390x.rpm 223887e17e6950c6eddf981f206a6d2053829c173f564a30f827f25cd0dc48c9 httpd-filesystem-2.4.63-13.el10_2.4.noarch.rpm 30a9431c19d9b0eaee77dd0b3a9c83a8c8a3a28bd86f1779bae9f85de7bc9f30 mod_ldap-2.4.63-13.el10_2.4.s390x.rpm 3d8193b862177d63b16dea066472f6cb7fc551ad7fdcfd37db53fbdc69a1cb5e mod_lua-2.4.63-13.el10_2.4.s390x.rpm 40bb160b7bb00166da9fbec14af7335d62ad348db1254ee5d73b7d7fe7db6399 httpd-manual-2.4.63-13.el10_2.4.noarch.rpm 5e32be7a095c8c1c4519272d18d660a3422b7a943ac850a731cff5f11027152d httpd-2.4.63-13.el10_2.4.s390x.rpm 5f0593ed0bcd8da3593680807c90f2bac7a40661f2d3a247f0f485095bbb9e96 httpd-devel-2.4.63-13.el10_2.4.s390x.rpm 746ee8715a133ec69257d7f0fe41fae8147a0382966334d12b6d57536b1fa150 mod_ssl-2.4.63-13.el10_2.4.s390x.rpm 8c4233a6eeda0bb9aa9e45c39a51507ca80d3a65a83b85d9e4527999bb5a1bc5 httpd-core-2.4.63-13.el10_2.4.s390x.rpm a949a52d5f0e1adaf425614c691ede07eac85ccc0b4b09d404a7e5478417248a mod_proxy_html-2.4.63-13.el10_2.4.s390x.rpm b8c6a80235c1612a21a95d1d6e83b6537917effe2369ff84eb2c445a3c383efa ALSA-2026:34355 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_http2 security, bug fix, and enhancement update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Bug Fix(es) and Enhancement(s): * address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:AlmaLinux-188008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.2.s390x.rpm f22e8f434b5b8484caf1544560c2acb6ab4b249818b284e1dcc82af305391228 ALSA-2026:34357 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default opentelemetry-collector-0.152.1-1.el10_2.s390x.rpm 0a558bfdfeed66a77c753828f52420d58779c6fe3074dfc97797de757edce3a9 ALSA-2026:34911 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) * kernel: kernel: ipv6 frag escape () Bug Fix(es) and Enhancement(s): * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z] (JIRA:AlmaLinux-182537) * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rv-6.12.0-211.30.1.el10_2.s390x.rpm 0109722d2795decc6898ff034519b959c7649518ca8584a176933c202749e5fb perf-6.12.0-211.30.1.el10_2.s390x.rpm 012dbc878d23b45dea1d92109c7d13aa3310d60b7ee24823604c7bf93d8dab5d kernel-headers-6.12.0-211.30.1.el10_2.s390x.rpm 06d1f2d085742c765984eec6d19b6982f723e7cfcfdfad57fc52c4a9de7525ca python3-perf-6.12.0-211.30.1.el10_2.s390x.rpm 313f0ed5af010f04539152ff90e52dae939e0e10dea4a89e833629f9061d0e2c kernel-doc-6.12.0-211.30.1.el10_2.noarch.rpm 37071c47ef6d33902382a8ed775082ac0e87202627db8e9d81a39e5f0fbdfabc kernel-zfcpdump-devel-matched-6.12.0-211.30.1.el10_2.s390x.rpm 3987c3a477c5b39ab133cfdd3223a515992d2178ee219f3f93d0c4101c90bc5d kernel-zfcpdump-devel-6.12.0-211.30.1.el10_2.s390x.rpm 69480f9d4568b3a1357e94d9f981c535168be6bf8afe3f10d34fbdef7dcec2f8 kernel-debug-devel-matched-6.12.0-211.30.1.el10_2.s390x.rpm 77998128718c959127e17886876f9151d15a6220074cee638345cf40767a4bf3 kernel-devel-6.12.0-211.30.1.el10_2.s390x.rpm 7ec6858ce0c28a6fc5133e4dbd63271ef289eb0044859c0bf299df75e6fb4447 kernel-debug-devel-6.12.0-211.30.1.el10_2.s390x.rpm a3c1900aacfc1699d7baedadf0568650a4c602c37fb1b7ebea03fd2aa9be3561 kernel-devel-matched-6.12.0-211.30.1.el10_2.s390x.rpm a9c503214b7a8db143c1867be69077f629b8be4baa3627b653b2a30c9d31481d rtla-6.12.0-211.30.1.el10_2.s390x.rpm e01c50bba638cbab3619d04b531de95e1596aa4af27ed9a550cb96c78c3e7c47 ALSA-2026:35826 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default grafana-pcp-5.3.0-7.el10_2.s390x.rpm 2c7d9da56cd7784089bdfb855b3ee2efc66212c50a2cd5b3648fb9cbe0914f52 ALSA-2026:35827 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default grafana-10.2.6-27.el10_2.s390x.rpm 23411e2c458a2d10d1703950b56415f9f7a449f4048ef5f5adebb75972aeee9a grafana-selinux-10.2.6-27.el10_2.s390x.rpm 7aa677ab04a5ed69585f00966d7d8c6e217185ba7f0b35164a439c0b56123421 ALSA-2026:35832 Copyright 2026 AlmaLinux OS 0 1 Important

golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ipp-usb-0.9.27-7.el10_2.2.s390x.rpm a2ad29b51a930fc3dfbaec3f58c50882e2f9386fd5c00c49b5548ead2678d411 ALSA-2026:35841 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs24-libs-24.18.0-1.el10_2.s390x.rpm 109ef77a85154fcdacea34123a30652b9f1cf4ab44e6337fddcfc76936f60f98 nodejs24-24.18.0-1.el10_2.s390x.rpm 2b0c8e403925d25398af1da95e70e0f77b2df78e7cc73408affada43c706e470 nodejs24-devel-24.18.0-1.el10_2.s390x.rpm b0a6a435bf710a324c8d5dee53d9899519292232dce2953ae9fa12198c1c8368 nodejs24-npm-11.16.0-1.24.18.0.1.el10_2.noarch.rpm b26d8267ca66276f7e691e6ae46d36fc0beaccc3064246c73bf7e97f5437ff7d nodejs24-docs-24.18.0-1.el10_2.noarch.rpm cfbfb133600350bcd79f384de1fe77fa2508bf7bbac0e804b4b4b5991450e772 nodejs24-full-i18n-24.18.0-1.el10_2.s390x.rpm d3534cf2ae4d78d14a8ff828aeb519b24e27939870a71b6336ba94f01d5fc586 ALSA-2026:35842 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs-devel-22.23.1-2.el10_2.s390x.rpm 2c4353d6eae917b51331f8b41f9198bf026e6629394934d484300a2a0f6076c7 nodejs-full-i18n-22.23.1-2.el10_2.s390x.rpm 2f4bd8ace9de98e097f10332136736396cd9989c55f92d6af3511541daf88325 nodejs-docs-22.23.1-2.el10_2.noarch.rpm 492a598f325fdb1de667b1cf3eb563ff290a931816399634238410c6852efc36 nodejs-libs-22.23.1-2.el10_2.s390x.rpm 4c97d22c21f93e987cea0e99735be544a95fa79354a5ce24896e86b69a8cc122 nodejs-npm-10.9.8-1.22.23.1.2.el10_2.s390x.rpm 9408d6bb53dd2bbcdc8dfe45b235a81b42d27b24ef70b35e1539c5a82b4e2bd9 nodejs-22.23.1-2.el10_2.s390x.rpm e20840ebc353064d0e1bde6ac89403eebd431118e764760646b772f41ee48c61 ALSA-2026:36193 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-pip security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3.14-pip-wheel-25.2-3.el10_2.5.noarch.rpm 80456c6bf4f96a398309a5858cf83bf96d5c0f655b8b581a95e3ff83b8664e80 python3.14-pip-25.2-3.el10_2.5.noarch.rpm 927cdfb0565ce93516e52106bc6c1092e3eb33f3170f0a74c8dfae46233929be ALSA-2026:36196 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default 389-ds-base-3.2.0-8.el10_2.s390x.rpm 9a40390a3f475fe2afc08117c45c805a5803a455e4e1456803bd7163e8d3b10d 389-ds-base-snmp-3.2.0-8.el10_2.s390x.rpm c2f7d7359a557719c3c77b0261d1b2a1e7ef03cb4bdb35b63d130e7ad459414d python3-lib389-3.2.0-8.el10_2.noarch.rpm db8acba0242228f0760021708fbba6f09ec6c3ed8b57470de69e594a8a184aa0 389-ds-base-libs-3.2.0-8.el10_2.s390x.rpm ebe21c4a2247072af66b05010a858b4792b7520853b41cd34ffb1b1ae90869f2 ALSA-2026:36199 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default buildah-tests-1.43.1-3.el10_2.s390x.rpm 731fc328513f6005b32fed3abd3c0aed9a797d89bb0d127ee1aab92472ccdbb3 buildah-1.43.1-3.el10_2.s390x.rpm ace0cdcd3bc79ca1a26f7a8aaf6e70a648ae9516a3ff17a65b2c7cd89970fdff ALSA-2026:36203 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033) * freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422) * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700) * freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421) * freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default freerdp-libs-3.10.3-12.el10_2.6.s390x.rpm 264c640bb60f3f9788f7163aeb48da02ca7233bd6e4fa17d3a6335d206a3db88 libwinpr-3.10.3-12.el10_2.6.s390x.rpm 65264754bea4f9c7da58b771569338f3b9aa23a6ec88945818caf9c1cf41dbc5 freerdp-3.10.3-12.el10_2.6.s390x.rpm 7d59f6a03941d60d1c369a56ae81aac8d4b76bbce024b8d10573239acbc80bba ALSA-2026:36211 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default freeipmi-ipmiseld-1.6.18-1.el10_2.s390x.rpm 5c46d359f48785666e964b16184442c67893ec1c3d79329e6ff1f8e80244f93f freeipmi-bmc-watchdog-1.6.18-1.el10_2.s390x.rpm b856ecdb0d0c1c93ffed75623eb5d2bc5a259618a95ae5cccd86fbd1613e9e1e freeipmi-ipmidetectd-1.6.18-1.el10_2.s390x.rpm edc93f057921b1f027706ff8fbf0fe1287347dfa7d1cf8bc83fcf7e5da45a0b7 freeipmi-1.6.18-1.el10_2.s390x.rpm f9630ab0c987b2dffc20c16b56f4d97bf96084ad04674664aba83ec8c54c2274 ALSA-2026:36320 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292) * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622) * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390) * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-unbound-1.24.2-7.el10_2.2.s390x.rpm 299eff6a5b216b25a775cf8a0c8a6a3d90137a8b712892a190f7b3676f308ee5 unbound-1.24.2-7.el10_2.2.s390x.rpm 4bd3c5994d8a153a8ffccef226638942df056a3ab933fc08664b9b1c3895af6e unbound-utils-1.24.2-7.el10_2.2.s390x.rpm aa6804c800e7af2aa99194190e553cb1f2d76ddd59bf500f7d649ef8dcaa6961 unbound-dracut-1.24.2-7.el10_2.2.s390x.rpm dd7b0422892f55e5e563762dd4ec724a03134f06df612c938df82d7bc9ae8278 unbound-anchor-1.24.2-7.el10_2.2.s390x.rpm e664bb982bea10121defc14359daff05fa33675ec19de05a2ff338a35c99891f unbound-libs-1.24.2-7.el10_2.2.s390x.rpm f3682939aadc3c6c69e973bb688491adf2730fc69435ee2e876a8e50a7e52b2f ALSA-2026:36364 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) Bug Fix(es) and Enhancement(s): * "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-10.2.z] (JIRA:AlmaLinux-191778) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nginx-mod-http-perl-1.26.3-6.el10_2.5.s390x.rpm 0604b367c9847b9db624fdf719185db15b416350530a73f63f39cae0de1362a0 nginx-mod-stream-1.26.3-6.el10_2.5.s390x.rpm 20e8136a2a0a18b1134d272a8bc62471a64c97d4bda4a1890ec5ddf7a6275970 nginx-mod-http-image-filter-1.26.3-6.el10_2.5.s390x.rpm 565f7c1a3ed8f69d95412c61819ad503c63e437d0cd68cbf55aea0b7ad0ef3c3 nginx-mod-mail-1.26.3-6.el10_2.5.s390x.rpm 5a51d514998ce5c01e7ebed9b69f5bcd36b6942db3479b7d15f5ccbbcb22d09d nginx-mod-http-xslt-filter-1.26.3-6.el10_2.5.s390x.rpm 5ef249c5350383cdcd6d70138bf0b797a122b2947bd8cb8d9d3580edbe19c476 nginx-all-modules-1.26.3-6.el10_2.5.noarch.rpm 63783f2757ef9f4c14eb7739660124c6c7d8094475d4b3333f54aa552c72f0fd nginx-core-1.26.3-6.el10_2.5.s390x.rpm 7d53a00736ba04658597505454f63ed2f1dc161aee5665b6126fda3cd8d79a22 nginx-1.26.3-6.el10_2.5.s390x.rpm b71ab55552cc556821467973295eb302bc4269b536e7e3f1176d47ce7c5d0988 nginx-filesystem-1.26.3-6.el10_2.5.noarch.rpm e33cd1bd4272896159c0e7c1cd3fb48f85a85d98e7641fd3ac67aa121ff5fae5 ALSA-2026:36541 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) Bug Fix(es) and Enhancement(s): * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z] (JIRA:AlmaLinux-162140) * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z] (JIRA:AlmaLinux-182770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.31.1.el10_2.s390x.rpm 07771c3eff521db02c25db54362f2030098deb52468a70c8629b96183e4fbebd perf-6.12.0-211.31.1.el10_2.s390x.rpm 077d24fbfd8828ddc71f1ae8fdd9846db6f360988fb1b1ed0fde95063e556864 kernel-headers-6.12.0-211.31.1.el10_2.s390x.rpm 0c6894cf11a3ff08089652358aa77992cb0e489b4d8aeb0b9171b8eb195d32c2 rtla-6.12.0-211.31.1.el10_2.s390x.rpm 34ee096b4d5c97323c9675e6e854ea30bd2ea2944655eb5320025951717dc3f1 kernel-devel-matched-6.12.0-211.31.1.el10_2.s390x.rpm 63f60c9fdcf923d4c06c2b68e1c02a15e5e6cc792a9367872ad7240ce0cbd437 kernel-debug-devel-matched-6.12.0-211.31.1.el10_2.s390x.rpm 750d1777b820f4a448a6e253feb3c7a86e8b0c4d0348ba891c35bc62557a7c7f kernel-doc-6.12.0-211.31.1.el10_2.noarch.rpm 89b91f15b9a6c2c75be8b2c7e16409d5457cac0e17efe5cccd145ffe6964e501 python3-perf-6.12.0-211.31.1.el10_2.s390x.rpm b2a3b21d74c319d47c07e3c9b34166030092f63bb75061c87e8ee5de319e9ea8 rv-6.12.0-211.31.1.el10_2.s390x.rpm b50f893613dd5592532328c61da441da3ffa3174848b202bd28fd2fd04e94b47 kernel-zfcpdump-devel-matched-6.12.0-211.31.1.el10_2.s390x.rpm ce4298d9f634c5a9b850110c1bfdf7ff6f19030c3a1534c88c66d38152eaf0f2 kernel-zfcpdump-devel-6.12.0-211.31.1.el10_2.s390x.rpm e01c7cc520fc1a39af476e7b4cc91295f9e8641bd236fbe066e49cb901598c87 kernel-devel-6.12.0-211.31.1.el10_2.s390x.rpm e81b4b2007be7deb00d2e001fd6528234a2aa8a6e1e454463d57d7c2de339f81 ALSA-2026:36675 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.1.s390x.rpm 308e97ea8ec2c45ebfd8b5a945535aad10dbb672b2f4fb3d1dff5d1101fa0be1 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.1.s390x.rpm fbeafe968cd1c7c4b40b52aa1badf8bf1cbca3f652941aa7971becc58c861b2f ALSA-2026:36749 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.s390x.rpm c33c0daf36d91e26ee1ec8999befd88f912cfa1925eef5cf710ec41bbf9b8522 gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.4.s390x.rpm cab86c5813cdae230019f691c61cf19a0bd7d5204d92660e30ee03f0eb2da1d5 ALSA-2026:36782 Copyright 2026 AlmaLinux OS 0 1 Moderate

aardvark-dns security update

Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in `src/backend/mod.rs`. Security Fix(es): * aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset (CVE-2026-35406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default aardvark-dns-1.17.1-1.el10_2.s390x.rpm dd26b1a3c579a699439e1933db3cc9c4ee2aa918e27751851813eff65011ec7c ALSA-2026:36788 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat security, bug fix, and enhancement update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default tomcat-jsp-3.1-api-10.1.49-3.el10_2.alma.1.noarch.rpm 1819dbffc1a4bca43680dfb716f9f6bfca480b2c4603395e77e0a419a58fbf40 tomcat-servlet-6.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm 2554b1cd27aae45d566ee543e529a7f8b631976f3dc644dccaa3151198093639 tomcat-el-5.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm 4b09a49a6a830ea70914354fdb2180be3d73be82a0bebb83bdfefc3d3432cb85 tomcat-10.1.49-3.el10_2.alma.1.noarch.rpm 7a52ade066f085dc82c61eb86e4ef336c98d2ac6ba70eff0127686795e779fa3 tomcat-lib-10.1.49-3.el10_2.alma.1.noarch.rpm 8493861578941c0333c0447a8fba9719aa909187e4dfce1eb7ea6f9689eb73f4 tomcat-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm 8545fc47344bf1f124375700093b8bd550c7b5bbd3885316391a2c6901779bf3 tomcat-docs-webapp-10.1.49-3.el10_2.alma.1.noarch.rpm cd529a071ef3d5271bd60e65c7097b158dc762889174cff1d29908a19942df9b tomcat-admin-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm f1ca32a57c82c415745065d6ad5dee139ea70ca3e4b206c2c5213577fb413f9f ALSA-2026:36790 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat9 security, bug fix, and enhancement update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default tomcat9-el-3.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm 1e7a1f290d83d33dca1568da1d68c956d2ff9d703a7b398d2955f8f881f6c51c tomcat9-admin-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm 35f74b44de15b3b04a6bc454a111d3dfb26dfee6c7ad16644fb1a88130dce735 tomcat9-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm 3682120341af35136b188a86d60de457c2c5936026aea99b5a7b1317d71f90f2 tomcat9-lib-9.0.117-2.el10_2.alma.1.noarch.rpm 3a1e23335ca4fc1ca27006743516d5c74f7da734dc74dcdc72f5a4bed710668b tomcat9-servlet-4.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm 42f01e89a5d4c20d96e5212710be93238f72ce04851d86ae714c53b925109a88 tomcat9-9.0.117-2.el10_2.alma.1.noarch.rpm 7b18a53d3580ad05f99f8ee76bc0a5408bc9f0a2ca45465fd3446184546c2cb9 tomcat9-docs-webapp-9.0.117-2.el10_2.alma.1.noarch.rpm a59f4bad7f545f5287804da402c7f5be36cbae0c74cf7b8b5f691c3473fe68b6 tomcat9-jsp-2.3-api-9.0.117-2.el10_2.alma.1.noarch.rpm ac4d0fe0045a2723cfb5b6f43bdf719a027a0d7e5f26985bc08e3b4c1c91feb3 ALSA-2026:36956 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.32.1.el10_2.s390x.rpm 027825e22f472883c5bd2464ea60e6156cf560180a53d2eceec6707f7b2b3d81 kernel-zfcpdump-devel-6.12.0-211.32.1.el10_2.s390x.rpm 166a5169ce689f80cbada81b24700faa6ebfa02112c99365c68cf3cc3c716437 kernel-debug-devel-6.12.0-211.32.1.el10_2.s390x.rpm 2e984aaea58ed6f62587b1061003991a59fe00939680502ed944e28418c38370 perf-6.12.0-211.32.1.el10_2.s390x.rpm 398637f1aeefcc80e162c1ff44822c449c543f0c0e251c6374d0924649c87dfb kernel-doc-6.12.0-211.32.1.el10_2.noarch.rpm 4f6f025dca58da64c2300881e18f8767aa214eab6914aec981f04cad4cabb279 python3-perf-6.12.0-211.32.1.el10_2.s390x.rpm 5d26ff4ff44e61048a3f29e950c87ceec06d7ad6cee217ee5752b66354b5e5d0 rv-6.12.0-211.32.1.el10_2.s390x.rpm 7c739573b6056504055c04014e50effc58c64a31ded2b0fc4eb4d874df707360 kernel-devel-matched-6.12.0-211.32.1.el10_2.s390x.rpm a9b5029c8782bc9af609524d311b29226670755698eb13e24515f62c7e8e4a0d kernel-devel-6.12.0-211.32.1.el10_2.s390x.rpm d8f2147c6c08afb8936eda7f0c3cdabfea6a264f1dd752cfc2f08843c3a3a480 rtla-6.12.0-211.32.1.el10_2.s390x.rpm eb7690aec2dc640bea7c288d17c1fd207c6d7a750b1ae9e37937c4a2544fd993 kernel-zfcpdump-devel-matched-6.12.0-211.32.1.el10_2.s390x.rpm edaeeb4407dfde4d3b319aec6d396972a0dafe9546150ea62963311776d441ca kernel-headers-6.12.0-211.32.1.el10_2.s390x.rpm f0f1fb22eb114ed070b69cb35d135519122354b129adebd9a4382f5180b82f30 ALSA-2026:37436 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.5+1 [almalinux-10.2.z] (JIRA:AlmaLinux-193473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default golang-bin-1.26.5-1.el10_2.alma.1.s390x.rpm 2dd88c2ddc216c3fe212158aade973a77ed61e524322c29b91762a15f0010b68 golang-race-1.26.5-1.el10_2.alma.1.s390x.rpm 315ebcc467d4b90ae121247466a86fe036b0bf77b4a7ff5a8dde5d520e2cf6b3 go-toolset-1.26.5-1.el10_2.alma.1.s390x.rpm 477ceaa2e0c1c092ebf520834725ebafb9061c93e2a350dd42430ba037030ef1 golang-1.26.5-1.el10_2.alma.1.s390x.rpm 65d15465154e3438ec0fa7beefa4abf5351fe037b518a4ac875661d3de3129fe golang-misc-1.26.5-1.el10_2.alma.1.noarch.rpm 8b1baa3232557c008b80897b0d878d2d32cb781b8cc9b3418c2541f114ab8bd2 golang-docs-1.26.5-1.el10_2.alma.1.noarch.rpm e79232aca5b77e65b500df22bd8d4d8328e0c2dce6833e3fc94730d5830a9c07 golang-tests-1.26.5-1.el10_2.alma.1.noarch.rpm e793fc42fe1650f9a19106e8b5b7a3d9bdb7d8d0204ee5e5af2c808d2d66a9bc golang-src-1.26.5-1.el10_2.alma.1.noarch.rpm ec33bba2e56c497962b088c3e47106cc014d357d9e7a0743489c3b9f1da82635 ALSA-2026:38489 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) * X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.s390x.rpm 2b123aace528e054e6ddae865d81b9945f15f7cf5a036bf1260aed60e9bd9862 ALSA-2026:38492 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-zfcpdump-devel-6.12.0-211.33.1.el10_2.s390x.rpm 0295289b05161c4f296ef4484624b47b5b197d85cec666fe3ad17ceae7e8c15f kernel-debug-devel-6.12.0-211.33.1.el10_2.s390x.rpm 05bbe6e3489d4800fad70bb13515fc5c8649ec44d6e236f3b886b5078fdafd3d kernel-zfcpdump-devel-matched-6.12.0-211.33.1.el10_2.s390x.rpm 11047d5a77d5687acbb6173d7c214182004c0fff08cdae48061c2d6bbf1fba50 kernel-headers-6.12.0-211.33.1.el10_2.s390x.rpm 1fe571520b3eadc5546fa6e50aa789b571386d6620a0a9fdb1c708e086c8af92 perf-6.12.0-211.33.1.el10_2.s390x.rpm 4c1b5731cad590cb0de420acce4d7763b47cbc2e199970377ccd98cb3d291b9b rv-6.12.0-211.33.1.el10_2.s390x.rpm 4f626677b6f989ed17bfcb2dc6b54d0230f68608b69c6b043cebcdf4bf6f27f3 python3-perf-6.12.0-211.33.1.el10_2.s390x.rpm b157ee8a6c1193befa0d8164220390e8199008777b6581c96f8bbbf6c1943296 kernel-devel-6.12.0-211.33.1.el10_2.s390x.rpm b577e9b0a3e784dfe022a53d885ffcf1e84ffd38a30c7f56c448667bae493d33 kernel-devel-matched-6.12.0-211.33.1.el10_2.s390x.rpm bbd295372b8af584a2bbdc66b15a69cb8699ab86ee17e2f95f81a30a47038bb1 kernel-doc-6.12.0-211.33.1.el10_2.noarch.rpm cb6b5ac15159f9f1673206a9a80d24ed89608d643c0b10f5ae9295c1579474e0 kernel-debug-devel-matched-6.12.0-211.33.1.el10_2.s390x.rpm d8fd26cc37348268a11707c5119579fd4fe26692c217845b7933eb6fd2450885 rtla-6.12.0-211.33.1.el10_2.s390x.rpm f74b22130ec4a994af425bdf229b56bcd2ea45d07607bbd9e04d218f48715e2d ALSA-2026:38494 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default buildah-tests-1.43.1-4.el10_2.s390x.rpm c2bedc8a39ae8760496f01c56cc67b610f24f16f50f628d54a54d4fad825db7d buildah-1.43.1-4.el10_2.s390x.rpm cf0837319fb7579379e615e1cfb7a99425e8253bfcf9b00cfcf3628397179131 ALSA-2026:38495 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default podman-docker-5.8.2-5.el10_2.alma.1.noarch.rpm 6d642e7bf54d7d8737244e959bd94e167100278c8303a9671587b40898d8f8a0 podman-remote-5.8.2-5.el10_2.alma.1.s390x.rpm d745fd12a9b184194486c7ac436f62be9377d679f9fcca8da644c25af27637e0 podman-5.8.2-5.el10_2.alma.1.s390x.rpm e6bee2705bd0c0ccbbb6b768e1dcebbb0f281faff4d78419fe8d0f2b0f351ba7 ALSA-2026:38499 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142) * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openexr-3.1.10-8.el10_2.3.s390x.rpm b358d2d51d6b390af08aab0f08f69b662b12a7f881f5983354de85e051268eb1 openexr-libs-3.1.10-8.el10_2.3.s390x.rpm c504f7a12ecd947ae0ca680a1b598e0532644789f79379032e6f573153585dd4 ALSA-2026:38509 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162) * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858) * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default xxd-9.1.083-9.el10_2.7.s390x.rpm 34926c13f6de7314fc1dcb09a49a448b997b83310a4041dd22abb2f2359f56c4 vim-X11-9.1.083-9.el10_2.7.s390x.rpm 3a0352e1651fdb923a3120aed177977556275bcd83b798fe8cc058b2fef40f8d vim-enhanced-9.1.083-9.el10_2.7.s390x.rpm 9433b90af6f8ef52bdabb8e0e969322c24bdb08999e7dd6a099d2e2396ccd8bf vim-common-9.1.083-9.el10_2.7.s390x.rpm cf682260105f96ccc1c372bb4bcbda892589415ded4a0910f9cbbd8044d4529b ALSA-2026:38513 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.1.s390x.rpm de650c1acc2d81917f187630fa00e04ff124d3a55db661d4f44c1fbf0c6624b0 ALSA-2026:38514 Copyright 2026 AlmaLinux OS 0 1 Important

plexus-utils security update

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage. Security Fix(es): * org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default plexus-utils-3.5.1-9.el10_2.noarch.rpm 0e05d395f8b55a153026dfa3c8010ad4245d0439c34d80e42db758da41ab8738 ALSA-2026:39183 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python-unversioned-command-3.12.13-2.el10_2.1.noarch.rpm 01fd0cfaa34357b582559770297e93d57c2b9e0ffb6f529c89ba4cd34d50ce96 python3-devel-3.12.13-2.el10_2.1.s390x.rpm 8c672a5657ccaa3366235868fb83bac82232870714bd5935841ae5c965cdf5e0 python3-tkinter-3.12.13-2.el10_2.1.s390x.rpm bff682a4fea20de530a2a806b03320d7d162fd7d28c6fd1ce980f5338e240849 ALSA-2026:39272 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.6.s390x.rpm f987098b9e0d866d90d8b46e506d95b9092750cb8744ac322ec3c6070a0174ea ALSA-2026:39296 Copyright 2026 AlmaLinux OS 0 1 Moderate

libinput security update

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es): * libinput: local privilege escalation via crafted uinput devices (CVE-2026-50292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libinput-utils-1.30.1-2.el10_2.s390x.rpm f124d53fd0b7ff25c7474fdc531147651f25d214e1cd3e5347415008047ef73b libinput-1.30.1-2.el10_2.s390x.rpm f70945995376933fb62e56188574e059570025440847cb799af99a2af2c41c10 ALSA-2026:39297 Copyright 2026 AlmaLinux OS 0 1 Moderate

edk2 security, bug fix, and enhancement update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) Bug Fix(es) and Enhancement(s): * edk2/x64: re-enable legacy kernel loader [almalinux-10.2.z] (JIRA:AlmaLinux-182421) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default edk2-ovmf-20251114-5.el10_2.2.noarch.rpm 15c2aa72562324380757fa4e4264b27e8d215a4ead60505448e6556096472823 edk2-aarch64-20251114-5.el10_2.2.noarch.rpm 5ebf1586f73cdbb4f6af4b6fac8634e21e96c81337572dd52d11cb6022b477ab ALSA-2026:39302 Copyright 2026 AlmaLinux OS 0 1 Moderate

cups security update

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVE-2026-34980) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default cups-printerapp-2.4.10-18.el10_2.s390x.rpm 34f6cf29426c7470641174ca53d81adfcd6dda7b2945a14a461edea75d677433 cups-lpd-2.4.10-18.el10_2.s390x.rpm 3b0c23941f746ed58d34a0f7b48d804d6d700c1e7a3eb851763ff0997677ed38 cups-client-2.4.10-18.el10_2.s390x.rpm 73491db610ccd1f201fc86bf4c0b4205418f3d45a5167a3f6633a9c8657401f3 cups-ipptool-2.4.10-18.el10_2.s390x.rpm aa95e3b400a23b71903fbb471678d13384a24b3101963d191cef0fe970d59996 cups-2.4.10-18.el10_2.s390x.rpm c1f18eea2ba1103a5fb8c550f6bbf6b2c5a6455081e22dbddb8dd2d57bf0a4f4 cups-devel-2.4.10-18.el10_2.s390x.rpm cd49eb918de22ea2995600aaf1a9f9f4b894078446c3a0d099931844c7976f60 ALSA-2026:39304 Copyright 2026 AlmaLinux OS 0 1 Low

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling (CVE-2025-6170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.2.s390x.rpm 843ca905581ee6c624ad357db9c8fdb421d62bc002db3bbcaf67fab29f13dc06 ALSA-2026:39494 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: XFS data corruption using reflink () Bug Fix(es) and Enhancement(s): * [Exploits (KEV)] kernel: XFS data corruption using reflink [almalinux-10.2.z] (JIRA:AlmaLinux-193945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-perf-6.12.0-211.34.1.el10_2.s390x.rpm 0057f5bbb50e7415d950ef94e98425a16a4f96bd34e5093b3797f15c95404a70 kernel-headers-6.12.0-211.34.1.el10_2.s390x.rpm 0275d7a09f25346cb64af22e5cc8a2e99a9944a5ed68b841acf94f98f8419472 kernel-debug-devel-matched-6.12.0-211.34.1.el10_2.s390x.rpm 13877dc083c10a75e7bf9a3f91746f4478b90f694f9c3998f7e02b442fe66a9e kernel-zfcpdump-devel-matched-6.12.0-211.34.1.el10_2.s390x.rpm 3898cef50bc18f2b09193dc39912e9fae28bd3dc6ff406ae4578d34b3510b135 kernel-devel-6.12.0-211.34.1.el10_2.s390x.rpm 6e0b3007cb4bc5dd30442bd365127a27594f379fefef0b6fed43a8b07549850a kernel-debug-devel-6.12.0-211.34.1.el10_2.s390x.rpm 7c4aa653e724875ae99b97777a0eff9d619dc5b0197d46b5d7c589967c2bafb6 kernel-devel-matched-6.12.0-211.34.1.el10_2.s390x.rpm 879e71851a80f6ed4dc8f4efb6d43b8c09e894414ff82521c463e4caa4cef7d4 perf-6.12.0-211.34.1.el10_2.s390x.rpm c582a8ece379ad018352fa54089ceb6b459604d891b30805d8f6ed44fee383ef kernel-zfcpdump-devel-6.12.0-211.34.1.el10_2.s390x.rpm d0e71ebc94c41d1a6d23116e29651ed502b228fd41629453402d1c05cef81eb7 rtla-6.12.0-211.34.1.el10_2.s390x.rpm d3ae0342046d5017be9dc99063af1386aa54c191ed724641c4690644b3ed5123 rv-6.12.0-211.34.1.el10_2.s390x.rpm ea6ae7ed7ae81fb9d52ba23ab75636c06ddb80796e20e3ad2eb89685caa42fcd kernel-doc-6.12.0-211.34.1.el10_2.noarch.rpm f70c0c028135ad9c40726ef7b16d8d2b3251fe80614da1fb1532d5c0d7eb97a4 ALSA-2026:39547 Copyright 2026 AlmaLinux OS 0 1 Important

perl-XML-LibXML security update

This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fix(es): * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-XML-LibXML-2.0210-4.el10_2.1.s390x.rpm 3c4b6fdad76897126e723f0303209eb8fc9481c1f8b078c31c4031c85157516a ALSA-2026:39573 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.s390x.rpm 65291382513926d418018ec20acb841bc3fbc899ebf874da9ccd4de12630656b ALSA-2026:39976 Copyright 2026 AlmaLinux OS 0 1 Important

hplip security update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * HPLIP: Incomplete Fix for CVE-2026-8631 (CVE-2026-14544) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default hplip-3.23.12-10.el10_2.5.s390x.rpm 557d61a7e86ff850fc775811b3d6d667950d4bdab28b27ddcbe56d1f07e69b55 hplip-libs-3.23.12-10.el10_2.5.s390x.rpm 91154c43be954f4e8374a945dcbcaaa438203165967f27d0a33376eb13201b89 libsane-hpaio-3.23.12-10.el10_2.5.s390x.rpm b992251981b9854c0258326059982adbcfcae2a4c5d89148aa331225c586b0af hplip-common-3.23.12-10.el10_2.5.s390x.rpm c954f4bb0f964accdb04b78e1ac07a56dce474c3f6c0158b2fe146d2b3718707 ALSA-2026:40833 Copyright 2026 AlmaLinux OS 0 1 Important

pacemaker security update

The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures. Security Fix(es): * pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default pacemaker-schemas-3.0.1-5.el10_2.1.noarch.rpm 6e3da70c121af183095ce7a58c2b0a382194143758f71b5c897c62fa60a07c53 pacemaker-libs-3.0.1-5.el10_2.1.s390x.rpm 70dbd6ae899daba4b51da53d517192879395bb57f9b8914ad702c50194905af0 pacemaker-cluster-libs-3.0.1-5.el10_2.1.s390x.rpm 95bea77b0506b411cc0f7d0a20418617c61ee115578f9d7f2ad4804549573a5b ALSA-2026:40856 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3.14-devel-3.14.5-1.el10_2.1.s390x.rpm 2ec26f176d0846e68568886577e210be40e82330c5ad387701419b5d9933b757 python3.14-libs-3.14.5-1.el10_2.1.s390x.rpm 6aa97a14f2de6230db2a8fa47171e2ffd485693cead199b770ec7fc26ce4b06b python3.14-3.14.5-1.el10_2.1.s390x.rpm 9b08ee470d651d0cf618fa49c802e5dcc9aedfece5665ce69a6a9f4c8257f5d4 python3.14-tkinter-3.14.5-1.el10_2.1.s390x.rpm dd3e5935a6f21b9f741bd741eaeea9726f2e7a230aa3912a08f3eea4c6486b6d ALSA-2026:41892 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security, bug fix, and enhancement update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355) * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) Bug Fix(es) and Enhancement(s): * Reintroduce the `tiffcp -i` option (JIRA:AlmaLinux-185328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libtiff-4.6.0-8.el10_2.4.s390x.rpm 1bbb5bb4f478985d3be01036667a6a17eea589036faae9c52e707dc75dc6b5b4 libtiff-devel-4.6.0-8.el10_2.4.s390x.rpm 35931a423c872e10add819d542fe94baa21f8bc0983754a64835dd46825fa499 ALSA-2026:41893 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-10.2.z] (JIRA:AlmaLinux-192468) * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-targeting-pack-8.0-8.0.29-1.el10_2.s390x.rpm 06b8791c9ae676909c8ddba024509cbf8cb3cd0016c6006094ff2de1eed54d7c dotnet-runtime-8.0-8.0.29-1.el10_2.s390x.rpm 596b5b009ff88e61490b64d4ef1600dd5114742bd06324a6c9ab8b98d037d4f2 aspnetcore-runtime-dbg-8.0-8.0.29-1.el10_2.s390x.rpm 685d1bb1326b0ef9866d858cf55130f79e0569b68c252bf5276931ea8eb4a9cd dotnet-hostfxr-8.0-8.0.29-1.el10_2.s390x.rpm 7059c8ec5773f2b0332c5db59ec8a74bbad37994594fc2fc19ff126810d063cc aspnetcore-targeting-pack-8.0-8.0.29-1.el10_2.s390x.rpm 7af435b8091dc1e245fe815d4fb08c8621ac45fd1c1c0c89b9d6c0083abc7fb7 dotnet-sdk-8.0-8.0.129-1.el10_2.s390x.rpm 84e0eab97b231cd12c27dab0ad55e9931c2210521b59037e70d6732083da4b23 dotnet-templates-8.0-8.0.129-1.el10_2.s390x.rpm 8ee7290005ad3cd7e2e05bb5282f4e388c55cade2347e8eb974eedad9ead9a6b aspnetcore-runtime-8.0-8.0.29-1.el10_2.s390x.rpm a1d618a5819a7045bbe38e607741545479843eac42d646656c220180eeee5977 dotnet-runtime-dbg-8.0-8.0.29-1.el10_2.s390x.rpm a630434f06e6c679045eb633e7a71883688e1cd595ba1d7ce1bc1bdd0b0189fc dotnet-apphost-pack-8.0-8.0.29-1.el10_2.s390x.rpm e250f787b86d5d8fad52cf5c98b79348308c1caf9e5df8318b32d81e96ba7540 dotnet-sdk-dbg-8.0-8.0.129-1.el10_2.s390x.rpm ff712b329e472cf5fdc713baf20320e7f8867a9729a2637c01e702c6ec323096 ALSA-2026:41895 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-runtime-9.0-9.0.18-1.el10_2.s390x.rpm 09b3daf256f0789c6d0f05e87d772ed6829c8e9fb60e46d0b6c4d1072aaa76cc aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.s390x.rpm 36727f8455e62b7ca5162844f3f750971b8f44e459ce5ed635703078c836522c aspnetcore-runtime-9.0-9.0.18-1.el10_2.s390x.rpm 4f2e49f43c42ba26ff9e6723799efd03ec56d7daae688833574ff893a71d4425 dotnet-targeting-pack-9.0-9.0.18-1.el10_2.s390x.rpm 5b3b9ab3d5de5050e68e8b090ed29b9b3e17eaae03b6249fb47e5b1b949b5830 dotnet-hostfxr-9.0-9.0.18-1.el10_2.s390x.rpm 698bad12f036cc123c7b3d4ebb79c0df15022f0c8e2ed552b1df6aa6e95bc0c8 aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.s390x.rpm 8906fa39b8b82647df6170a60d67d7647d031488530bde05f9ea3cf4c714831b dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.s390x.rpm 93b1102c57aae6f8f85792f528b290b44b54c2002f32c984281db5375f293483 dotnet-apphost-pack-9.0-9.0.18-1.el10_2.s390x.rpm 9ed6dfa1198cdda3ceb61dc3eab58ebc752bca3551ea11b5c857b6f161e11b17 dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.s390x.rpm b5c7af3b9b03f5824a500d29f91063ee5e9198376dc9b9810c5d3312dc93a705 dotnet-templates-9.0-9.0.119-1.el10_2.s390x.rpm c8bf8f69196bdc8bc53155c0fb75c3f395fe039d406ed35f543519094e4c050d netstandard-targeting-pack-2.1-9.0.119-1.el10_2.s390x.rpm db0902653fceffa126a432b4ef350d830233cad7e404dbb366e39e541476e6f0 dotnet-sdk-9.0-9.0.119-1.el10_2.s390x.rpm f53ed675d59dfb50ee88e43564242b52bdb2157d82254f2ceb35ef2526307df8 ALSA-2026:41897 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-10.2.z] (JIRA:AlmaLinux-192463) * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192326) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default aspnetcore-targeting-pack-10.0-10.0.10-1.el10_2.s390x.rpm 14c1e15abe4130b97f8a4cf011f1b899e80426185a0d0baaa5de8918e761d4da dotnet-host-10.0.10-1.el10_2.s390x.rpm 2edf22b83ff9c8e310106a8964c744100892bebca77e8ebded39e04cbcee936d dotnet-templates-10.0-10.0.110-1.el10_2.s390x.rpm 328de186c57383ff33b4592d90c18012098f097c3ba1db58fe6b2207e55134ac dotnet-runtime-10.0-10.0.10-1.el10_2.s390x.rpm 57f7e0724eaa79526ed580af84143847e5d815123e7e469556bcb398d3caa462 dotnet-apphost-pack-10.0-10.0.10-1.el10_2.s390x.rpm 5810bd5caf7d50ec959965fd1e74e7a7f7dcbaaf13b4a955f47c634ae009c064 aspnetcore-runtime-dbg-10.0-10.0.10-1.el10_2.s390x.rpm 5a2d55b0fb4e1745df29b9739ac85a57722b17baa4bfddd864f1819d29e1a183 dotnet-targeting-pack-10.0-10.0.10-1.el10_2.s390x.rpm 7b5fde50e9962058a52a0536ded09d8a48fec0cab6afb8fa44b4c99f4b70719e aspnetcore-runtime-10.0-10.0.10-1.el10_2.s390x.rpm 9ef5751991443f2a66a8e201f4c4d8ef2fffc9d8e05a2fdfac8c82cca5cb66c4 dotnet-runtime-dbg-10.0-10.0.10-1.el10_2.s390x.rpm a0f77d778f3912c016b8f6780870c72468f3b490816bab86661262d2e16cc598 dotnet-sdk-dbg-10.0-10.0.110-1.el10_2.s390x.rpm c8f6dd811a4f6fd0c5bee92c917af76ee38de2ba9611caac13e54fc9ce3c4ea0 dotnet-hostfxr-10.0-10.0.10-1.el10_2.s390x.rpm df0365432b42bab662e5671e6c95728e6abc5bb95b0268453a52b0cde3503a5b dotnet-sdk-10.0-10.0.110-1.el10_2.s390x.rpm e36d29ab50c5001f6d62526deff991504c54e99801591a01957939e32991b7fd ALSA-2026:41937 Copyright 2026 AlmaLinux OS 0 1 Important

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) * sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default sssd-idp-2.12.0-3.el10_2.1.s390x.rpm 6a26d0ad55c508936f8577e0997f17c6462ce4f5f30c0a72439a583ffbb11b7d ALSA-2026:41988 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dovecot-mysql-2.3.21-19.el10_2.1.s390x.rpm 041ff952f1d5a37e0d613661a830731e9006d2a118def53eef37edaa9545a3bd dovecot-pgsql-2.3.21-19.el10_2.1.s390x.rpm 1120234b76200e8201dbdef3cc68825c2a15be48e304dc81bc3b538492fc7a07 dovecot-2.3.21-19.el10_2.1.s390x.rpm 974ea14fcefebf150d1e64d28f2118f4a6060bc6b8ab2011e4232dd0c464da7d dovecot-pigeonhole-2.3.21-19.el10_2.1.s390x.rpm af45812115eac7c02af1f5ca71eff4e66b2a43efc3dd0f754d45c1618a4a2a2b ALSA-2026:42063 Copyright 2026 AlmaLinux OS 0 1 Important

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glib2-devel-2.80.4-12.el10_2.14.s390x.rpm f842332f2d945f48251e6b061803c4f5c2b2b371e7f0ac7247b5cd80edd41533 glib2-tests-2.80.4-12.el10_2.14.s390x.rpm fd6675aa53735a217c67d94b763fa83d8345355541985882d4d90bf6ece9b29d ALSA-2026:42096 Copyright 2026 AlmaLinux OS 0 1 Important

c-ares security update

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default c-ares-devel-1.34.6-2.el10_2.s390x.rpm 5f458156a23bfa2a416bea72989e9b9467769d0e3d89a8a72d01ab2b524fed08 ALSA-2026:42694 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928) * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435) * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glibc-utils-2.39-128.el10_2.alma.1.s390x.rpm 43842de1de421354a5c14768de3de97163f0cb3ed4005511b108ee7c0a1586ad glibc-locale-source-2.39-128.el10_2.alma.1.s390x.rpm a2e09cc4f831b088790f4c077081ad099285cc1e5595ab9aa54b40227a4d7337 glibc-devel-2.39-128.el10_2.alma.1.s390x.rpm bc83c7e95e84e169324d0565428518c18cb767876ef574b20ec48e6f0fa2df97 glibc-doc-2.39-128.el10_2.alma.1.noarch.rpm ec6e77a457ba7f13faf9ac4994f0f83f6fa55864f6690c7cb0495903d28a82f2 ALSA-2026:42739 Copyright 2026 AlmaLinux OS 0 1 Important

acl security update

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fix(es): * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libacl-devel-2.4.0-1.el10_2.s390x.rpm d6cc2fe51f6dcda5a5588504f95ae655eeeb214eb4671f891073c38b56a08d76 ALSA-2026:42895 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default java-21-openjdk-src-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm 0454fbf7bcf1811f9745139e9fde5d1fcfdf6eb45598d17db4f159b8e06836e9 java-21-openjdk-headless-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm 0e00a5a5122586012d1702480220e8a5c5cb5908af81d3d457b75da99e814a59 java-21-openjdk-static-libs-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm 19ca46d1ededfcfc691f598c3ec3ed257b9a943f089bf149af9fa8fbdbf41069 java-21-openjdk-javadoc-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm 3db4c960657e8665e8492c08da703d40bcb02da22a20a84ab400583392959d0a java-21-openjdk-jmods-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm 44309b78451f1d1d69943083a10c8a6f1a1077b252bb8a14a201faff62cc5926 java-21-openjdk-devel-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm 6e2e4aba6820431d8671d57d20d3c966281b18c36d2a12bdbbe624ea28d3b96a java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm 9311982b0cedf63fb621e1419582d9f5b7c3dc860bf5a9d848e2d12a193d46cb java-21-openjdk-demo-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm be37ae499f7559dd2ad31f2d403674f38ef665c3969cff4ff765c23f9a9b7c35 java-21-openjdk-javadoc-zip-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm c2b660432c6c6f9692332d81995aff4db04ea0934ae7d7081d928b8d17be3871 ALSA-2026:42899 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048) Bug Fix(es): * The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052) * On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default java-25-openjdk-static-libs-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm 0ef06bc86262c5091cddd69a05768fddc7a6e92f38463ca21bd6b11ea74f0d9e java-25-openjdk-javadoc-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm 1307aa8cdb9bdc85477ea7b697edf2612a4f35106613508fd06de70e5b80c0db java-25-openjdk-crypto-adapter-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm 1535302aae7162f940981a18f0fc92fdb589acf7ce760186f7b27eddfe5ad658 java-25-openjdk-jmods-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm 3ec7758279aa6c0157400969b030edb2f93a6014822935a60afb49ff2e8d48ba java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm 4312830b6838d2cc16c675a3f8791a4d6f9718d134dc2547c3a5825cab6f7875 java-25-openjdk-devel-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm 96ec3ba1489ca1eec045c2cda4956d20491d185c1ff491f43be2619dc896dc95 java-25-openjdk-src-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm b06009d22d9974d9a5ade5c68cf7fe50a92003a1b7c85e6358f122bcd1d78dc4 java-25-openjdk-javadoc-zip-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm d028415111ab331bae7cd591bf5748630e48e031cba0f2c15146ec67a90c76e7 java-25-openjdk-demo-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm e2d6087876b8bf3895c6eeec8b4c4c98307fa52de7d23a29cf1a4d7d95b9475b java-25-openjdk-headless-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm ea4cab2d09e05486acb1e81c053eb2d5d2280341cdfbfa34bc7fa868fc203ae0 ALSA-2026:42919 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168) * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950) * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: can: bcm: thrtimer use-after-free during RX operation teardown () Bug Fix(es) and Enhancement(s): * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:AlmaLinux-173103) * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975) * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [almalinux-10.2.z] (JIRA:AlmaLinux-186311) * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-zfcpdump-devel-6.12.0-211.37.1.el10_2.s390x.rpm 0057e4b1b8b58335f5342363d903f21346eede929458f09eff91c73338822824 kernel-devel-6.12.0-211.37.1.el10_2.s390x.rpm 12d7ced73be78f5b1b660a233ce6a2a053ce6d9716b835984a79c111df133b16 kernel-devel-matched-6.12.0-211.37.1.el10_2.s390x.rpm 210522a29bb00ac4f59e287d2485218eee125874c690ce5466ad4dee564fd036 python3-perf-6.12.0-211.37.1.el10_2.s390x.rpm 286b81c946124e1af8f52525280d9bf157e2e3025dc83f11ae94f6e8aca4581d kernel-debug-devel-6.12.0-211.37.1.el10_2.s390x.rpm 37c9c93756956ba43539ef333b07e7be8c5cfecc13e7de11319138122b6ea300 perf-6.12.0-211.37.1.el10_2.s390x.rpm 58a3b831878f6cb606f7155bf82e0f4ea6129a079bd20bc94b16dfdb4d84c8aa kernel-doc-6.12.0-211.37.1.el10_2.noarch.rpm 87d31242d05551914e981aae0b0f4d898f16e6999a0326758830d5c4a4582d3f rtla-6.12.0-211.37.1.el10_2.s390x.rpm 97cc33e312ede04c3dde5a32fe3ba9071f63a4664391ec83a2cc06c79d7a8252 kernel-zfcpdump-devel-matched-6.12.0-211.37.1.el10_2.s390x.rpm a6edf8a786d985e87ca700235af8819f7652682b379d55400683740ea34f7db7 kernel-headers-6.12.0-211.37.1.el10_2.s390x.rpm c3b6acccb9f69d88bbd8a292e769c6c19cf2cd5fdf0c5e78c697072632180f80 rv-6.12.0-211.37.1.el10_2.s390x.rpm fae0097569bdf75f4aeb5d2b95fff00f6b4eb8d3f6057f6ce38ead5b8f6eaafd kernel-debug-devel-matched-6.12.0-211.37.1.el10_2.s390x.rpm ffd01aa21c2bff059ed3b686fa49b2ca283d721586ff72e312672180a0d4e258 ALSA-2026:43400 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default idm-pki-kra-11.9.0-4.el10_2.alma.1.noarch.rpm 0969cdaf908804a41b9168709166a69e8aa7ae8fcc2e747357080f04a1172f5e idm-pki-ca-11.9.0-4.el10_2.alma.1.noarch.rpm 0b735f0dd0d261caa3582e67de71f6261dbab4015274cff710fc04879b00b9e9 idm-pki-java-11.9.0-4.el10_2.alma.1.noarch.rpm 19db97d8c3e96b064b9b644b115703383e1a284592656856fb4c10b17f0ff783 idm-pki-base-11.9.0-4.el10_2.alma.1.noarch.rpm 2078148c1821766f42e07686376b4f47372e0d8d1f28117d64c14ecfa9c35ec2 idm-pki-tools-11.9.0-4.el10_2.alma.1.s390x.rpm 5598e33720c2e43211a9ccd5c29e14f32532b882fad28d179ace9aec1c05baa2 idm-pki-acme-11.9.0-4.el10_2.alma.1.noarch.rpm 65f47e5c5837435369b77d7a6e0414cfd4e2ab76ac728e69b36043659fdf4ae8 python3-idm-pki-11.9.0-4.el10_2.alma.1.noarch.rpm 6e8938d303bc048889247d06f240b4f4e4629de2d3a8d8d05230791ef281e8a6 idm-pki-server-11.9.0-4.el10_2.alma.1.noarch.rpm b82532ebd593f44ece5bc792082777393864e54da71878f86dc5d3f9abd9a78a ALSA-2026:43505 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb-connector-c security update

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fix(es): * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mariadb-connector-c-devel-3.4.4-2.el10_2.s390x.rpm aa0c089f1dafae275b339ada6aeed345af91a78768159d8a4b19d264aec173cf ALSA-2026:44270 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rtla-6.12.0-211.38.1.el10_2.s390x.rpm 4070feac36816ae5bbea17e2edc81045e0e56aca4cc251a14fae28777cd129a9 kernel-doc-6.12.0-211.38.1.el10_2.noarch.rpm 4a069b5675e58961c90a55b7563fc8b4cdfeb44341f929a948dd293d00bbc4cb kernel-debug-devel-matched-6.12.0-211.38.1.el10_2.s390x.rpm 4d9cb968a11489cded5bce90a12c000541b06f6ac7dec04f59ab8ec2904ee774 kernel-debug-devel-6.12.0-211.38.1.el10_2.s390x.rpm 51653332e15cd6b8fe4cd46794c0adf79efaeec18eebb3c5a77c034909ea2dda kernel-devel-6.12.0-211.38.1.el10_2.s390x.rpm 741258a944581bd9d497aa4e09a856b127f6f81a041e501d88c6dca74ee373dd kernel-zfcpdump-devel-6.12.0-211.38.1.el10_2.s390x.rpm 8eee8825b1c31611fea75b23af8ee3f4e5a14f3553a86b1d972dea0a543d9848 kernel-zfcpdump-devel-matched-6.12.0-211.38.1.el10_2.s390x.rpm 9a2c5040119e3fe351eb27839bb0f3ed0154dc6f4316c850e87efed1d8503122 rv-6.12.0-211.38.1.el10_2.s390x.rpm aa4a91de220b7c9761ca2c2985f4b801611bb43108a8ee9904f1870624663d44 python3-perf-6.12.0-211.38.1.el10_2.s390x.rpm aa55eb212912c7bc24135cbd117da97586a1ce7e58a9691c961345506bdad222 perf-6.12.0-211.38.1.el10_2.s390x.rpm b32a79b0a3b8989d5b2bfc68f2fd37955d9b7be9873cbbc933e70cafbc27e77a kernel-devel-matched-6.12.0-211.38.1.el10_2.s390x.rpm d219b79f64f4d39675b69a0fa255872fa2a053c0dffbe2bb9e996e9eac08f0f4 kernel-headers-6.12.0-211.38.1.el10_2.s390x.rpm eb4a66edbbbdca1e26da075a0e30a887e5bd89053f0af6635e886062f661d5e1 ALSA-2026:44391 Copyright 2026 AlmaLinux OS 0 1 Important

libpq security update

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libpq-devel-16.14-1.el10_2.s390x.rpm 5b1cc2f22231878e5aac21962087e3eed195d805de26be617a3c5293ce887a20 ALSA-2026:45114 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973) * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-devel-6.12.0-211.39.1.el10_2.s390x.rpm 024f2abd23a88861815ab16cb1b059aeb7859d56b0d761defc19327f6614d538 kernel-zfcpdump-devel-6.12.0-211.39.1.el10_2.s390x.rpm 1853e9b0e1aaa44583c88562388b81c26bef011dfffec24ae6c10e0e67ef69ce kernel-devel-matched-6.12.0-211.39.1.el10_2.s390x.rpm 32a7b8892e6de2431a85a41915ff7a207f7d779dc69cb6312e3c08eaa02399fc kernel-headers-6.12.0-211.39.1.el10_2.s390x.rpm 67fe2c81d9a75cd7713178bb0082298d9722cfaf9fce96645f53250afc6d841a python3-perf-6.12.0-211.39.1.el10_2.s390x.rpm 6a49abd0d30e1f465ed0768fdb2adccdc962ec89c14830f931b1f6eb47bd2a0c perf-6.12.0-211.39.1.el10_2.s390x.rpm 919730e56f4f7857dbf9ed8535ce778d40096e50f7269ffdbb37190c8e1a71f5 rv-6.12.0-211.39.1.el10_2.s390x.rpm 9793dd02a5343fd42cd8ff7bace0c89b00f52ba35dbd04640df50248fe2b57f3 rtla-6.12.0-211.39.1.el10_2.s390x.rpm 99260e5e174ee665a96fe456167bba2747f6025743151746e691a4dd55667866 kernel-debug-devel-matched-6.12.0-211.39.1.el10_2.s390x.rpm 9ba5ceece057197ba3848f361cca5cada79cff3bdae789c71edc34519b2f86b1 kernel-debug-devel-6.12.0-211.39.1.el10_2.s390x.rpm b0da177333d0ab9abeac86aa2e912322889ed057bddfdf79602e17ac1aefba4f kernel-doc-6.12.0-211.39.1.el10_2.noarch.rpm bed818f0799b768ff6cfc2f657938405ca4fdd836ecda0511057e50c36a60fb4 kernel-zfcpdump-devel-matched-6.12.0-211.39.1.el10_2.s390x.rpm dd4e403fdb6bc04d53b1de43a5b5c70b5ce800ea25d588c8e286cfb989f62c42 ALSA-2026:46395 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default go-fdo-server-owner-1.0.1-2.el10_2.3.noarch.rpm 8a1f12fb60dd6f709e8d044b6d020d14de7e6afbde8dda5848544a5e669cff85 go-fdo-server-rendezvous-1.0.1-2.el10_2.3.noarch.rpm caf1db0da6a4940dc368733c9e45509fe9a782dd4331421e6ca8bcf1a5779321 go-fdo-server-manufacturer-1.0.1-2.el10_2.3.noarch.rpm cb7c2a74215550a5f2ce3d4355be09b754b0e502285caecb7e0f536ef2a0011f ALSA-2026:46398 Copyright 2026 AlmaLinux OS 0 1 Important

libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721) * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722) * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413) * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libreswan-5.3.2-1.el10_2.s390x.rpm 7378a6277f4c14a6ea70b1876b6d5c46badabddb9358ef6d261734db113eb89b libreswan-minimal-5.3.2-1.el10_2.s390x.rpm e2edb37595ea0ce9ad362d34d08bc3a3da1efa9bd1efe4841320ba9ab411cec1 ALSA-2026:47017 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281) Bug Fix(es) and Enhancement(s): * rxrpc: Address CVE-2026-43500 [almalinux-10.2.z] (JIRA:AlmaLinux-178254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.40.1.el10_2.s390x.rpm 093d1d788b3bfbd6823149b26267ef0ddaa613db933e072f4b8984768db2ece6 python3-perf-6.12.0-211.40.1.el10_2.s390x.rpm 10f0590a7e14838e5105320f68aef326e7c9c424404ca797845e6b42e13a7347 rv-6.12.0-211.40.1.el10_2.s390x.rpm 1ca8b39617772c18e8407c93209404ff5116d2bb13b690ae79bc5c8bfb3c1402 kernel-doc-6.12.0-211.40.1.el10_2.noarch.rpm 3f33284f7c4ea3f56149f8190f4db9d0acabacfef1186c7aa7ad46d25395aa49 rtla-6.12.0-211.40.1.el10_2.s390x.rpm 4581687864bb534fce673b2ded8d1eab95db423e212fbf702a6eeee3f62d45a4 kernel-zfcpdump-devel-6.12.0-211.40.1.el10_2.s390x.rpm 8d27c19f5a80eda863dfc4d893300d79686b1dfde451287fdd943eb43d7ee7b2 kernel-zfcpdump-devel-matched-6.12.0-211.40.1.el10_2.s390x.rpm 9fc46826492b4bbfb29c530ada448d431562dafbfb873a3b8ced545955db4397 kernel-devel-6.12.0-211.40.1.el10_2.s390x.rpm aa2495b72b52affbe1b2e35a9307518d10ff012df449ccc13ba14d729db262cf perf-6.12.0-211.40.1.el10_2.s390x.rpm cae53c642509bcb3d40336a5ca7cff25763ce9bcf8441e756342ae03a987f901 kernel-devel-matched-6.12.0-211.40.1.el10_2.s390x.rpm d650ed322131c57e50d9b94ce16638c534db3cbcbf2305232d4dcac899f41a8f kernel-debug-devel-matched-6.12.0-211.40.1.el10_2.s390x.rpm f0d356e7204c789e0c14c184bd44e9086a04929c506950f22e98c9941c1f8c2c kernel-headers-6.12.0-211.40.1.el10_2.s390x.rpm fb942f5e3a7f2e5d31ddb315f087869a907927ca5f8eb937f90d4b4c13d1904c ALSA-2026:47079 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libXfont2-2.0.6-5.el10_2.1.s390x.rpm ae99d5b9ed38179a85dfc8d38d79087219d15a59e850c2a83ba160cea35d3cb2 ALSA-2026:47083 Copyright 2026 AlmaLinux OS 0 1 Important

pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading (CVE-2026-5674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default pipewire-gstreamer-1.4.11-1.el10_2.s390x.rpm 0cf070e99beecc4b9b34a5befd6b5bd157af404257541750a073bc65887e0840 pipewire-libs-1.4.11-1.el10_2.s390x.rpm 4d7d37dc77224ab32d4e5f0fc599f5067b79926b78452e77ecc6bd3454cbe28d pipewire-module-x11-1.4.11-1.el10_2.s390x.rpm 5ffb402a42417f9e4aeca2fc2077ebad94ed74555bc2968d1764e55eff8e3e36 pipewire-alsa-1.4.11-1.el10_2.s390x.rpm 7c1a8a17564eae1b1a092d3fb9f5745efda47fe1a6337026acca0fcb35c1c4fc pipewire-jack-audio-connection-kit-devel-1.4.11-1.el10_2.s390x.rpm 8b5f38e1228d8a2bbc4e91934edb9cdf50ad8e8e2e794b508b1ea6fa3e77d8f0 pipewire-jack-audio-connection-kit-1.4.11-1.el10_2.s390x.rpm 966ea246f21314f19afc21289dff1a194f3a89e2154cbb85f42bc035970d0321 pipewire-devel-1.4.11-1.el10_2.s390x.rpm d21b99532ea92b645d5ec92df6edb1cca6b23390d933c1f1603cd8709fe0fb83 pipewire-1.4.11-1.el10_2.s390x.rpm d4210cc3add55ef468e5583a7ac97029b2723c2bd5597a67e1ed706caa20b5a8 pipewire-pulseaudio-1.4.11-1.el10_2.s390x.rpm e45859d766e53d112a0a434bfe4c1d76c1d0453c2e1a176a01b60fd2d99337ef pipewire-jack-audio-connection-kit-libs-1.4.11-1.el10_2.s390x.rpm ed23acca4209aa282b4cd4db93a740ab7c197d9e8a78b24283ea8e7da49aed37 ALSA-2026:47085 Copyright 2026 AlmaLinux OS 0 1 Important

rest security update

The rest packages provide a library for access to the RESTful web services. Security Fix(es): * librest: weak random number generation in PKCE implementation (CVE-2026-16615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rest-0.9.1-11.el10_2.1.s390x.rpm e82c52f8a8df8e15aa9896b20f64cc35d9a5cb1ff73823dd81263619371df265 ALSA-2026:47101 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default firefox-140.13.0-1.el10_2.s390x.rpm 8e2d40509b0ca099e8194ce27205f50c26f3b54d9c92fd60109124df2b3404fd ALSA-2026:47180 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer (CVE-2026-59691) * gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback (CVE-2026-59692) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.6.s390x.rpm 69205fd96f8621ddd5b3653abfbbb81913efac355662117132cfa2b54767dff7 gstreamer1-plugins-bad-free-1.26.7-2.el10_2.6.s390x.rpm f0e0181fb509cb9917b782a21cbf79baa598e3fd38076a02653856f5f335ada7 ALSA-2026:47757 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenSSH client versions (CVE-2026-55655) * openssh: Double free in AlmaLinux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653) * openssh: Heap out-of-bounds read in AlmaLinux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654) * openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002) * openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy (CVE-2026-59996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssh-askpass-9.9p1-25.el10_2.alma.1.s390x.rpm 0a51eac47238ecd01951fd1ca1303fe8c7d4765dce65a0650a1f8089de36e9df openssh-keysign-9.9p1-25.el10_2.alma.1.s390x.rpm 6f98e7f21b7c51e88a7c289f22157a6e7535254ba4dce88c0d013622dc46aba6 ALSA-2026:48032 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm bbd3e0be33345b40f7140ed617b9d6ac035fa7d714eef964005b4f634524f37c ALSA-2026:48033 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs-22.23.1-4.el10_2.s390x.rpm 1e0355965f5a90998ad7565363a40d0e315e84930fd6cb9f6942e43a38f86fd2 nodejs-docs-22.23.1-4.el10_2.noarch.rpm 4a83c12224f35412b6625e9741ade14adf2898f3deb3cc76c129e06984205bf2 nodejs-npm-10.9.8-1.22.23.1.4.el10_2.s390x.rpm 7a66fa83c8259e46dfe28706a1ab95db59730f0597f4c831c7d93d69cfd78ce5 nodejs-devel-22.23.1-4.el10_2.s390x.rpm 7c8e28efc5e7970978a05e0464498b312dd778378042c976d86dc78ba148d660 nodejs-full-i18n-22.23.1-4.el10_2.s390x.rpm b5be071eb10586b120d78d6bc4beb0b693c49549e18b4df54ddad2e2c0e66522 nodejs-libs-22.23.1-4.el10_2.s390x.rpm b7c786287bad4c41be7824f91239f41c9a8827db41167ef9f8dea62f39adb425 ALSA-2026:48034 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs24-libs-24.18.0-3.el10_2.s390x.rpm 75b1148b3271c2c1c2b99d9772f57d2644d08f58a3cd2d05b98319a302126b10 nodejs24-docs-24.18.0-3.el10_2.noarch.rpm 89066bd3e4a424f6060b375e6c02c05394b0753a9457c3f2bea0b8ca3a7ef097 nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm a0d67f6698a66c5d36c8a723a620bfc3e7512941af628d160a75f70e47142745 nodejs24-full-i18n-24.18.0-3.el10_2.s390x.rpm b991dc453b6c08c82225a5a28339f39b3388ef56ca265c84cd037332f7dac5be nodejs24-devel-24.18.0-3.el10_2.s390x.rpm ce9e783026e4bca3ec688ac8ff12f3d8751f106f2464d437be74c5165b0f1dc5 nodejs24-24.18.0-3.el10_2.s390x.rpm d9651575ab18527d75709901d25406a5803b16a5276bfcf6692a11dff82ee82a ALSA-2026:48170 Copyright 2026 AlmaLinux OS 0 1 Low

php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default php-odbc-8.3.32-1.el10_2.s390x.rpm 0ea6ad3c27047b86b1dddac44a9ee027d46a057ed9cf2fda6b61d1cd9962193b php-dba-8.3.32-1.el10_2.s390x.rpm 105624feb823d4f5eb3130c947cf8a0b9f29de835327061b179ab4a901506b41 php-ffi-8.3.32-1.el10_2.s390x.rpm 24e32c6a39a691c55f375cee8c850f30b4cb7788b2e218561126d6efd62067fa php-gd-8.3.32-1.el10_2.s390x.rpm 25e788f6025e191e1d42b84a0052884cca0c0774200d03efb273046af3694c07 php-mysqlnd-8.3.32-1.el10_2.s390x.rpm 3519f5618b5064c428d320caacd510066a27267c2f3c2549d63370a808685585 php-snmp-8.3.32-1.el10_2.s390x.rpm 52fad0962deef79f0c3c25e54467b16352e3f45cb87a57c32db6e2d3329bc8d2 php-enchant-8.3.32-1.el10_2.s390x.rpm 57ab56b75393c51c72b2f3a73dc128b6f10c8857e69abe8f9dac9deb647d855a php-gmp-8.3.32-1.el10_2.s390x.rpm 58627459ebf493823c1dcfa8db1e276600d3e1360986d23a18de4dce42e8aab6 php-dbg-8.3.32-1.el10_2.s390x.rpm 597a2366bfd621b5fcfdaed355237d438bfefb347dd894d7b28b68bd8aed667b php-bcmath-8.3.32-1.el10_2.s390x.rpm 5ecc2a25515df3f4a093d5decbe0ddac3c6b5180e0a748e0ce415521c2d25e19 php-mbstring-8.3.32-1.el10_2.s390x.rpm 81b24e47bfa8779c732c767a39c43f8c3755e854a27f13404d22d6056c2b3b00 php-common-8.3.32-1.el10_2.s390x.rpm 83c700a89dfc385ff3dc82b50e1fa3dc43933c0e0611d99017b6ad492f4dfbe3 php-opcache-8.3.32-1.el10_2.s390x.rpm 8680ca8786680602602150f81ca84277edb7b8d1f46ef9448b3c86afc0637158 php-pgsql-8.3.32-1.el10_2.s390x.rpm 8bf280c5b3f584a7c0cf547029820e901d927db03ac3a1bb7097e4c8f3595985 php-process-8.3.32-1.el10_2.s390x.rpm aa0188b8cb8c57d5444aade02a777cc77cc163e0d6583a1c43e302fd70e7f539 php-soap-8.3.32-1.el10_2.s390x.rpm ad876517989163b8ce7eec0c9c6f47eeaf0cfc9ca03ffde19dc9fff8224c7d3b php-intl-8.3.32-1.el10_2.s390x.rpm aee8e7aa8deb9303fd2083cfc29adbf1369abaee93e8ee8c0f581af3d92d9cf9 php-cli-8.3.32-1.el10_2.s390x.rpm d769ea36c9afaedcf97ba2b49fe6b149063506084486587628d2e63b289dbddc php-xml-8.3.32-1.el10_2.s390x.rpm e0160471538b97a364ddbcb120e217145037ff32c438a5c8071f7d93e570bb0c php-fpm-8.3.32-1.el10_2.s390x.rpm e4a31d747fffe95e2e64f071fdd5c1148158578d9352ad6b6cd0404d46328945 php-ldap-8.3.32-1.el10_2.s390x.rpm e54cf3f7c3c9769c9f9bf2e6fc792d281b336c25882c3a3fc628f3d5570b14bd php-embedded-8.3.32-1.el10_2.s390x.rpm ed5f180143b355b4f676f82fef5736e7ce565dc3e52470332b88f10ef4a50f13 php-pdo-8.3.32-1.el10_2.s390x.rpm f9a475f962753abb8b734f3ba155ba5324c343ad5dbb06c8e15fa530d487d45e php-devel-8.3.32-1.el10_2.s390x.rpm fe265679882e8f77148cd97f6a92a864dfe34dceb8a6562e6f14f7534f71dade php-8.3.32-1.el10_2.s390x.rpm ff5145e1881ceaacdbc3fc052d56d27f403147e7697d6790594ccd909dee85c3 ALSA-2026:48585 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default fence-agents-scsi-4.16.0-21.el10_2.5.noarch.rpm 02a9562b78a8a24d7e333970efbc532e24161062499846a84fe75f07c16df2e2 fence-agents-cisco-mds-4.16.0-21.el10_2.5.noarch.rpm 0585c3e9f38920e515019f74ebdb69e2987cda9c3fc8f55553b0d5b46a04667e fence-agents-ifmib-4.16.0-21.el10_2.5.noarch.rpm 079ef24bb4d641ff4713ab43de2a354ad8dc7350f764f31380313fb52bb8e396 fence-agents-eaton-snmp-4.16.0-21.el10_2.5.noarch.rpm 089facbd88cf4480c948daef5080d8a4e863f876af741e894953a052c18472f1 fence-agents-apc-snmp-4.16.0-21.el10_2.5.noarch.rpm 0ed42a2237e32de2ee788e8d1ce0205de2e3e3668fe8621b0454862360f4cae9 fence-agents-virsh-4.16.0-21.el10_2.5.noarch.rpm 0fbe596f99db8f892c67c85f7cca46ccd883667a63ee6aa5c0a06fc771d1546a fence-agents-rsa-4.16.0-21.el10_2.5.noarch.rpm 1af89745129e72d3cf10835d0b18dc20f4fbb3c87def696fa64d2677f26078eb fence-agents-rsb-4.16.0-21.el10_2.5.noarch.rpm 205874c6618128431f134d578571738ee9368d524e16f9991bf507a48a1fc4af fence-agents-kubevirt-4.16.0-21.el10_2.5.s390x.rpm 205b290dc9c0ac83740c00a328789c70d6e8c7aaafbdf2989531c7e1ae30cee0 fence-agents-wti-4.16.0-21.el10_2.5.noarch.rpm 2ac50c4183e12154477c90ad233354a1b426ce6ada8318cd9ff1c95783d0a6e9 fence-agents-ilo-moonshot-4.16.0-21.el10_2.5.noarch.rpm 33a6033ef28cbf57fe6ae177ba899bee9efa2586458cfc9f4b17d8816f4852e9 fence-agents-sbd-4.16.0-21.el10_2.5.noarch.rpm 393ba16d2124e745058334be1a9ea19466f1ea2ed79be749f9534c0eb2eae3a0 fence-agents-ilo-ssh-4.16.0-21.el10_2.5.noarch.rpm 3b06b3b6370f1542f6c561b830148802a761f1a54cced27f5b897bc72bbf000c fence-agents-bladecenter-4.16.0-21.el10_2.5.noarch.rpm 43be7813f12ea8487c7144e058efdca667f8ee63e3b8fb3688b1ee768242c4db fence-agents-amt-ws-4.16.0-21.el10_2.5.noarch.rpm 4f4f9455dc2124c09068d3955018c52d59c5e5787e20c74b56664df7585682b8 fence-agents-common-4.16.0-21.el10_2.5.s390x.rpm 4fa3632f0b705796a79d132a1bd903af99b53769a1c277266588a75242aa4f09 fence-agents-brocade-4.16.0-21.el10_2.5.noarch.rpm 512d3a91950b1d4aba9d521f1b1298cb5281a94cc741007163fdefa3ff9c6d6b fence-agents-mpath-4.16.0-21.el10_2.5.noarch.rpm 63316b6226135353f691c6e8611077a5d55c61e96e1bbd2f0feae1ef1156055f fence-agents-eps-4.16.0-21.el10_2.5.noarch.rpm 70805cb3186ce3b83c61dd6a92392e10e2269d97bb12901831a705caa2e13e67 fence-agents-redfish-4.16.0-21.el10_2.5.s390x.rpm 7145cba9d364deddfdcc57f27c1bab306af49e83e759128608105b54b3248152 fence-agents-ibm-powervs-4.16.0-21.el10_2.5.noarch.rpm 769c27a5bdf674e7ae7d3e284ca2ef59c325032952f687138b4de3eb49bbf684 fence-agents-ibmblade-4.16.0-21.el10_2.5.noarch.rpm 7d422de49cf099ef097c46e463774d835a7a6341739f62bf21f362bf0369b424 fence-agents-hpblade-4.16.0-21.el10_2.5.noarch.rpm 89fef3d43f7585019392d0dc5d961f1c4648edbad79329024e184b6e229a1f31 fence-agents-zvm-4.16.0-21.el10_2.5.s390x.rpm 8eb85e6207ef2c27a85619dd0d413a172b2f18cfb594871541272bb027816744 fence-agents-lpar-4.16.0-21.el10_2.5.noarch.rpm 91ae58cf021e245e1a1bf1024c70c1f559915400b560633a3068c117a652dbec fence-agents-cisco-ucs-4.16.0-21.el10_2.5.noarch.rpm 9380d9758dfd4d1453e71e86b6de038363038a4d33fa19c298d368038b30f2cd fence-agents-vmware-soap-4.16.0-21.el10_2.5.noarch.rpm 998f6222b512104dd6ebeef7539b27e306dc5fcfa10ff8331e8975e680821aff fence-agents-heuristics-ping-4.16.0-21.el10_2.5.noarch.rpm 9a5a0dc003e77f5a9ea108f92a622c5d6976e36a844c4b748e069257b31f1021 fence-agents-intelmodular-4.16.0-21.el10_2.5.noarch.rpm af75659dc64c53a891fd4636e3b0602ad519684579d5271ea03c01a7caa278b2 fence-agents-all-4.16.0-21.el10_2.5.s390x.rpm b26efa9c37b1203df8f7ad41971192bda400d565c8692892f21fd1759fc0ed0c fence-agents-emerson-4.16.0-21.el10_2.5.noarch.rpm b3ba20e516f6f7d2812656bf61775f98e42e342544de7b9ed01aa80028d7e454 fence-agents-kdump-4.16.0-21.el10_2.5.s390x.rpm ba2fd6a4cde067cfe4766d2b8a3a297ca5c777857cc901349a3777ccefc9be7f fence-agents-vmware-rest-4.16.0-21.el10_2.5.noarch.rpm bc1b3776aff2e7d3bbe29a17599074c9bf396e5e1b77fe5ab1defede6847358b fence-agents-apc-4.16.0-21.el10_2.5.noarch.rpm bec0c532edc9657fca3d85daa3a0597c46af622904928c2339a37f0adf7ed7ce fence-agents-nutanix-ahv-4.16.0-21.el10_2.5.noarch.rpm c009350e071848c015df98437c80cab01c9ca98f0801415e0e5a445ee998c502 fence-agents-rhevm-4.16.0-21.el10_2.5.noarch.rpm c41641cbe4507b116bd310318f52a3d80536a50089c6df7dca2a11a7a759457c fence-agents-drac5-4.16.0-21.el10_2.5.noarch.rpm c72dc94ebe3471be09580a457d1e65fd832107047626548b5bfb15a04b9060dc fence-agents-ipmilan-4.16.0-21.el10_2.5.noarch.rpm cc3c20cef2b889d5204bd8db41430e7e4147d375fba2c598f1d7f4ae9a00fd26 fence-agents-ilo2-4.16.0-21.el10_2.5.noarch.rpm eb84f77d4c349914d249a21e99b260421c5f9152deb8ab4f6aefcad2c4b71e68 fence-agents-ilo-mp-4.16.0-21.el10_2.5.noarch.rpm eeb9b2bc6cde8b87c3ec4e65ba4ab628d789e89f6bb675f9de06ddff240c830a fence-agents-ibm-vpc-4.16.0-21.el10_2.5.noarch.rpm f902c8e652433f804325f4d993ebdaaa7d96b4806e8da803c04d74fd44eb47e5 fence-agents-ipdu-4.16.0-21.el10_2.5.noarch.rpm fc9de80e97011d49b8861f131eb3794c92c566c1c4502d917365892d71a8bb61 ALSA-2026:48650 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default vim-X11-9.1.083-9.el10_2.12.s390x.rpm 182400944a639da59299530ecb3ea59049beb8b36aa545888a122fd5dfad1cc4 vim-common-9.1.083-9.el10_2.12.s390x.rpm 1c15d960b62ff0931b0629bd51dce6074926869a11ec1467096ef53d176725f3 xxd-9.1.083-9.el10_2.12.s390x.rpm c63bc9fdf869ae269dceca88c4af91406c4a194e537ce6f94c6b1c1ef9d28db7 vim-enhanced-9.1.083-9.el10_2.12.s390x.rpm d44e8062da05510bf03680e6c8f2f488169ea1b26d6dd303858cd4cf900ee1e7 ALSA-2026:49211 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () Bug Fix(es) and Enhancement(s): * [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [almalinux-10.2.z] (JIRA:AlmaLinux-185669) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-10.2.z] (JIRA:AlmaLinux-212063) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rv-6.12.0-211.42.1.el10_2.s390x.rpm 09dc50cc4fe2aa7e7167c41afd8c9e862caec4780b323110e92bd7b6fdc6cd42 kernel-devel-6.12.0-211.42.1.el10_2.s390x.rpm 29c98d3b1f42f5dfe4fea66f34bb641299217a9941ae6d1e16e4d7ccca9b2be6 kernel-headers-6.12.0-211.42.1.el10_2.s390x.rpm 2b109e222e918b3da2a7ac8865197cfb31f4a5c277bd2a706c5791fd1fe6d257 rtla-6.12.0-211.42.1.el10_2.s390x.rpm 35cf0319009e91b98337be9eb18659fccc73c4aada91e89ebb4c91ff4f2d1b84 kernel-debug-devel-6.12.0-211.42.1.el10_2.s390x.rpm 3d0af2a6de9e492f484ae1d3815578466a08698bd9e5fc96fcedf10a479e2e21 kernel-zfcpdump-devel-6.12.0-211.42.1.el10_2.s390x.rpm 408c91797d5a7f98212ac33e694c5182cae33f14267c0bc2c2b1fe7972ecb703 kernel-zfcpdump-devel-matched-6.12.0-211.42.1.el10_2.s390x.rpm 62072cb1006fe8898cb8ad3070809873ad60d3409fd01782500d7af7e4b70c95 perf-6.12.0-211.42.1.el10_2.s390x.rpm a36c9b3ae6b723b0150c40cdcf654159ddab9e258de251e3c7a6e0bb04d62b8b kernel-doc-6.12.0-211.42.1.el10_2.noarch.rpm bf419056c1f25a425baf0071c6b140681f7a5be5fb6970d09bdaddba8a9d6353 python3-perf-6.12.0-211.42.1.el10_2.s390x.rpm cc24a2a4018617f8d42eb96d21bb454af2a58bd7fcb97a8c39471d92079f87b6 kernel-debug-devel-matched-6.12.0-211.42.1.el10_2.s390x.rpm cc4ba0c485e5ab6f1e1ff4e452a764346c000f9d3df951336e9d13c17edce7ac kernel-devel-matched-6.12.0-211.42.1.el10_2.s390x.rpm e71f41e47a84a1ce8591fc5bd7a34cfe3691d76866ad74361dbea7b0fd8626f4 ALSA-2026:49508 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux (CVE-2026-5056) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.2.s390x.rpm 3094ca6cfd658e41f17c24fdf2eb2b558712b9513ace7db05a05563d8ffee47d gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.2.s390x.rpm fc0be4e81a82f95f24a6d304ab971bf379e91aa98aa9d27c71796cd319e65514 ALSA-2026:49514 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380) * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.3.s390x.rpm 740921851887b7c340aab189e4ccdbc9e2fb35d9aee07b7af616ce8aba17b58d ALSA-2026:49523 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files. Security Fix(es): * perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size (CVE-2026-9538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-Archive-Tar-3.02-512.el10_2.2.noarch.rpm d2c6df33777b5bff8ce63f4a073d414a7c9afac6e1da152d7b5a41393951e548 ALSA-2026:49526 Copyright 2026 AlmaLinux OS 0 1 Important

osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default osbuild-composer-core-165.1-3.el10_2.1.alma.3.s390x.rpm 210bf6171bba068b9bb36bc5fee84a5be74202a4db2a5061dbc7d4a399989bf4 osbuild-composer-165.1-3.el10_2.1.alma.3.s390x.rpm 7c4588276e0149781e7b44ee2ab8172701ce8b65d215a29a3b858649815549d4 osbuild-composer-worker-165.1-3.el10_2.1.alma.3.s390x.rpm 820c7f9d6bcf261bc91631b68b7ec375438cf5d90c6b3f8daf0e5f9f2c1d12d4 ALSA-2026:49621 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default thunderbird-140.13.0-1.el10_2.alma.1.s390x.rpm 648d80135b906d13be3fa8e572ee04ba233e8f3a0b252fdc5fc14e9d5190e2e9 ALSA-2026:49668 Copyright 2026 AlmaLinux OS 0 1 Moderate

p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files. Security Fix(es): * p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing (CVE-2026-13757) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default p11-kit-devel-0.26.4-1.el10_2.s390x.rpm 664082f6867d38a1ffb11be3f7c256846eda723e4cda039e9fd5f08d9e5e81aa p11-kit-server-0.26.4-1.el10_2.s390x.rpm 9865616902049bc8609c1ba50a74d7fa76f0ac2e69c03d2cb975c93d73cef3f3 ALSA-2026:49836 Copyright 2026 AlmaLinux OS 0 1 Important

ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets. Security Fix(es): * ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ldns-1.8.3-18.el10_2.1.s390x.rpm 6add7a9d302f2d18c2939884a78f00dbb3f94f3b0c1eae6db5c694eb0db6db9e ALSA-2026:49871 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214) * kernel: procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199) Bug Fix(es) and Enhancement(s): * [Lenovo] Graphics not working on T14 G7 Intel (Pantherlake) (JIRA:AlmaLinux-172832) * Possible regression with FM350GL [almalinux-10.2.z] (JIRA:AlmaLinux-184266) * [10.2 FEAT] CNB102: dpll: sync with upstream (JIRA:AlmaLinux-211011) * backport make module and modules-core provides use variant [almalinux-10.2.z] (JIRA:AlmaLinux-213965) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-doc-6.12.0-211.43.1.el10_2.noarch.rpm 1c74553d75296b52e5083e8873de03e04a8574cf085839e5ac3f4e2003a287ca kernel-debug-devel-6.12.0-211.43.1.el10_2.s390x.rpm 1f6bad1ac77e648bd31e53b13bc4444f40a50193f783874694eba0325a7030e8 kernel-headers-6.12.0-211.43.1.el10_2.s390x.rpm 5478b284710f959ec930eb2176bc4d638edfa4e4649c53b2ea347303ae1c1044 kernel-zfcpdump-devel-matched-6.12.0-211.43.1.el10_2.s390x.rpm 55d409e7e526d049a1cd6ed51ffea2d82d1a03def8d310353fedf3362b376501 python3-perf-6.12.0-211.43.1.el10_2.s390x.rpm 86485b610971e473f0ae84b8969de3be4d9e487f39bc5d2dcc0b3ca16d9ff711 rtla-6.12.0-211.43.1.el10_2.s390x.rpm 8d12d4e26d88fdbfb53f50e1383a94f580861cf3d50d96757643be10241a929f rv-6.12.0-211.43.1.el10_2.s390x.rpm 992bb9606fd8f152ac65a0e89bddb3c684054b409bc05cbb62f1b558ae6ba945 perf-6.12.0-211.43.1.el10_2.s390x.rpm 9f1de0ecbe8412f66243d9070e5f682c178843836fbb2f66b4e1946f447463a7 kernel-zfcpdump-devel-6.12.0-211.43.1.el10_2.s390x.rpm b2df199b7e9f18ddcf597e43c827b745702cdc20cb9dbc006115c6331e874e63 kernel-devel-6.12.0-211.43.1.el10_2.s390x.rpm c1ca8967d66aa751e028abdf44ee933345faf8a55a9ff295cf027b293ebf09a2 kernel-debug-devel-matched-6.12.0-211.43.1.el10_2.s390x.rpm d35d6d712ce90921c364268229e3c2d2a698b0a84298f81b1a76f77757d8c178 kernel-devel-matched-6.12.0-211.43.1.el10_2.s390x.rpm ffe6bfd57bef17b7a04f35c543399bb43bd35485636be609ff6d6b47aa7ccd54 ALSA-2026:49914 Copyright 2026 AlmaLinux OS 0 1 Low

php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.4.23 for CVE-2026-14355 in 10.2.z (JIRA:AlmaLinux-192616) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default php8.4-bcmath-8.4.23-1.el10_2.s390x.rpm 0ddd9cb2245164097df2d195a2d31732c10bb9500f876e622d147891ca356fee php8.4-8.4.23-1.el10_2.s390x.rpm 1e716e6d9287340c9a1c0e8a544ec56586bcfb334e3740d3bcf91c78a3b2d1ca php8.4-cli-8.4.23-1.el10_2.s390x.rpm 1f38d43a9998b262ee11dee050af6190feb5ca9d3791ed44312ed04e84af74b0 php8.4-odbc-8.4.23-1.el10_2.s390x.rpm 37f85df7a88c38be09db3b559fca46fcb47a0f7ed033843721ffc6e805634159 php8.4-soap-8.4.23-1.el10_2.s390x.rpm 400e83b49c7659af572e12b1a6549c1b3ec93a001b823d73118522f169c7a59f php8.4-embedded-8.4.23-1.el10_2.s390x.rpm 40b4b1f5f6feb03a5f288ebaa93c9fc3030d4f8802b77d54ce53753d9666b8ed php8.4-ldap-8.4.23-1.el10_2.s390x.rpm 4587ecc0a988cf792b8404e542dad7c560fb0d61d5319542e14dac9f42c48fc7 php8.4-pdo-8.4.23-1.el10_2.s390x.rpm 47b28f88092b52a0bd6658317f9dd83a6e49fb44d469bcc10cbc1e391589b440 php8.4-common-8.4.23-1.el10_2.s390x.rpm 501e8b9119f2f156b4774080030807d204d8534e8cb1462a778b572d40d1904f php8.4-devel-8.4.23-1.el10_2.s390x.rpm 507e6214e1ab2f76b8c8b5f4eeccd1d3047eacf3de1537671bebe08076774b9c php8.4-dbg-8.4.23-1.el10_2.s390x.rpm 51348702e17ab107e25332279216ad4e9fe68812dc4bcc6f89f88865912a6f41 php8.4-gmp-8.4.23-1.el10_2.s390x.rpm 5e16c3e271c0869728b8fa58fa9fdbb85c5c00eea1f6904f9e7c76a2340ba071 php8.4-pgsql-8.4.23-1.el10_2.s390x.rpm 7320a73b308e6e4be98b6498b1b576d3b1b8388f1509d583e694e4ff68a3b9c0 php8.4-mbstring-8.4.23-1.el10_2.s390x.rpm 770b00cb7a6a4e0c1b0f5ef83732b34714b4c40618a8b8460b32246dee8b7f72 php8.4-ffi-8.4.23-1.el10_2.s390x.rpm 882cf6ea660f68886bdabed4a3eee8333650f7260e45d39d5f32301143dd6921 php8.4-opcache-8.4.23-1.el10_2.s390x.rpm 8850f2921c675008f6abaf1b0831477bc45a795e4df3499e09a5149108910fe9 php8.4-snmp-8.4.23-1.el10_2.s390x.rpm 929783979171f85df09b2a006a628daeafdf24d25f94cf296da1e7a476a8634b php8.4-dba-8.4.23-1.el10_2.s390x.rpm bdb5f85859acf619cb7bed30717f394a5acca2cf29f784fc445799e177ae75b6 php8.4-intl-8.4.23-1.el10_2.s390x.rpm c0df4018a5d2168bb63aa1216c42ab983ca57a053c516a119889713eae7b7c01 php8.4-xml-8.4.23-1.el10_2.s390x.rpm c609971de96aae49fc821b30de8aa6691a1f5c9253fa8d085c578201e857543f php8.4-process-8.4.23-1.el10_2.s390x.rpm c8136b507d16775e6ae8d5f7668e9b2407195106cb76b8c02a6239f46f904b93 php8.4-enchant-8.4.23-1.el10_2.s390x.rpm dd55884839f5b9b44e0db58fc15c9f53038069adf09b9a936e368ab2f45707a5 php8.4-mysqlnd-8.4.23-1.el10_2.s390x.rpm eeb47abdabf7c5e77366eb13135f29625931ad5ef1a1d8c7667cf2c30c04de61 php8.4-gd-8.4.23-1.el10_2.s390x.rpm fb2692e8aac3e6272f3369c5b76ad03f0ffe81233fd6fa48d876d0b79064de67 php8.4-fpm-8.4.23-1.el10_2.s390x.rpm fcad49be69adcb65d9f23f12c7a3c46ef57f3eb9f25af16b6d87bd777056496c ALSA-2026:50144 Copyright 2026 AlmaLinux OS 0 1 Moderate

libgcrypt security update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix(es): * Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libgcrypt-devel-1.11.0-7.el10_2.s390x.rpm 1bff8f18abce86f5ec407006b744fdcce9355b583c0001cda7cbeef626785c15 ALSA-2026:50747 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding (CVE-2026-55827) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libwinpr-3.10.3-12.el10_2.7.s390x.rpm 0b1dceed634aa385e23fbfbfaf3ddbd78e7dce21ca53ddf0072828383ba4cf24 freerdp-libs-3.10.3-12.el10_2.7.s390x.rpm 190a9430c07d93122e14a5f54d88f4c0b788a5f06d4ed2a6f4eb883a07388b63 freerdp-3.10.3-12.el10_2.7.s390x.rpm 191cbd719242d32b685ba7573da9c43ada276a074b1f8b2c0a8c979e817660e2 ALSA-2026:50773 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security, bug fix, and enhancement update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241) Bug Fix(es) and Enhancement(s): * ruby4.0: Rebase to the latest Ruby 4.0 release [almalinux-10.2.z] (JIRA:AlmaLinux-211310) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ruby4.0-4.0.6-36.el10_2.s390x.rpm 389f27fbac266988f935ed642e411eda28e06706100ee44554707e6fdd87240b ruby4.0-rubygem-mysql2-0.5.7-36.el10_2.s390x.rpm ac994ba7f00a2b88a9c47c463dc6ed779c8227e889fe77f95f132fa976c5e4c0 ruby4.0-rubygem-pg-1.6.3-36.el10_2.s390x.rpm b2f4edd94ae1e78e3817a77c73aa5b67b28869bc679c4f4965a2824ecf01d17b ruby4.0-devel-4.0.6-36.el10_2.s390x.rpm b923e68ce7cb4262723f906972aacc7a39362959e91ee861f126c0433c84e4ef ALSA-2026:50778 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241) Bug Fix(es) and Enhancement(s): * ruby: Rebase to the latest Ruby 3.3 release [almalinux-10.2.z] (JIRA:AlmaLinux-211300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rubygem-test-unit-3.6.1-14.el10_2.noarch.rpm 131dd8cdd912467ba1f8827ee2132e59e97772a0a19a34d30dd7839e793b2109 ruby-libs-3.3.12-14.el10_2.s390x.rpm 2045188567d710092d53542a3f55e0af46cd356ae96e98e73318765a11507466 rubygem-minitest-5.20.0-14.el10_2.noarch.rpm 21c1889fe2fe8b665fd8d07927f509fe6feeaf78754ab805c15679497e55be47 rubygem-bundler-2.5.22-14.el10_2.noarch.rpm 2351acfc5df3fcc5dde89c2945b1b2c2f82584566adf5020e0254e7f592cfebb rubygem-racc-1.7.3-14.el10_2.s390x.rpm 2b0ad6adde1d14be7f13f3bb5f2847f4252d781c536c71aaac9159c1e348bff2 ruby-bundled-gems-3.3.12-14.el10_2.s390x.rpm 2f5803313b6d9bae1c1435704eaa69de2a7fad494d95aa2b561f07e793f7d3cc rubygem-irb-1.13.1-14.el10_2.noarch.rpm 46613819af1fb9478b0e629651c46aa11e4464bb5c9cffee7e759d6786dec0bc rubygem-rdoc-6.6.3.1-14.el10_2.noarch.rpm 5c00d2550ead68020d3187766315cf476e673c256a3075d89c40e6868434b24e rubygem-io-console-0.7.1-14.el10_2.s390x.rpm 74958fefc4fd9edb88b7296fa8bcf5330a9af316a52fde56ee0203fca8a9b52f rubygem-rexml-3.4.4-14.el10_2.noarch.rpm 797e9b5def067ed1b4a076e585bd427d2faa3fa20db74f61c349ce54a17001bc rubygems-devel-3.5.22-14.el10_2.noarch.rpm 7e994cc7820f22d4c3173560806e49845622523b1b6813aaaf17a3274d4dd035 rubygem-psych-5.1.2-14.el10_2.s390x.rpm 851330d5c2024c247ef7338fdca3ade81db3d552c443441d5b2d0ea29bb24d5f rubygem-json-2.7.2-14.el10_2.s390x.rpm 88964b9707e7808432453324199e04df1b2ede166216fc1dcabd1cd331c79608 rubygem-rbs-3.4.0-14.el10_2.s390x.rpm bded03e2bd3060bc0ed7b92ae84a138cec6c5150ffd1c559becf5ef1bd7361e7 ruby-devel-3.3.12-14.el10_2.s390x.rpm c1c5f597444a39c2769667a3a31be9af09f4b45569be779ad38c3f1f3f0c3734 rubygem-rake-13.1.0-14.el10_2.noarch.rpm c53bb678682a61e82cacd04f0a3d4f33c0e1d8dcad90c1eefd2d5de20caafebf rubygems-3.5.22-14.el10_2.noarch.rpm e614c319dddb353036831b3163c6c76c806a302b2d1b420f110dc3ac9779a8bd rubygem-rss-0.3.1-14.el10_2.noarch.rpm edcf8a577a06115a59a8a5e4d7f017b389372a4f7da251061524db691c1b5132 ruby-default-gems-3.3.12-14.el10_2.noarch.rpm eee30784ab9187664bab88713a780f0e03173777cb24eeeb2c65f08854146ff3 rubygem-power_assert-2.0.3-14.el10_2.noarch.rpm f635633eb2dfd48b67a65aa9e6a82eadfada6bc616d85081cdf4cc5bf73f08e4 rubygem-bigdecimal-3.1.5-14.el10_2.s390x.rpm f756697345fd01cd60a587cd5855ae912f1c970affcaad1dd40ecaa64a2ce8aa rubygem-typeprof-0.21.9-14.el10_2.noarch.rpm f76ebecc0e4d4bec6ed47f476de014cea992d3b11812f607afaed01950bc5dc6 ruby-3.3.12-14.el10_2.s390x.rpm f9623a39a28fdfc97d06885c6fb3fae247704b0a2e699a5862943d3a9af7aecc ALSA-2026:51075 Copyright 2026 AlmaLinux OS 0 1 Important

gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See <https://access.AlmaLinux.com/support/policy/gpsd-support> for more details. Security Fix(es): * gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution (CVE-2026-58459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gpsd-clients-3.26.1-3.el10_2.1.s390x.rpm 15ae709a283b92156e8188583a6aff07c50b3a8dd5e5b55080528818c1ddb83b gpsd-3.26.1-3.el10_2.1.s390x.rpm b1c90a1d9b5f8ed92ceeb83b9fb25ee26520130ebc20a3c7fa1f3230057f15d1 python3-gpsd-3.26.1-3.el10_2.1.s390x.rpm f08e03b6251ea1bdb4d91ea1ba55135095f0b9f37b534fb157e4f2b4d47dea3d ALSA-2026:51295 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CVE-2026-43186) Bug Fix(es) and Enhancement(s): * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-10.2.z] (JIRA:AlmaLinux-186345) * ice: driver update 2026-06, part 2 [almalinux-10.2.z] (JIRA:AlmaLinux-193134) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-devel-6.12.0-211.44.1.el10_2.s390x.rpm 114c806f39ada5b9eb327134d8d9aadabec2c2c6ae662e166830f1e791526b35 kernel-doc-6.12.0-211.44.1.el10_2.noarch.rpm 1c4aade5d5fb516248eb660f2819523377e9feca8b77c696901ba628dcc0602a kernel-debug-devel-matched-6.12.0-211.44.1.el10_2.s390x.rpm 74c292332f6a5189ee39f2cfea52048f6cd7c90feb9f5ae65e9d04001dc548c3 kernel-debug-devel-6.12.0-211.44.1.el10_2.s390x.rpm 94b101a9333e7386718a2d7210147fece6a908613630ab37eab74d7e74b7e37e kernel-headers-6.12.0-211.44.1.el10_2.s390x.rpm a41a9909fc9701fa4e05334971721d9030c3aa669bd3d195e749a68073df3b67 kernel-zfcpdump-devel-matched-6.12.0-211.44.1.el10_2.s390x.rpm b39793b2b07298d664cb236e1689280cd3d964e572792d7e3d62640d5211ed38 kernel-devel-matched-6.12.0-211.44.1.el10_2.s390x.rpm b7c16d57483b6bd2cd470f675b9c3433a14aea983866f7946513e02a242e61db rtla-6.12.0-211.44.1.el10_2.s390x.rpm c5b84a7ec4c955bc39185bfd6465cde593067f03afebb21708c82920f841d26a rv-6.12.0-211.44.1.el10_2.s390x.rpm cb33a8b5bb3ae8c0eefa336c8c8d5c830e111134f8306b173a7cb4d0af31661d python3-perf-6.12.0-211.44.1.el10_2.s390x.rpm cf21812f4560ab40c4fcd8afa3301eb3ed7b34c7fc7ce187b86275543bd3ca27 kernel-zfcpdump-devel-6.12.0-211.44.1.el10_2.s390x.rpm e37dd383c0886aeaec88ca9475727ec5aef4ec4630c36ad9b5db5d467988badb perf-6.12.0-211.44.1.el10_2.s390x.rpm fd3adafa612bbd088995b074457e69eec6cd9e0f49a6beaea66e894630290ebd ALSA-2026:52675 Copyright 2026 AlmaLinux OS 0 1 Moderate

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libarchive-devel-3.7.7-10.el10_2.s390x.rpm 356c96557e720316e51ed9d9dd9ff4aa863b06b9b9c1cab1cf22757e9986fab8 bsdtar-3.7.7-10.el10_2.s390x.rpm e371e9f97a60839d3745d64111a322518ca0970e13f24525c2a1983af10cfd1f ALSA-2026:52841 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs-nodemon-3.1.14-3.el10_2.noarch.rpm 754dbb75c7096126fe89e0025ab2e31e63eda960fb77226c5e627a74feb18d21 ALSA-2026:53330 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fsnotify: Fix ordering of iput() and watched_objects decrement (CVE-2024-53143) * kernel: shmem: fix recovery on rename failures (CVE-2025-71072) * kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415) * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368) * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531) Bug Fix(es) and Enhancement(s): * Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-10.2.z] (JIRA:AlmaLinux-213035) * AlmaLinux10.0 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-10.2.z] (JIRA:AlmaLinux-222503) * AlmaLinux10.0 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-10.2.z] (JIRA:AlmaLinux-222505) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-zfcpdump-devel-6.12.0-211.46.1.el10_2.s390x.rpm 13fb3bf3c854b2a2557c3988841e4a90a24df741f754f53bf01866e2c6d00a31 rtla-6.12.0-211.46.1.el10_2.s390x.rpm 13fbafc397731f170b1842034ffb0148d008bbfa691eaa9c74fd48d25c906fc6 rv-6.12.0-211.46.1.el10_2.s390x.rpm 1bdd0ea752dba0056a2b2377aed3dbbff07fa8874612f94b6f0bc8e1b75453ff kernel-devel-6.12.0-211.46.1.el10_2.s390x.rpm 1dec9ca644202d8a51fc6d9d93af56ee82634fa69b0c44198f22918fcb5ad14d kernel-devel-matched-6.12.0-211.46.1.el10_2.s390x.rpm 27e1ea1518b2dcfaf5f7f6d2993ad2d6253cf58769ba258dc1beb15a109505aa python3-perf-6.12.0-211.46.1.el10_2.s390x.rpm 478e6e114a1faaa0cb5f3e32cf6d64ecbf288266f2abf39f5dfbd8f1e4c7e7e5 kernel-zfcpdump-devel-matched-6.12.0-211.46.1.el10_2.s390x.rpm 6fa861779263d5ee887b8a4bdf7cd0cffc347c28aa8d0c19f54835b536461a5c perf-6.12.0-211.46.1.el10_2.s390x.rpm 87ed43de2cf42d8ee3c4b919ade21fe913116407e7fa6ac55ec008e7889fa7c3 kernel-doc-6.12.0-211.46.1.el10_2.noarch.rpm 889073b12cc0ea295f2ca8fe44265cfc363bf64df9f9389e1236bf5667da86f5 kernel-debug-devel-6.12.0-211.46.1.el10_2.s390x.rpm b1ae3c873c310a98980a63cc8cbd8669d99201039426526956dfee21d2be78f6 kernel-headers-6.12.0-211.46.1.el10_2.s390x.rpm d567cc5d3ddee3faadda291fe4936096f450d17309bfe5502e48f10d5db9239e kernel-debug-devel-matched-6.12.0-211.46.1.el10_2.s390x.rpm fbf43b79cd2ea5d0a4e31b68754f98fdad717880408c147a90e3c7c2e2cf7772 ALSA-2026:53435 Copyright 2026 AlmaLinux OS 0 1 Important

udisks2 security update

The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default udisks2-iscsi-2.11.0-2.el10_2.1.alma.2.s390x.rpm 2f751af7a0ad0e0dac5362291c8536c9c696920d6f1dca6905fcf0a7c7788f2e libudisks2-2.11.0-2.el10_2.1.alma.2.s390x.rpm 99a1d89f3ceede00ef967a4f4cfaf634fdde8ceedb55602fd9696be2ad2f6614 udisks2-2.11.0-2.el10_2.1.alma.2.s390x.rpm a2056b33416eb87d1e939fa723f3cfba916bd924fd028634458fce0fcacf3c85 udisks2-lsm-2.11.0-2.el10_2.1.alma.2.s390x.rpm a942553bbf1052cc19d9d7891d9475191a2722eec5be3a92f2b12e423ec4610a udisks2-lvm2-2.11.0-2.el10_2.1.alma.2.s390x.rpm c84c4addc154262f5891e19022a5da6963847be9aa3d619bceb2e5553d52e4a7 ALSA-2026:53451 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.3.s390x.rpm 7ed7d8b68c16ecc5ddc32957b4f7055c3412a8dfefdde1a24b8c890e1caf65b8 gstreamer1-plugins-good-1.26.7-2.el10_2.3.s390x.rpm b1c0ee8b21dc06a5cdf1a3eea9f30025ebad37149bccba1fff87cc19317cb121 ALSA-2026:53845 Copyright 2026 AlmaLinux OS 0 1 Important

iscsi-initiator-utils security, bug fix, and enhancement update

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks. Security Fix(es): * open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944) * open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943) Bug Fix(es) and Enhancement(s): * [FJ10.1 Bug]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [almalinux-10.2.z] (JIRA:AlmaLinux-191899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el10_2.2.s390x.rpm 3de384b15721a945b9d2031442dcb62a6ed6b76bfafcb974d7e8e0f580705fae ALSA-2026:54178 Copyright 2026 AlmaLinux OS 0 1 Moderate

grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382) Bug Fix(es) and Enhancement(s): * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default grafana-selinux-10.2.6-28.el10_2.4.s390x.rpm 0e8dda8a7e29227691b4f6ec653ae1c8b44e7d7f8f499e955acac840e3e343e2 grafana-10.2.6-28.el10_2.4.s390x.rpm d8f57b5c8a7066f3c0bb5a92ad22bf41e704254bfd69882f8c1205d1c2cf90cf ALSA-2026:54343 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: perf/aux: Fix page UAF in map_range() (CVE-2026-64300) * kernel: af_unix: set gc_in_progress to true in unix_gc() (CVE-2026-53361) Bug Fix(es) and Enhancement(s): * netfilter: CVE backports for AlmaLinux 10.2.z (JIRA:AlmaLinux-185311) * tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-10.2.z] (JIRA:AlmaLinux-214436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-devel-6.12.0-211.47.1.el10_2.s390x.rpm 1e077314bd329ea14e391f5fae95abdeffcb02a2b6a6362d38face074a2233c1 kernel-zfcpdump-devel-matched-6.12.0-211.47.1.el10_2.s390x.rpm 467333d95e6eac667c12ba07ba55fb0c1c4ba1379cf9d96c39b9a47c84e95df5 kernel-devel-matched-6.12.0-211.47.1.el10_2.s390x.rpm 4b0a389563a1915b595cb84d7b0a4ac9cbcd15446952357e5c581d6684e571e6 kernel-zfcpdump-devel-6.12.0-211.47.1.el10_2.s390x.rpm 4f10f1fffe6974bb73f23fc59100e9946d529d689c3692a9076010e6dfa30037 python3-perf-6.12.0-211.47.1.el10_2.s390x.rpm 52a948844ac3fedd2659a3380c951cb56d30e27a0e51dae4a52738f982aaabd2 rv-6.12.0-211.47.1.el10_2.s390x.rpm 7faef0c3f57e35adf2dc05396fd7b60c519e3be98442dca0ad060023f01b5fe3 perf-6.12.0-211.47.1.el10_2.s390x.rpm 86c418c0b79f1357bb29de6010a034524e8345b46871b4710c72226e107c77b1 kernel-doc-6.12.0-211.47.1.el10_2.noarch.rpm b6ea785a24bb7a5f9f936164f09340cbc926d13f91290fde4caa9d611fc41c48 rtla-6.12.0-211.47.1.el10_2.s390x.rpm b96fd4213aa1612610d6b4f8129858d4a3852003b45264ae92169bf404615440 kernel-debug-devel-6.12.0-211.47.1.el10_2.s390x.rpm cea5867e78f50b973573ae61e214e25cbe74ff2de772f5b58a11433f19df6c04 kernel-headers-6.12.0-211.47.1.el10_2.s390x.rpm d45e56f327c45ab214b9f08083576938cd5507e9e0602cba18a96a8740a19b51 kernel-debug-devel-matched-6.12.0-211.47.1.el10_2.s390x.rpm d83a27e62d51702e25a8935b3112aefbcafdb761a1deb5dd5d7e65d696f102bc ALSA-2026:54486 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620) * FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621) * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libwinpr-3.10.3-12.el10_2.8.s390x.rpm 05d108e4da78b4968f382dc9a428a43dabec1de8128e558418aaa28f70d4539c freerdp-3.10.3-12.el10_2.8.s390x.rpm 917d4d26c98e75e94410ad64a1899da11a5a240d97ca0e4dbe6ddcc3fe13214e freerdp-libs-3.10.3-12.el10_2.8.s390x.rpm 9e30a9c67d212ff14e514dcde1ae03e9e925b78f8c20baf2725402bf68f96d71 ALSA-2026:54512 Copyright 2026 AlmaLinux OS 0 1 Moderate

gnome-remote-desktop security update

GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fix(es): * gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service (CVE-2026-18358) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gnome-remote-desktop-49.3-4.el10_2.s390x.rpm c3780ae3712be856b6eb9749a71e3781b6d5a6a15ddb5da89219f59b28809bb3 ALSA-2026:54541 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.130 Runtime version: 8.0.30 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-10.2.z] (JIRA:AlmaLinux-235472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-sdk-8.0-8.0.130-1.el10_2.s390x.rpm 23a20f1d3ef96bdbbe03748a7cfdde4f680ace3e6efd77e00e36c754d151a820 dotnet-runtime-dbg-8.0-8.0.30-1.el10_2.s390x.rpm 2cdbdff8cf211d9e535d4a9bef78ec46e7869687098045c60c104a9180deb070 dotnet-apphost-pack-8.0-8.0.30-1.el10_2.s390x.rpm 37cb77d55f4c5d91034c53e3d1b85db5a8c48479da06e2a5990e14b40b3fb844 dotnet-templates-8.0-8.0.130-1.el10_2.s390x.rpm 4dcb7ba70f2eab0c669b0e50a02dd4471baa484c61159c571451c8ca9858b042 aspnetcore-targeting-pack-8.0-8.0.30-1.el10_2.s390x.rpm 7efb121b9a6888b7bbe5e92d57e96e85977ceca4324ce549f6c3cd54e2afe6e9 aspnetcore-runtime-8.0-8.0.30-1.el10_2.s390x.rpm ace33e70c4653fc2fa1e826f4b6b713fa2c4d1146b14c20df31e109edd176f81 dotnet-hostfxr-8.0-8.0.30-1.el10_2.s390x.rpm ad59cffacaab143dfee360b8eb9f59ab1039f8864db92c4ce368d4652562cb14 aspnetcore-runtime-dbg-8.0-8.0.30-1.el10_2.s390x.rpm c415dc82018105102db9fab6106df91d913803c9641177cf02e1321855c794df dotnet-targeting-pack-8.0-8.0.30-1.el10_2.s390x.rpm f4aad2932076636100874d95d42fcc380d0090570bfce88fdafa351884a09253 dotnet-sdk-dbg-8.0-8.0.130-1.el10_2.s390x.rpm f8f58220435066f6bb87ba728acb9e311b62d592ee0075bcd65d48028c27fed5 dotnet-runtime-8.0-8.0.30-1.el10_2.s390x.rpm ff1ab6f8c7146e8ab3e2e0b6c271695183426ea23332b0f914d9c980e939854b ALSA-2026:54576 Copyright 2026 AlmaLinux OS 0 1 Important

dracut security update

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dracut-caps-107-9.el10_2.s390x.rpm 0e0611000b2890cec9fe8925f2bf7f0a8531721f6cc5f878e90d8c2835e62721 dracut-live-107-9.el10_2.s390x.rpm a709c61e85193eaab61d28c6e4bebff597010f34d0581162ab5a8cabd33ad99c ALSA-2026:54590 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.120 Runtime version: 9.0.19 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-10.2.z] (JIRA:AlmaLinux-235477) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default aspnetcore-runtime-dbg-9.0-9.0.19-1.el10_2.s390x.rpm 22445460bcbe64d526fb0ecbdc36f33c8cfa0ba39919687f5e38f13d471a60b7 dotnet-runtime-9.0-9.0.19-1.el10_2.s390x.rpm 285085a4c34ccfcf98dbd0914efa66fbc836a148723c88f8d0ec3b49939b0422 netstandard-targeting-pack-2.1-9.0.120-1.el10_2.s390x.rpm 2f69ffc2a283f8581e627fe5378511724eb1cba3c702168c47f4c5a6137e3bd6 dotnet-targeting-pack-9.0-9.0.19-1.el10_2.s390x.rpm 4e89a745e8f80d2d89c974f00f058afa6194cb8e6dd99cec4b63a6939a2fee21 dotnet-apphost-pack-9.0-9.0.19-1.el10_2.s390x.rpm 7cd2bd67a70acf75ecb5747c43a38be67c1c5c2e3179666d52e0bd25bdcf90d1 dotnet-sdk-9.0-9.0.120-1.el10_2.s390x.rpm 8530ccabdd240955fee4e63204c35eed5d42549f680849fa43412804956c7f81 dotnet-sdk-dbg-9.0-9.0.120-1.el10_2.s390x.rpm 8c68d23f37df90dac7561edad1e7a33e110f6ebe0bf4b7ee5baea28127a3dbe0 aspnetcore-runtime-9.0-9.0.19-1.el10_2.s390x.rpm 9d0cd2e15a0fc83457008777ce10f9d25f6d4f314ef5c1d89f59811628272d06 aspnetcore-targeting-pack-9.0-9.0.19-1.el10_2.s390x.rpm bc4bbbce80e74fa23c72ef3c2f333a8c82dfe3ff2d3151f293c020262c1fe68e dotnet-hostfxr-9.0-9.0.19-1.el10_2.s390x.rpm d13f1a00e43e6df0e48e85b678716f37a3660315a9b182c5b335f4d0a6daa894 dotnet-templates-9.0-9.0.120-1.el10_2.s390x.rpm ecba5c41d31e88c5d1c5ac03c5d25ec37404aa85f53120a49b9f20d55ca1e7e5 dotnet-runtime-dbg-9.0-9.0.19-1.el10_2.s390x.rpm f77fdb7a0b29cd7bb369741bb240ba0e4c697487bae4ea1e182e35e568aa83d9 ALSA-2026:54650 Copyright 2026 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libnghttp2-devel-1.68.0-3.el10_2.2.s390x.rpm 6f0e175704c81bece862b619b32499fad1734e00ee1fe376e5b0238d1bcc3533 ALSA-2026:55424 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-lib389-3.2.0-9.el10_2.noarch.rpm 27cf3e06e99257f4c51c72088b1f9e5f48d590b294e516768385c0f484ac53a2 389-ds-base-snmp-3.2.0-9.el10_2.s390x.rpm 30de43f989ec4d4058d9ce4bc7d1a54aef006057e0e2ce110fbe9fc060b0f63a 389-ds-base-3.2.0-9.el10_2.s390x.rpm b5ea36197e439782435b4bf37d98fcf923fda1dbd7edcddbf9d7dc09533867b1 389-ds-base-libs-3.2.0-9.el10_2.s390x.rpm ceda9e1a6ef0ad27904aa034fd1267fbce641ef2b322290a8fadc8a028ae7615 ALSA-2026:55432 Copyright 2026 AlmaLinux OS 0 1 Important

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.4.s390x.rpm f21f41a6d59b60aad626f80bb40f5b13c081641a3f3f6ff75f86d0fc821f88e1 ALSA-2026:55433 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.s390x.rpm 3ce42002597ee5f0beb8002684c8dd751d72ad64da249903bb696a7cb210e969 gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.7.s390x.rpm c922644ca2b2f528d9a356dfbbeac0a7379352f73978136dfe496495653d33aa ALSA-2026:55434 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433) * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.5.s390x.rpm 9c543a5e1f8a10d35bc934fdb953e441d68cef4c45602254c3218b3a257b3465 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.5.s390x.rpm adcd20b75422583b87821339c3b1867c15cac25d54f55ab820a97279a439ce43 ALSA-2026:55437 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default bind-9.18.33-15.el10_2.10.s390x.rpm 11eda84081a11a884e3998e348f027899f5f789eb6f159a827996901a96f8fc6 bind-dnssec-utils-9.18.33-15.el10_2.10.s390x.rpm 2f7f4c25defdcc71e9e8d46a1087d15330150d9bd3a3f08ce2a000e35206f2d6 bind-libs-9.18.33-15.el10_2.10.s390x.rpm 693a8a69dc9c8b7d36142c7d3db6df983435268f6cdc91875f7f5f4da81aa852 bind-utils-9.18.33-15.el10_2.10.s390x.rpm 781a40bf6074e45a1fdcd9c296cd4d926129952ebccbdcfff31e8d3c4629c646 bind-chroot-9.18.33-15.el10_2.10.s390x.rpm bfb04d07f852c38f1b53e2b3b3bda4ae02b865755c2ab00068baf5c9212bec01 bind-license-9.18.33-15.el10_2.10.noarch.rpm e7269f3a04d0f19af0b01cb87ae997a2d63f8b901c3fbbbd06b2be1ac756d519 ALSA-2026:55448 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679) * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libXfont2-2.0.6-5.el10_2.3.s390x.rpm 16d2c2ed6e7ce1571d52a99ecda5892a77a60aaf53599fca7d603d77d04e8df7 ALSA-2026:55541 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs-22.23.1-6.el10_2.s390x.rpm 03a41cff0317faf3dfbee7268e2b1fa705c86117d28ac3206a4b08b4b0ad9d42 nodejs-libs-22.23.1-6.el10_2.s390x.rpm 5419c32f43428edcf57e4965edf2cb55b7d6b3d456672211717e28c823555ae0 nodejs-npm-10.9.8-1.22.23.1.6.el10_2.s390x.rpm 6a5329666040fe5e0a45fe23aa458310bee2d9411d3a0bdfd3f0c72b5cb2ab84 nodejs-full-i18n-22.23.1-6.el10_2.s390x.rpm 6d2c08534eb8565c076a4111aca225d5df19c773d1afdc62ee3574684d273ef6 nodejs-devel-22.23.1-6.el10_2.s390x.rpm a30047e9b959197931f6578e19ee2d0174870bd6e8675f3283fb37554e7cdcc1 nodejs-docs-22.23.1-6.el10_2.noarch.rpm a4cf7db461223295f0f82718617815510079e00e6e5e5f79921d8490e5169df3 ALSA-2026:55617 Copyright 2026 AlmaLinux OS 0 1 Important

pcp security update

Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fix(es): * PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524) * PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526) * PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527) * PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default pcp-pmda-logger-7.0.3-5.el10_2.s390x.rpm 045354f3d05e9a24bd0b9378a1648af8d514322e506c86a9cf68afed97c7ffab pcp-pmda-openvswitch-7.0.3-5.el10_2.s390x.rpm 06b3790ffd8171f918c15f530a4aacd8d4c463c07bb128b376ce79b4f4120cfd pcp-pmda-unbound-7.0.3-5.el10_2.s390x.rpm 0722a6e966e1ac5b0149eb5f1b6e38dbb3f68d6903a317d7ee40caa8f533fccb pcp-pmda-mailq-7.0.3-5.el10_2.s390x.rpm 0a4e942908c1a31f4dd49d5108b1c027ff17db88f04ed17a23e2d050b47902e1 pcp-pmda-nvidia-gpu-7.0.3-5.el10_2.s390x.rpm 0a6c6632e332c8bf4add8ae98e5957e1947ccfd2367087be53470bce08f0cc12 python3-pcp-7.0.3-5.el10_2.s390x.rpm 0dcb3140ec2b70a7f538bcedc159ba66b25d5cf94580c5766e61be40cfe913b7 pcp-pmda-openmetrics-7.0.3-5.el10_2.s390x.rpm 0e4c93bccee2b548036158cd528226bf8459007c6f7005be00e84ce59b1a881f pcp-pmda-bind2-7.0.3-5.el10_2.s390x.rpm 12e1ba823d08de366c51844e6ec2fe975bf69a515cd4b7c0963222364c378ae0 pcp-pmda-lio-7.0.3-5.el10_2.s390x.rpm 13755ebdfcaf89bb2a7be490a075ea30e28219c354381cf31277b1d5ece58574 pcp-pmda-libvirt-7.0.3-5.el10_2.s390x.rpm 1794c8babbd5e395a715728e4f87e1e4e3664568fc0f0a3650d9b81364af4a72 pcp-pmda-denki-7.0.3-5.el10_2.s390x.rpm 1df6b5e6089884aa536dbed422c8fb5ff03ce54e0787f8ef25155bfb00e656d8 pcp-pmda-zswap-7.0.3-5.el10_2.s390x.rpm 2030c4ce2008bee27cb798a978703f55c64f40c6d252487f5cad13a7c2f66874 pcp-pmda-trace-7.0.3-5.el10_2.s390x.rpm 22041e2dfd5f961af6a743b7d9c8d474644eea5835973fc86859927b96512cad pcp-system-tools-7.0.3-5.el10_2.s390x.rpm 2311dd3cf55146d23e32360b05c20cc9717023d7b457bd60e3b2731ceabee5c3 pcp-pmda-summary-7.0.3-5.el10_2.s390x.rpm 2446aa76df1132ca3e7b405fa7f876ee0df73e6111e72b9fe9c1703ba2760e30 pcp-pmda-roomtemp-7.0.3-5.el10_2.s390x.rpm 2c32ca874c2d82a9a0b0edc9af88a2dd133b2d90a75ad682f4486faa0bb21a97 pcp-pmda-elasticsearch-7.0.3-5.el10_2.s390x.rpm 2f9adfa653d85faa7252e29bc42ccc551c16b5dfea26a302f0fd4748e8229eea pcp-import-iostat2pcp-7.0.3-5.el10_2.s390x.rpm 352fe085b3e71f63c0e92cb03ed74096d7e445e3a7a66bd91d34014dc479ac0a pcp-pmda-rsyslog-7.0.3-5.el10_2.s390x.rpm 3623fc50592c5ea04e8d19b261e1da876713e12852d83d68c93b0a744d65b074 pcp-selinux-7.0.3-5.el10_2.s390x.rpm 367426ffb22ca182737baff6bce54829fb5c98b5d875f7a48616296d87ebb3a1 pcp-devel-7.0.3-5.el10_2.s390x.rpm 372c59b691a4e523104291c7649ccd1c26af2e9fe77e1141ccb448eda27ad44b pcp-import-ganglia2pcp-7.0.3-5.el10_2.s390x.rpm 3a133f78509a07f1214b8e3c00db8b967deb1ab49205f574277f65a274551897 pcp-export-pcp2influxdb-7.0.3-5.el10_2.s390x.rpm 3b987782d9040562878bbdca10acc75fc457e331b790950201ca7194f3990e6f pcp-pmda-rabbitmq-7.0.3-5.el10_2.s390x.rpm 3f2f9d1e87624fdbc211a94f70ad5007b7dfe0dd9b25770e4bcda77610fff63b pcp-pmda-haproxy-7.0.3-5.el10_2.s390x.rpm 42248ff6971a48f91cd1566b5ddbd08c78c97ddeac20c97df7f3307577eecbbe pcp-pmda-bcc-7.0.3-5.el10_2.s390x.rpm 4536af93bfa6fabe4b9833c89967600b61d3bdde699fadf8a63bc591259ddc14 pcp-export-pcp2opentelemetry-7.0.3-5.el10_2.s390x.rpm 45e88017e5cfdd5284e0724315e01148d6b160cc802639f9939044b08a97043a pcp-pmda-systemd-7.0.3-5.el10_2.s390x.rpm 46fefbd91490d03ad762cc198f9e095a9df7397c3bff6ed0fd507c951fe5d286 pcp-pmda-zimbra-7.0.3-5.el10_2.s390x.rpm 4736dbee34ad766b4c6ac6f9f9296c934781a05adf463b3f8b56e1b938c4ffe4 pcp-gui-7.0.3-5.el10_2.s390x.rpm 48ab49ba412382caf2f1f72c873212bf56573062763efd26b37ce1853f8b643d perl-PCP-LogImport-7.0.3-5.el10_2.s390x.rpm 497649e0b582848500f8e0246afcec939043af3e689a31ffe9aefce0c734d9b1 pcp-geolocate-7.0.3-5.el10_2.s390x.rpm 4ba5bf305b2f9d52d6c10fd6bc6c3c623e81fbe4351507e303449e89f7c2ba80 pcp-pmda-mic-7.0.3-5.el10_2.s390x.rpm 4c8f8f5106f7fc13813cbcf1bf89dd2960b599fb09ce265621f2f602b88827be pcp-conf-7.0.3-5.el10_2.s390x.rpm 4e6b0b2fbb00360986a84e0a41c710c1b874f835ad132136497b7ea32d25e362 pcp-pmda-gpsd-7.0.3-5.el10_2.s390x.rpm 5257387127dbc0f06c7a6980a148ec822b85e44126358794ac18a9682aca27ca pcp-pmda-cifs-7.0.3-5.el10_2.s390x.rpm 5362fdbb858d49a7473dcc3153c9f0e3dcd46dc57ec79cf0304d6f4b30696143 pcp-pmda-nginx-7.0.3-5.el10_2.s390x.rpm 5469995daca4538a8f5d87f91bf28bc2e0fb501b8808928c1fc04fd04c184bb3 pcp-pmda-hacluster-7.0.3-5.el10_2.s390x.rpm 549ae4e7b94b5ed344f8d607054523c948412096bd48111a7e7a94d909b04d12 pcp-export-pcp2elasticsearch-7.0.3-5.el10_2.s390x.rpm 57faae9a8d034648b59c0003a9ef93ec1a16bfdb7116234cbfd029e5421e2bdb pcp-pmda-amdgpu-7.0.3-5.el10_2.s390x.rpm 5840dda16d70450e83e51d7acb03efda2d734828a9188c8f8f653ff4ef7fff2a pcp-pmda-mounts-7.0.3-5.el10_2.s390x.rpm 5bd759a003ef0d1478cc5a5657c7e19c0734eb4a9a4b65efa2fe367220599d7f pcp-pmda-news-7.0.3-5.el10_2.s390x.rpm 5cacd0789d4b1ba705b1d2081ee28904ef2c9cdf12cb8bb7952c5fde0c4ca8e4 pcp-pmda-rocestat-7.0.3-5.el10_2.s390x.rpm 5ce5c0c96ea6bd6269de133c67ebd8223c2032253cea20dabb38bcccb171e6c5 pcp-export-pcp2json-7.0.3-5.el10_2.s390x.rpm 5e819e5d0c769c12b72394ca1994579407cb1045fe825f3deafefd2f49740a38 pcp-pmda-shping-7.0.3-5.el10_2.s390x.rpm 5fcd3bb6c668630c188739b631019088b8343801adff4e0885682f7210c3a9dc pcp-export-zabbix-agent-7.0.3-5.el10_2.s390x.rpm 60aa221269f305240295dad8545ac2d1006619e7887deb881781ce6d4fe5d5ad pcp-pmda-dm-7.0.3-5.el10_2.s390x.rpm 627eef1d0b1202fd02945ff72c3794d372f5f7c85bca97087a7afeedf1c2a055 pcp-pmda-mongodb-7.0.3-5.el10_2.s390x.rpm 629174c0fc3455ce3d82170ed323c995a2d98930316b37a1fce06de2a73de02a pcp-pmda-lustrecomm-7.0.3-5.el10_2.s390x.rpm 63a5dd25723037ba2dae1d79827fbe9de0ee3b165a6e9ad58837e80f5c1874fc pcp-pmda-dbping-7.0.3-5.el10_2.s390x.rpm 6455d470370bc68e5ee5ef6c8d4bcebcfc5fc8a217c93e5916e1cb87b9687922 pcp-import-collectl2pcp-7.0.3-5.el10_2.s390x.rpm 6d05eeb97a1155b827b26c46d89f6e3e4da54949d9d56265a84c58eae4d999c2 pcp-pmda-lustre-7.0.3-5.el10_2.s390x.rpm 7031365f56a7e23eaf74b07814ef7de0ddd99f05a810244cc6001d758e1f29c1 pcp-import-pmseries-7.0.3-5.el10_2.s390x.rpm 705da1e0af01fd4202448e4b082632a8a7d925e96bac74479d72662cf40fdfee pcp-pmda-ds389log-7.0.3-5.el10_2.s390x.rpm 70a592587d715389e2dc71d4db375966cb4488e5e18be27cdf04c730664ada15 pcp-pmda-redis-7.0.3-5.el10_2.s390x.rpm 73af990b45a2124cecec0de9c0c9890786961d61ce2cc5bd57c5de03c127c959 pcp-pmda-bonding-7.0.3-5.el10_2.s390x.rpm 74f18c0c9d3cbeb9c87fe219c0a20389c6a7be422daef48d46b848c05d95449d pcp-pmda-smart-7.0.3-5.el10_2.s390x.rpm 76de58af7043e4e9ee63b5dc2b69192abdda6a3d68a1ea37c5d7155c773a4a20 pcp-zeroconf-7.0.3-5.el10_2.s390x.rpm 771b3997f517dd1acd6259653c80c62930602f42f4090eb9ea5d347aaa5608f7 pcp-pmda-docker-7.0.3-5.el10_2.s390x.rpm 772dabe44c5fac56a5fb96df3eb66d57efd990b6c132ec58a9c0dfd06fb3e19f perl-PCP-MMV-7.0.3-5.el10_2.s390x.rpm 77bff061066d76d2c62b9dcc3dbbeaba04b47ef6804fcc9ee8bb97a7e7b0f5c7 pcp-pmda-bash-7.0.3-5.el10_2.s390x.rpm 7a1d4c511dc4d6835059f5aca851a66e2e2b66e33166fe5c9c7db6558ec1d0ae pcp-pmda-uwsgi-7.0.3-5.el10_2.s390x.rpm 7af47a81ddc3b4a00e84101ca737a94d6c1de656d5228997f46124031f453401 pcp-import-benchmarks-7.0.3-5.el10_2.s390x.rpm 7f52d3d0e1d0738a2bedda4e38494a0da7b95bbe38c88724f74468e80478600d perl-PCP-PMDA-7.0.3-5.el10_2.s390x.rpm 80cd2343c447dfa3be23ac8eed23774cd73df081566bc6b3d1457874b7a1097f pcp-pmda-postfix-7.0.3-5.el10_2.s390x.rpm 81d29bc37d91bb454065429413c09d40a21328fa0da7be4e4dc4dead5bf70fad pcp-pmda-apache-7.0.3-5.el10_2.s390x.rpm 8951262b2d8dbd67f3393c2c3a65209faa30af7b66c6629df793c0e6a38d8341 pcp-pmda-slurm-7.0.3-5.el10_2.s390x.rpm 941a86d0b270d8bdbf9922d033f28e9bea84a7082eee42891cc4b1e45c6664c3 pcp-doc-7.0.3-5.el10_2.noarch.rpm 94a7dc3f75afab71ce735dd038541108a4e6b18e03790db4d1e46bbc272ecb1d pcp-pmda-lmsensors-7.0.3-5.el10_2.s390x.rpm 96aa4ed1b265ce0c74983754a15d4c6085b09b4f759e9727bfb73b2d4faa34d1 pcp-export-pcp2xml-7.0.3-5.el10_2.s390x.rpm 992475d7c6ddc0b9af3010256b0ba51266b639a9e2ca01583c0be43177f6a2b0 pcp-pmda-weblog-7.0.3-5.el10_2.s390x.rpm 9ca4b4084aa88620de53612bd61e7a9265060dc4dda40716c2ed0bc69b2b7ec1 pcp-pmda-pdns-7.0.3-5.el10_2.s390x.rpm 9ca5a0b9f2e07b7a1308d477378c2cf29de806234442557ea432aaf4754bf525 pcp-pmda-postgresql-7.0.3-5.el10_2.s390x.rpm 9e32acd02d0da0ed787c46bf572eb23e105fbec34c016cab354aee8eab25ed72 pcp-pmda-gpfs-7.0.3-5.el10_2.s390x.rpm 9ef0ff89402f70d63ee6ecc9a17f29b25644f3ffa0be9f5aa9ab299fbb625854 pcp-pmda-farm-7.0.3-5.el10_2.s390x.rpm a27e603f42c2f3c0127900e4235f5b80c2341999add8d210998268c46fc5e785 pcp-export-pcp2openmetrics-7.0.3-5.el10_2.s390x.rpm a707fdbff27b837838d00bbc8104eed3f08660c664d168a762ef6dd97b49d572 pcp-pmda-activemq-7.0.3-5.el10_2.s390x.rpm ac0511b0279801f415be98ed457675a7da4abdc76fb2daa1d3d30923e970a186 pcp-export-pcp2graphite-7.0.3-5.el10_2.s390x.rpm ae3e8cef616fa7253c2e587f0b58352acdd5a91746b52ea852184690bb7b9fb9 pcp-import-mrtg2pcp-7.0.3-5.el10_2.s390x.rpm b57e22a688a282f9fb23ce5e81af73379f7f4077b0493e3e895ff12c061b2b14 pcp-pmda-opentelemetry-7.0.3-5.el10_2.s390x.rpm bb0d6683f9bf064c01c39f2e0cc8e2fe444bd357897a311a9431ff507259dfa7 pcp-pmda-cisco-7.0.3-5.el10_2.s390x.rpm c1b3c7c38975e9b887fcc7ed2f41d76950abb2f11221d1c0eb3736e291e01133 pcp-pmda-bpftrace-7.0.3-5.el10_2.s390x.rpm c53447ac4aad2d3cba9d8ca8bcec9864e55706eb5750874d2dc1586982f91b94 pcp-pmda-memcache-7.0.3-5.el10_2.s390x.rpm c773a55b9d647348b246254f32170219eeb79f65856e5e6b929d1014dfd49131 pcp-pmda-sockets-7.0.3-5.el10_2.s390x.rpm c8e689f6282e881bfff121a0be7616aa3478e2e2d28b819536f17230c3447a5e pcp-libs-7.0.3-5.el10_2.s390x.rpm cb59473c9e4ff07a5cea178f8aef3842a1bdfa8e6fa0aad5e19802552c16611e pcp-7.0.3-5.el10_2.s390x.rpm d0f3450e5783ba958d3ee45a8da07e04e3efee989b10a19b10561b998451c69a pcp-pmda-snmp-7.0.3-5.el10_2.s390x.rpm d3981d0855f6d16198655a6ae661cb9a60e388712ad5f9dacd4ec27f4284ba21 pcp-pmda-gluster-7.0.3-5.el10_2.s390x.rpm d3fc6de8c31f76d1097f56cddbaedca137b3dee946c215119dbf608f284cf9c6 pcp-pmda-mysql-7.0.3-5.el10_2.s390x.rpm d44027be2ac19dfe2ccdf3b0bd80d0e50bef4953ff2b8b3d34fd5402410b764f pcp-pmda-nfsclient-7.0.3-5.el10_2.s390x.rpm d77ea947b552e3cd71956fb4c0644466f961a8462c26ff110a1cf6ab4e6fc02e pcp-pmda-oracle-7.0.3-5.el10_2.s390x.rpm d905b5f7d0f49fda03a356c25fc56642ae8edeaeeafd695b605ae335046f708d pcp-import-sar2pcp-7.0.3-5.el10_2.s390x.rpm dd5ce8deb68b2706aa7b8b74fc4bbb973fe355fb9e758b999df69f2d130113ea perl-PCP-LogSummary-7.0.3-5.el10_2.s390x.rpm df3c3a053d122ba0c3a1c4aebc87ffb97f36e078a3d2d928b08bb67f35cf20d8 pcp-pmda-netfilter-7.0.3-5.el10_2.s390x.rpm e0ae972a56694023035ad3c52a29cdc669b70094fd6d26d1a3998e892765fe16 pcp-export-pcp2zabbix-7.0.3-5.el10_2.s390x.rpm e35f6793541049e343d4946cfe77b1a00b083ab4f2a16c22874adb0be3ba4f7c pcp-pmda-samba-7.0.3-5.el10_2.s390x.rpm e4bf5db0e3b80dae6e6b7526752c3a2cff63fee5aac70470c4435f8aa8b4356e pcp-pmda-hdb-7.0.3-5.el10_2.s390x.rpm e508284a978fbc8a3c884c05bb45232a292522d7983619096ff89be8a2b110d0 pcp-export-pcp2spark-7.0.3-5.el10_2.s390x.rpm e775426e30bc0267183b1f731861419fc69b5bccd05452e1533a64dc5b268e75 pcp-libs-devel-7.0.3-5.el10_2.s390x.rpm ec558c36f13e5c9714c5cf5dc23a72f365e4e9c9c69d2ced22e0772539879a49 pcp-pmda-sendmail-7.0.3-5.el10_2.s390x.rpm ec6b47b8b83ec7380afd589f5f4e96fb7c3293d61b70de964df50069a17236d7 pcp-pmda-podman-7.0.3-5.el10_2.s390x.rpm ec7a90a4a6c0c0cbd852eff7880431d31a8fe89a4fc358948c46f6150f04cbfe pcp-pmda-ds389-7.0.3-5.el10_2.s390x.rpm ecc2e8cd6dc95fa9e8cd711258c586a6dcab9f85cb277829b8fcfd71bc8e9e3c pcp-pmda-netcheck-7.0.3-5.el10_2.s390x.rpm ecf88e86d7db39e18977d3140430dd7535943e79f66522f10b67e69ea4396144 pcp-pmda-statsd-7.0.3-5.el10_2.s390x.rpm f34e4930cbe5063d73e2e557540fcd458adff1205caa8f43fad56f303e02bc2d pcp-pmda-bpf-7.0.3-5.el10_2.s390x.rpm f9cfb42528f22a82f87028006732ee2a250f4a148b025035c286027a8bff184e pcp-pmda-named-7.0.3-5.el10_2.s390x.rpm fdb0c0e023460e21b190af632e6bd097b8a39e3adb856d25b32172a62b6bc378 ALSA-2026:55679 Copyright 2026 AlmaLinux OS 0 1 Important

haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fix(es): * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204) * haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default haproxy-3.0.5-6.el10_2.2.s390x.rpm 7994ea2ac53cffa8af6ec2bd11cc6103e0b4e6040b98ce7fa7c28943a2e0b305 ALSA-2026:55787 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default java-21-openjdk-devel-21.0.12.1.1-1.2.el10.alma.1.s390x.rpm 4aa5dfdddedb13cb7a4f107a9ef132531ea988dd1495ce52a5f6e28fc3400ad1 java-21-openjdk-javadoc-21.0.12.1.1-1.2.el10.alma.1.s390x.rpm 4d0046757d123973932b7baf7aaece9ad9f90eb971f555bf8b65fe2d8ffc8b9c java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.s390x.rpm 53e93980e3d3a5355c3511425f7bb791adb7659427a738a784d1ab304a03a674 java-21-openjdk-headless-21.0.12.1.1-1.2.el10.alma.1.s390x.rpm 5a4d8898e69f02142e7563af4600215ab6dbaa16aadaabbc21a9da82331dcad5 java-21-openjdk-demo-21.0.12.1.1-1.2.el10.alma.1.s390x.rpm 6a05f2c56bf1f56a72aa9958c4878020877882746e7ed373e89e1acf12755597 java-21-openjdk-jmods-21.0.12.1.1-1.2.el10.alma.1.s390x.rpm ad9913595ad51f34d8126cc67bbcc14092e3b229cb73eee868e5934bc9aa93bc java-21-openjdk-javadoc-zip-21.0.12.1.1-1.2.el10.alma.1.s390x.rpm c7fcee7ef8c33c08848b9a8807cbcd4843b69f234ef01caae84f0101156b6d95 java-21-openjdk-src-21.0.12.1.1-1.2.el10.alma.1.s390x.rpm dc6b3593a696234ae051782810a4704f9ad6395c493e9253ac754f9035b529bd java-21-openjdk-static-libs-21.0.12.1.1-1.2.el10.alma.1.s390x.rpm fe625a2eb45d3a6e7328abcc61936546e9bd3f6d6fb55a3c0a64009923f43b53 ALSA-2026:55798 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Improve font loading (CVE-2026-70906) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm 000513598c2c721922774e8f8cda9a9c0fefc621a850890bf7acf077f1dece3b java-25-openjdk-headless-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm 002fd5a2f539dc1619ac0a1b592745800f3df91004150e0755924b08c885fe0e java-25-openjdk-static-libs-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm 3a4aac0835feb961c999a03bf77c144a85633ea5ca75fb56fa9649cf552f4179 java-25-openjdk-demo-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm 3b04410ac6b1055ead54658ed83ca3532145fa400a558495b4e3234ce8f728f9 java-25-openjdk-devel-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm 4746e160ed004143c9ab52d554d74fa847de7289c6543479ae70cc4f3c8b1554 java-25-openjdk-jmods-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm 4e79c008ee4b3e985f01272a9c07b31b12afc714de32045693e874691630ce4f java-25-openjdk-src-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm 91cf4e89b9d2fc36ef24c8c839713f033c2e5e32abc59d840be22952dc96b828 java-25-openjdk-javadoc-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm a183e6d5a4ef1212c2972c987bf2baa08fc6fd49bcce95b5b600e32493929b37 java-25-openjdk-javadoc-zip-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm af558cfd0199f7a3d89a74d5df449f8f5bec23ee1494627181f1e8fa3cbb476d java-25-openjdk-crypto-adapter-25.0.4.1.1-1.1.el10.alma.1.s390x.rpm b35a5b2babf52010cdc85df1c0d3e73856e838440af68fb5ec3fa989f0064d24 ALSA-2026:55855 Copyright 2026 AlmaLinux OS 0 1 Important

libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842) * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843) * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844) * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845) * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846) * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847) * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848) * libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849) * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850) * libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851) * libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libssh-devel-0.12.0-3.el10_2.s390x.rpm 16fc93f0aaba5f3e674ad5c9e96385fca35c88794e8328d91bd48398b4d674ce ALSA-2026:55858 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.111 Runtime version: 10.0.11 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-10.2.z] (JIRA:AlmaLinux-235482) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default aspnetcore-targeting-pack-10.0-10.0.11-1.el10_2.s390x.rpm 031e60ef496f18a655e608b2799b25a03e90dc49a34990078229b805f5267303 dotnet-apphost-pack-10.0-10.0.11-1.el10_2.s390x.rpm 2a173a06c2a0897a5580a939c7668dc71029a918ce67f6a4e3e5fc5591d02979 dotnet-sdk-dbg-10.0-10.0.111-1.el10_2.s390x.rpm 2bbc9426a993d406af0aa9b60cc708363a49560d39e3859a49178cabaccd97b9 dotnet-targeting-pack-10.0-10.0.11-1.el10_2.s390x.rpm 2dbaab74f458bdcdbac48de35c22e3a00f7ba49858ecbf1374a21d05784035eb dotnet-host-10.0.11-1.el10_2.s390x.rpm 315842fba46ecc1ee85c5854ed1d68d3dce47056fda7bfd12c73428c789c832a aspnetcore-runtime-10.0-10.0.11-1.el10_2.s390x.rpm 423137d70d81c2c2db1311764cb5d6f8b03d7ec8a8eb8844b9b1af58362ac04f dotnet-hostfxr-10.0-10.0.11-1.el10_2.s390x.rpm 5331718a18f10ce1c9377d4bbfa3bc13e546ac31ac9ce6c90c7d9bdf69416366 dotnet-templates-10.0-10.0.111-1.el10_2.s390x.rpm 67ad3ddf1e816bb2fe0b85373960ee8ac597155997a5d01ac5bd587e0f9b3c86 aspnetcore-runtime-dbg-10.0-10.0.11-1.el10_2.s390x.rpm 7590506b62b28032624664a7458bec7fc8bfe9dd9dc898040e15064b021b23d8 dotnet-runtime-dbg-10.0-10.0.11-1.el10_2.s390x.rpm 816e6844f0c43fca056628509aad7f714499bafff97c120b2ef26999cead2f25 dotnet-sdk-10.0-10.0.111-1.el10_2.s390x.rpm 97cf73043be30c5b1a6715eb706a1581db5f2749870d8634922aa741ee5dc06e dotnet-runtime-10.0-10.0.11-1.el10_2.s390x.rpm e13c6b0c7804c114c76d2c8ad49a0a8470015ca30a286621544336af26c8c29b ALSA-2026:55892 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default unbound-dracut-1.24.2-7.el10_2.4.s390x.rpm 0369a9bfcabf6c5e5c8afbe51d6e5cfaa9718d3285290266db83011f59b174b6 unbound-libs-1.24.2-7.el10_2.4.s390x.rpm 37e2cb8d4b49b77dce7068ddd59831321f4e3639b1ea7241038f0114c038e026 unbound-utils-1.24.2-7.el10_2.4.s390x.rpm 3922b5d3fb8491549d1ba79c338c271d32a0183680db58b8c744adcde77548ca unbound-anchor-1.24.2-7.el10_2.4.s390x.rpm 4e13acb2e6f693324b0365c618f4e2e94245f76487e491b67b4d7dc124f5b314 unbound-1.24.2-7.el10_2.4.s390x.rpm 9ffac100ed133422e69f295b325e0627546fadc3df196962d92b92f4749de2a6 python3-unbound-1.24.2-7.el10_2.4.s390x.rpm f5689dcc4a7bbb479bd456831217efbecaedc59c7ec128152fed2a3c6d59bf79 ALSA-2026:56007 Copyright 2026 AlmaLinux OS 0 1 Important

mysql8.4 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: Performance Schema unspecified vulnerability (CPU Jul 2026) (CVE-2026-61081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47064) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47012) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60331) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60190) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60177) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-60145) * mysql: DDL unspecified vulnerability (CPU Jul 2026) (CVE-2026-46936) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60186) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60315) * mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026) (CVE-2026-61096) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60163) * mysql: InnoDB unspecified vulnerability (CPU Jul 2026) (CVE-2026-47052) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60188) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60184) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60185) * mysql: JSON unspecified vulnerability (CPU Jul 2026) (CVE-2026-61109) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60191) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-61094) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60178) * mysql: Group Replication GCS unspecified vulnerability (CPU Jul 2026) (CVE-2026-60332) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60189) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60747) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-47023) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60183) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60316) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60187) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60585) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60182) Bug Fix(es) and Enhancement(s): * [tracker] Rebase MySQL to 8.4.11 (JIRA:AlmaLinux-188044) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mysql8.4-libs-8.4.11-1.el10_2.alma.1.s390x.rpm 048deaa4f3f6d3739b91ef2ad5bc71be407594f83d72c13d2e53b1b4fe2ca32e mysql8.4-errmsg-8.4.11-1.el10_2.alma.1.noarch.rpm 363b90f121ea2698cc9695f9f3309d5ffa0b6afbaa96304878cd6e0f4729dc7e mysql8.4-8.4.11-1.el10_2.alma.1.s390x.rpm 6ba6aa32a842597ed4d0dcd94d04c9fe7a77e34933f5b4edb3102d8852cbd861 mysql8.4-server-8.4.11-1.el10_2.alma.1.s390x.rpm 6bcee814f4595e7ed2f9f97f5d2706f9da064951886d5b4d3296ccbab1db0630 mysql8.4-common-8.4.11-1.el10_2.alma.1.noarch.rpm c88645f04b3cebf77c1371c06af54dbc511288a9c7e60b32a1b8566680f797db ALSA-2026:56965 Copyright 2026 AlmaLinux OS 0 1 Moderate

libcupsfilters security update

Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications. Security Fix(es): * libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611) * libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libcupsfilters-2.0.0-13.el10_2.s390x.rpm 15eab1307b858d71bd92786344d92c9ac03c9fe87f7396fbaf4da08803c073d2 ALSA-2026:56969 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:AlmaLinux-223949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default php8.4-8.4.24-1.el10_2.s390x.rpm 04fc36cd36828e65317bb326edd5093fdb1afda55f3ab7663171ebc3ce1e7953 php8.4-odbc-8.4.24-1.el10_2.s390x.rpm 105706827b7f60f76443197c698df3f4f23374eb85a01a1890f31d0114eaa1b4 php8.4-mysqlnd-8.4.24-1.el10_2.s390x.rpm 1306910db060cea7d67cbd9f35a44bbdf4db101f0b11d07c4866f808db39da78 php8.4-dba-8.4.24-1.el10_2.s390x.rpm 14d19e46c424d2293bb409bdc2882886321fefd9e24d3ba361e35a8bdc13f99d php8.4-gd-8.4.24-1.el10_2.s390x.rpm 198b842734367bfc86ccaf371219be6021ee8d5d7eb36cb7d59883cd40779c51 php8.4-xml-8.4.24-1.el10_2.s390x.rpm 1e2f7646039706cc16272e732130cfa1c16b687bbf3fad9a94cb6f57daf6e596 php8.4-snmp-8.4.24-1.el10_2.s390x.rpm 3bb0953bdec620c743c33c0a09378e6fca471c70f40fefd2b0c36dfd7e547c18 php8.4-bcmath-8.4.24-1.el10_2.s390x.rpm 3d6eb726fa81d416b6c0ede831592a5d62c312952efc120b2ba6e2e545ef6f8e php8.4-cli-8.4.24-1.el10_2.s390x.rpm 4c209540257e457da3dca0bf802a6aa370b3cfa534fb6465496c9ecd83bd7b54 php8.4-opcache-8.4.24-1.el10_2.s390x.rpm 5150e208bd84b700a2b788351b7e92e1d9d9655badd679e054f6b9824ce76567 php8.4-ldap-8.4.24-1.el10_2.s390x.rpm 94b13c39040ea987c5feb97c55eca68377bdd27b87b37f95bb70262e3c901d66 php8.4-common-8.4.24-1.el10_2.s390x.rpm 9c02aa2d7e3e0e70a3f00e89bbf06e655e389885bb714ec58b3ddf5b72577b3c php8.4-ffi-8.4.24-1.el10_2.s390x.rpm 9e00d820ec58a9f39da2550e25aa1f62e10a2dc34a44a657204599cee04dc7f9 php8.4-pgsql-8.4.24-1.el10_2.s390x.rpm a943a5ad167345baced00a8d3d9048583878276e52db6dcb39e6e4e6f525482d php8.4-soap-8.4.24-1.el10_2.s390x.rpm acba2681c51b06a2fc6359488f68aa7ce5b4eb5953def7e1f8c2265975942c39 php8.4-intl-8.4.24-1.el10_2.s390x.rpm b0a6ed105b5943c32ab13e1214e9df09861ed86619651ab2e92650e4c0095844 php8.4-fpm-8.4.24-1.el10_2.s390x.rpm b917984a03cb110b7a5c79fb5750fbe35f69bddaa81f42f7d4fae06b8f2d95d3 php8.4-pdo-8.4.24-1.el10_2.s390x.rpm c4ebdb9c2cace97950bdc0dda71c1abff9d05b8e2801459126250d5935c9bba9 php8.4-enchant-8.4.24-1.el10_2.s390x.rpm d81314ff1891c055ad102dc0f4ab66c1d93674a9cbe53e98822385e24c2fd93e php8.4-devel-8.4.24-1.el10_2.s390x.rpm e1eef56fe441c4feba7936c08f431d8bffccb1949bc19639659fcad2decf2bec php8.4-dbg-8.4.24-1.el10_2.s390x.rpm e4f55b1ec62e427fa00aa310f37271e35d55c9697e7a0adb23171f75ee6e07ec php8.4-process-8.4.24-1.el10_2.s390x.rpm e8f24ba2895c0b492100f4b2d673a999e5f1d57ad660cd134c8d4d8cc3d2d4e5 php8.4-mbstring-8.4.24-1.el10_2.s390x.rpm e9de116b10d4f9f89f866bb4c7884330b89e2dd55aa106ad3ab034805968b304 php8.4-embedded-8.4.24-1.el10_2.s390x.rpm f41b9637e6d9baa8476a6ebd48ac498ca63837b449871e9262b32ecf44bbe8dd php8.4-gmp-8.4.24-1.el10_2.s390x.rpm f5eb92d0a5a98ea7b1ef0a2fcfc96ded5061e6baa83e5dcbb79d07def143eb36 ALSA-2026:56971 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Date-Manip security update

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time. Security Fix(es): * perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-Date-Manip-6.94-5.el10_2.1.noarch.rpm 10d103055b714ff49d9c99838b44a6ae39437022daa8f3446516cf8eca19f1d6 ALSA-2026:57015 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010) * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011) * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012) * glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015) * GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering (CVE-2026-15588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.21.s390x.rpm bf6b71ddfc4130ed78c02f14f3d818cfae055c5818bb62bee94005c0e9fb1e55 glib2-devel-2.80.4-12.el10_2.21.s390x.rpm f6dd03282ad19131561c8222cdb545ce150d133167c51d7191b61d6e3b36d2f2 ALSA-2026:57126 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.2.s390x.rpm 0a24f45f05bb7040629c6216c94f28a534a2650e528a2419deb3b7e2e34944cf ALSA-2026:57148 Copyright 2026 AlmaLinux OS 0 1 Important

ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. Security Fix(es): * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ansible-test-2.16.16-2.el10_2.1.noarch.rpm 278ed7a9b385cb985f51b9a6e708b16d47cae71cb98ba0d3c8d13b7c71d3f0de ansible-core-2.16.16-2.el10_2.1.noarch.rpm 9e56e424dbf2c5ad2a45a0dfbe4d711e036865c0a60139679f71bec6f32d2897 ALSA-2026:57251 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878) * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185) * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991) * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379) * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386) * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560) * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388) Bug Fix(es) and Enhancement(s): * CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:AlmaLinux-223954) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z] (JIRA:AlmaLinux-224545) * cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459) * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z] (JIRA:AlmaLinux-235812) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-zfcpdump-devel-matched-6.12.0-211.49.1.el10_2.s390x.rpm 118511ee4be7e16650926f5f0967779051b28e325a0387820c63e6c302dc31a9 kernel-doc-6.12.0-211.49.1.el10_2.noarch.rpm 246731a322c2c865a9e626b9c0be133018206f6db8652c48453d46fdc34459d6 python3-perf-6.12.0-211.49.1.el10_2.s390x.rpm 3cc7d4b68f64ebedadafd582bcaa65c71d036fd94833d6ee6089b7449d38f591 kernel-zfcpdump-devel-6.12.0-211.49.1.el10_2.s390x.rpm 48d030a127d20be1b5343d0aa805042e6c2d4d4865cca4c09360fa4621a79f12 kernel-debug-devel-matched-6.12.0-211.49.1.el10_2.s390x.rpm 50773087b38c01d9bf11fa9c9c78f69f5e716a8682397bcc4bacf4111d8f843d rv-6.12.0-211.49.1.el10_2.s390x.rpm 86f432ac6145635188b06fd7850b5a87c8a824382e6bb3915a7a8b4b7b294223 kernel-devel-6.12.0-211.49.1.el10_2.s390x.rpm 9831675898f6a579598a88e4badcaec311d20ca6b2ebb5c1d4991b2d05f9a9e8 kernel-debug-devel-6.12.0-211.49.1.el10_2.s390x.rpm a2a284d9bb0474bbbd1bb6146380448f50c8f41acec51176cbe7971e4437a652 kernel-headers-6.12.0-211.49.1.el10_2.s390x.rpm cb9927576a3144eda0638c936b379ceb524467608faa49a827e89ed39cd54583 rtla-6.12.0-211.49.1.el10_2.s390x.rpm cdb739efb3d014ac1a5f55b8a29c88358c25659971235484c4b478a33c3d9103 kernel-devel-matched-6.12.0-211.49.1.el10_2.s390x.rpm ef567c04f11b71ac1db16c7282c9c7d2b26ec6091a8ca9aac254d48c560cbe31 perf-6.12.0-211.49.1.el10_2.s390x.rpm f9c49e240fef8746a3778eee208797299a2ef83fc131da819d2a7c291b29226b ALSA-2026:57596 Copyright 2026 AlmaLinux OS 0 1 Important

mrtg security update

The Multi Router Traffic Grapher (MRTG) monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic. Security Fix(es): * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation (CVE-2026-72694) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mrtg-selinux-2.17.10-12.el10_2.1.noarch.rpm d7555e699b1e01e77cb85e1fbe4038f3f7826311959865d40f4c38eed8aa6134 mrtg-2.17.10-12.el10_2.1.s390x.rpm dce0e8a1038c6b31d6e340d03362b42e58d27d82e8286d78c8f873eb0717be97 ALSA-2026:58571 Copyright 2026 AlmaLinux OS 0 1 Moderate

qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914) Bug Fix(es) and Enhancement(s): * qemu-kvm hung during drain after double pause [almalinux-10.2.z] (JIRA:AlmaLinux-190702) * qemu-img create/convert fails on target block device with 4k sector size [almalinux-10.2.z] (JIRA:AlmaLinux-207389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default qemu-kvm-10.1.0-16.el10_2.5.alma.1.s390x.rpm 1300b74a18c61ad4f19ff0ffe2f5d82d5df8a79a290542093bb9542dbf92c39b qemu-kvm-audio-pa-10.1.0-16.el10_2.5.alma.1.s390x.rpm 1affa7b3ec6b3b5fe68b86cc8e8a118d439f62aa600c3e123f896ea7fdc01cc7 qemu-kvm-core-10.1.0-16.el10_2.5.alma.1.s390x.rpm 51663abde4001d5aa8594d25e7eb4a04b7c78a987b060a0d2d9c6e48d509f71a qemu-kvm-docs-10.1.0-16.el10_2.5.alma.1.s390x.rpm 6069549c5f3af9f9c845459cf32a059d651f89df460eeffc512532bc1b9a3434 qemu-kvm-block-curl-10.1.0-16.el10_2.5.alma.1.s390x.rpm 6c51eef228381a515824f83754b14f47a364e378ba904207350b3cf7d35c8115 qemu-kvm-common-10.1.0-16.el10_2.5.alma.1.s390x.rpm 9180c2ef1fe3364c501e561b6bdd43016876074278c67495ce83c08191e51463 qemu-kvm-tools-10.1.0-16.el10_2.5.alma.1.s390x.rpm 960535b1023196733950b263b6f5aebfef27efcf3b4dc1371ace401531dbd610 qemu-img-10.1.0-16.el10_2.5.alma.1.s390x.rpm 9a752f07cc0965460900629a45ad5da58093506e6039ef73ffec47a4666e889d qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.5.alma.1.s390x.rpm 9acad4c209d80f59783d08ce14ccd87991b00a2e96ee105c8087544bbb94d8c8 qemu-kvm-block-rbd-10.1.0-16.el10_2.5.alma.1.s390x.rpm a396fada8f52b103ceb7642421be2dea00d29d26733fb0b54aa7f786639216fa qemu-kvm-device-usb-host-10.1.0-16.el10_2.5.alma.1.s390x.rpm ae21dcd6555478dee750101acaaa676537fbdbd420ad1d48128b8382b4ff9e42 qemu-kvm-block-blkio-10.1.0-16.el10_2.5.alma.1.s390x.rpm bed9ea10989858811cb0bd0e175b84103a32fb57873b9040dfcda91dded285eb qemu-pr-helper-10.1.0-16.el10_2.5.alma.1.s390x.rpm cba062beaabd19c0a506b4a930d1b27ccc2d08677fe40b1e80374a01ddaa7a7f qemu-kvm-device-display-virtio-gpu-ccw-10.1.0-16.el10_2.5.alma.1.s390x.rpm d82c1dad8ad294e899b7c230893424c71bd32ae130413e3cf3ba0ab7ea7964bc qemu-guest-agent-10.1.0-16.el10_2.5.alma.1.s390x.rpm fb9fea5ee0a985fa159e8e22ae78f66bcba4b484fee95504243e5370f84459f2 ALSA-2026:58819 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch.rpm 0b5823d155438be9e50559a2b2516af1f168e0c86471037562a2f1a8b8cc92f1 nodejs24-24.18.0-5.el10_2.s390x.rpm 554fabac3e6e13d6f908a9f56c8faabbabf37973b49951fb96286f70b6723c2d nodejs24-devel-24.18.0-5.el10_2.s390x.rpm d51914a8db148cd7d4bd817594b4c08cac7164fa8e0b4e8a667233203ce79079 nodejs24-libs-24.18.0-5.el10_2.s390x.rpm e1b18d3cb372b35a4e0d9cb498fedb2f6f7b65cb5f9bd5cbd8439cc87116c6e8 nodejs24-full-i18n-24.18.0-5.el10_2.s390x.rpm e3976d92db25a965d5ccbc0c692b7aacce542f3b146f174f4b1d8df506cfbd30 nodejs24-docs-24.18.0-5.el10_2.noarch.rpm f376c79686cb878dbaf4e4b6b47534b7dad0ad97bbd2d659ad2f239bdb1d023c ALSA-2026:58899 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component (CVE-2026-74983) * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-74943) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component (CVE-2026-74941) * firefox: Privilege escalation in the Shell Integration component (CVE-2026-74965) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-74946) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-74949) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-74940) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-74969) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component (CVE-2026-74967) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-74944) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default firefox-140.14.0-1.el10_2.s390x.rpm dc0e7afe3cdcb2952be3e900d0fb9ebbfaf6a8b378cd5842de62a8ef41384f36 ALSA-2026:58902 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-tkinter-3.12.14-1.el10_2.s390x.rpm 22a0124f8422f7f27a4ad1789158dd907d0a2427fc8c8a5d7333680f2aaef54e python-unversioned-command-3.12.14-1.el10_2.noarch.rpm 432002d2f2d16400a23c31dbfa20b3800372adba8054dfdfcb8877898640e6a9 python3-devel-3.12.14-1.el10_2.s390x.rpm ef64acd1155f0ca00246889673dcddb6f07e8e95a9865f14d5ad74af0886b2b7 ALSA-2026:58927 Copyright 2026 AlmaLinux OS 0 1 Important

sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default sqlite-devel-3.46.1-6.el10_2.s390x.rpm 1c30301118ac54772517cd7ade4b70c85831c912332c3abdb74b0101cd36ccc0 sqlite-3.46.1-6.el10_2.s390x.rpm cef8d2f499c80fd34966b63e82e951cfa27b8a1f725ad0875b05a85916c894a7 ALSA-2026:58928 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3.14-tkinter-3.14.7-2.el10_2.s390x.rpm 03372cbdfd38fa0341c08da2b7220efbb6c30c78bad6960a52fdb0b9ac9db127 python3.14-3.14.7-2.el10_2.s390x.rpm 683b35e12a548853b1a6cc6bf115651ccdbbcd5501831837314e5a6d48227772 python3.14-devel-3.14.7-2.el10_2.s390x.rpm 982718839fc78c6a177808fe7e790163d8b8a6999bbcb2ce14c2f3452d677386 python3.14-libs-3.14.7-2.el10_2.s390x.rpm a6bfd36052e5786563ab74118be0e7f6ebfdacda1b35d30dbe111aa462110cc7 ALSA-2026:59097 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-base-tools-1.26.7-2.el10_2.1.s390x.rpm 13cf53fa38036e4b61c35a82eaa41ce05aebcfc64926b17f095a754453931638 gstreamer1-plugins-base-1.26.7-2.el10_2.1.s390x.rpm 3c7a9b65bbd91842f1046b0deda81f34b5522b442e9a321ec793a640dc8d0d73 gstreamer1-plugins-base-devel-1.26.7-2.el10_2.1.s390x.rpm 8f4d54a86c0540a237422a0c37a46808022dae2c102fc3cd5e363caf275aa14e ALSA-2026:59133 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296) * gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.7.s390x.rpm 92411003d5bb3622a87a4680ac69778ba7373e456bda512003a7eb9fce909cd7 gstreamer1-plugins-good-1.26.7-2.el10_2.7.s390x.rpm af247037355f3695ae709839fd95b7ffaeba857fa5ed3de1d70233c352eef136 ALSA-2026:59220 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nginx-mod-http-perl-1.26.3-6.el10_2.6.s390x.rpm 03361ec31d819c29f1dd325ce455ddb3e23b7fcfb470ed2ab984b576e0ce28a2 nginx-all-modules-1.26.3-6.el10_2.6.noarch.rpm 0ee1da66b42d7a7309fa3e289c5fb632caccf67d24aeab9708c03be35a50dd93 nginx-mod-mail-1.26.3-6.el10_2.6.s390x.rpm 5a4ee0b2feb413cb0c5da97b778f5b09af16cdd42f72f2a3a76e61d3b6eb15c1 nginx-core-1.26.3-6.el10_2.6.s390x.rpm 5a9a936b0f23bf97db06337f2a6836eed692d1e4bd58fa3697082c65a8af9434 nginx-mod-http-image-filter-1.26.3-6.el10_2.6.s390x.rpm 5debe3d0b2a138a8e87ccf810caf5499f8fb0778bccc9c3a279352ffdebf25b3 nginx-filesystem-1.26.3-6.el10_2.6.noarch.rpm 6a4302dfb7471b2cc3f0c8e4f7944909387b627464c4efe14fde80d576b946c0 nginx-1.26.3-6.el10_2.6.s390x.rpm 72180d7b4daee331eb945b25fa693d1d6aacc884140b1b7455ea977317817994 nginx-mod-http-xslt-filter-1.26.3-6.el10_2.6.s390x.rpm 73b6fce193ba376d825daeed43576ceb6ac002962761ebaa0fdf0d4372afad94 nginx-mod-stream-1.26.3-6.el10_2.6.s390x.rpm ab62b2c4dd64b54838770d1e7f82f6d7f827fe2424cb4e66e7035744f1a5beb8 ALSA-2026:59243 Copyright 2026 AlmaLinux OS 0 1 Important

python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-pyasn1-modules-0.6.2-1.el10_2.1.noarch.rpm 05edb19dae2edc37e82548abae6af2808fd01ad0c9fb7d6e914cb343e2182e02 python3-pyasn1-0.6.2-1.el10_2.1.noarch.rpm 5a44c6804ccdde9b93b518b3d47f1187e4ee407ae6a058b986bc2fa52399e8bc ALSA-2026:59372 Copyright 2026 AlmaLinux OS 0 1 Moderate

assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing (either with JUnit or TestNG). Security Fix(es): * assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default assertj-core-3.24.2-9.el10_2.1.noarch.rpm 2001c3bdd1cac076d06f46697038efbcaea5ed8fff25714109166daf9b16ee5c ALSA-2026:59379 Copyright 2026 AlmaLinux OS 0 1 Moderate

pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default pam-devel-1.6.1-9.el10_2.1.s390x.rpm ed2743334f86cec00d267ac340a966f2792ba425257cacfadfaa0bf6d381e732 ALSA-2026:59380 Copyright 2026 AlmaLinux OS 0 1 Moderate

attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fix(es): * attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libattr-devel-2.6.0-1.el10_2.s390x.rpm 6b1e9056caca4a37736e166787032b779849276869ecd227b461eea2933eaf75 ALSA-2026:59972 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.8.s390x.rpm 8479f2ed77bc64e1e8896b4c6d0f7a9b6cda3cd2128bc000cc33a36ceb8d3279 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.8.s390x.rpm 8a243e2bf3e4840bd1397d042f07094710c18e01696578726dcafb5fef1bb73a ALSA-2026:59997 Copyright 2026 AlmaLinux OS 0 1 Moderate

polkit security update

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fix(es): * polkit: Polkit: Denial of Service via unbounded input processing through standard input (CVE-2026-4897) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default polkit-docs-125-4.el10_2.1.noarch.rpm 305e34938bffb0db90d5a6ec9e239162450d0c39bf641873dcc7b0598bf2930e polkit-devel-125-4.el10_2.1.s390x.rpm f0681d633c0d93f93f00b8fea8085a3a77319152db142bd67e3b8ef800ddc768 ALSA-2026:60004 Copyright 2026 AlmaLinux OS 0 1 Low

httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default httpd-filesystem-2.4.63-13.el10_2.6.noarch.rpm 2d887c9658de80e5f018347a72ff0e89acbb079bbd7a748b53ca6594ecae718a mod_lua-2.4.63-13.el10_2.6.s390x.rpm 3de93bc12fac15f96361bc65db139748757d1c6582ed9a6e45f3aee5a0454d13 mod_proxy_html-2.4.63-13.el10_2.6.s390x.rpm 4c6b081f1c5d732150b5a0f26d1130820b69868ecbd7a46f0596066dabd7cb32 httpd-manual-2.4.63-13.el10_2.6.noarch.rpm 69567bdd1024b64882fe35313f7a8f2549cab4b9a577ea66ad31608c30f9ff84 httpd-tools-2.4.63-13.el10_2.6.s390x.rpm 9ac8c89112dba718f8d21c4d5d19ad6d3528e49c053c9d40e25ecfd74f3a7041 mod_session-2.4.63-13.el10_2.6.s390x.rpm a7e5db8fc27829508350ffc14933ad4dba2aa353872aa57a633f86edfcf3d61c httpd-devel-2.4.63-13.el10_2.6.s390x.rpm addde1efd274694422ec49c53c3b5d170d88f8f8c75b3216d5fe72e2fe4be3e1 mod_ssl-2.4.63-13.el10_2.6.s390x.rpm b5be3d0afd7dbb7c0a3a2bbd5d8630277abb9c9de876a61dd7c29dafb8b327aa mod_ldap-2.4.63-13.el10_2.6.s390x.rpm c94fb75d62ff2b37e0467c121b9281357fe44bb81fa0fe0ff0213f7ccbf78872 httpd-core-2.4.63-13.el10_2.6.s390x.rpm cde4548a5236aac16753a511b2b927f799c1671efd17ef411af5147ccff58193 httpd-2.4.63-13.el10_2.6.s390x.rpm f9d03c9286661494635f872ac3e79578cb0f5194818aaa460902dc6e323e4bb2 ALSA-2026:60306 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.7+1 [almalinux-10.2.z] (JIRA:AlmaLinux-246423) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default golang-misc-1.26.7-1.el10_2.alma.1.noarch.rpm 1923dd6592518a5d2f4e4eef0ff7f7bf3b611a49230e03cd40caa092e84f83c5 golang-tests-1.26.7-1.el10_2.alma.1.noarch.rpm 2cd7fa5d945a940c336d1817cb06f166edf8869a955ca3e7b5638d0f77886aea golang-docs-1.26.7-1.el10_2.alma.1.noarch.rpm 36167694db02b79aff2148f3934c8d4bd287c3615d93d5a40f6356796ff2e299 go-toolset-1.26.7-1.el10_2.alma.1.s390x.rpm 868eaddc7c63ea2ee442acdd1d9d1357653eb0e14cd49cc67e5412f8c8b11dec golang-1.26.7-1.el10_2.alma.1.s390x.rpm af29fe51ef0af06896b6559ffa767b13681dad166d712f0899c5ba1d17ee9805 golang-bin-1.26.7-1.el10_2.alma.1.s390x.rpm bf9fe3ae49bed7c8e1942f6ead4039aca35eb3a1fcc296dd8c790833952a6b7c golang-race-1.26.7-1.el10_2.alma.1.s390x.rpm cceb0038389f262b947d15ece6247745efdbf0a25f24845526ff187d60a0a92a golang-src-1.26.7-1.el10_2.alma.1.noarch.rpm db81e8b2dcb9cce76b60048edd375ec23e8fb6a055cbceb28ee21bb48274cc6e ALSA-2026:60394 Copyright 2026 AlmaLinux OS 0 1 Moderate

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.3.s390x.rpm 76a964798e3cc4def7abdddfe1769ac1d9b1eb8a7cba2b3d68bcecb6200a5d14 ALSA-2026:61241 Copyright 2026 AlmaLinux OS 0 1 Moderate

pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: RAOP RTSP NULL Deref (CVE-2026-14324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default pipewire-pulseaudio-1.4.11-1.el10_2.1.s390x.rpm 06cdac501597a7ac9efe94db6fda17759c004b592fa5d03fafc447ba7148c479 pipewire-jack-audio-connection-kit-devel-1.4.11-1.el10_2.1.s390x.rpm 2a280eb9b054dfc3013ee5e744e350e1d69a2ddabe43bb1e142b8bd6f78052bc pipewire-module-x11-1.4.11-1.el10_2.1.s390x.rpm 48b3bea1be256517bff5ba3f058f01d89737e310cc26861e371ba7f4dc047480 pipewire-libs-1.4.11-1.el10_2.1.s390x.rpm 5ed3673173c36f2d09a0dbfeaa6676773499dbde074a5b4da4b25a1eae0255b4 pipewire-alsa-1.4.11-1.el10_2.1.s390x.rpm 84f30dfc8877038a9d050833987006c09f54d45e71eedecf3ecdb378f866eb8c pipewire-gstreamer-1.4.11-1.el10_2.1.s390x.rpm a86860ef1c5fbc3280068e5bff62e099d8251bca5658e84dc1dfe6b7ab50c23c pipewire-devel-1.4.11-1.el10_2.1.s390x.rpm aac5a03cb38f1a0d6b23b5306f98102f0e63c16fd2653fbc8b228b2126af2079 pipewire-jack-audio-connection-kit-1.4.11-1.el10_2.1.s390x.rpm aae118d534ac0a7b660234d1271ce493908af3ba404aa18cc41c6062c753f6bb pipewire-jack-audio-connection-kit-libs-1.4.11-1.el10_2.1.s390x.rpm b5e469be2f764523cadd077e75a54e2a4714f79d526c0227e33a786864a67a88 pipewire-1.4.11-1.el10_2.1.s390x.rpm c3dc4996ff1ad706ede7e987115a83e2990d93005af65319860b551b8b3dc60a ALSA-2026:61376 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs-npm-10.9.8-1.22.23.2.1.el10_2.s390x.rpm 642c824b0bb74eb8463c7599b73e07de899308a3f10b0b0555e80409f334ea6b nodejs-full-i18n-22.23.2-1.el10_2.s390x.rpm 82d6ea842100dd8161614f2fb563d2fbcd6141927ffa45742b1fb73e0685e99a nodejs-libs-22.23.2-1.el10_2.s390x.rpm a5e238dcb4665a9fa735d94ad45a8b9f227acbb0776b893eb15528053a0e7eb8 nodejs-docs-22.23.2-1.el10_2.noarch.rpm c9f5cc58213b857b0d4326ca1f1f1fd1cda4ecc64776646fcfb759c191300495 nodejs-devel-22.23.2-1.el10_2.s390x.rpm d8feedbb394f6e361aadfb89f55f3cc8f960a005728962078a0c8f5484404df6 nodejs-22.23.2-1.el10_2.s390x.rpm e37add652359609138181e70276546c2226bb04a1332beaf5a951f1f892d251c ALSA-2026:61377 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-220543) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs24-libs-24.19.0-1.el10_2.s390x.rpm 1248a1b8b786863bf6c09618c78415c65314685217051d2e8facc7fbda1eca32 nodejs24-devel-24.19.0-1.el10_2.s390x.rpm 585335c8af7c83eca6a0a0ec3cedbcfd6d065e26edc71a3ec31866be1b3f9dac nodejs24-full-i18n-24.19.0-1.el10_2.s390x.rpm 7e3a4bb4aecc6e9312dd3b31984ad40100cb6f60c68afce24f2d3c4a9d624c73 nodejs24-24.19.0-1.el10_2.s390x.rpm 9ecc7a97856fe38f8abc9834516672e82e2b5d8e5c9d2263667f0a7c66686a68 nodejs24-npm-11.17.0-1.24.19.0.1.el10_2.noarch.rpm afa3166dc5e00f1d8df5f85611a54b62dab8bd37e034efff70b640de418fbf6d nodejs24-docs-24.19.0-1.el10_2.noarch.rpm d3d3383f8710db59beae06da2be66237d330acc7d4a195352659f94e3a452149 ALSA-2026:61378 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297) * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301) * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288) * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291) * FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296) * FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304) * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298) * FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242) * FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241) * FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652) * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194) * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633) * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default freerdp-libs-3.10.3-12.el10_2.10.s390x.rpm 0b7b0e4b2676af26f12b86fbbb60b03a58f8ffb771e7588c6b86e0685fd0ab23 libwinpr-3.10.3-12.el10_2.10.s390x.rpm 3ce7159874118d9467b2dbff8495b8ad9481cc48234307dd5bdb8eeecd6be29b freerdp-3.10.3-12.el10_2.10.s390x.rpm 7e96a77afe77526475cb7ccd71fdf44cedfab8c93008be5d0fefea017bfed434 ALSA-2026:61680 Copyright 2026 AlmaLinux OS 0 1 Important

iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (CVE-2026-71217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default iperf3-3.17.1-6.el10_2.1.s390x.rpm d269a8306d6c6abc23a519e1a336f287ab1a0600b93c1412a32b1042fc698b26 ALSA-2026:61887 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454) * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) * kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418) * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) * kernel: ceph: give up on paths longer than PATH_MAX (CVE-2024-53685) * kernel: ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419) * kernel: ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408) Bug Fix(es) and Enhancement(s): * AlmaLinux 10: s390: Revert support for DCACHE_WORD_ACCESS [almalinux-10.2.z] (JIRA:AlmaLinux-188180) * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-10.2.z] (JIRA:AlmaLinux-193043) * ss core dumped when there is an SCTP session [almalinux-10.2.z] (JIRA:AlmaLinux-212393) * [AlmaLinux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-218627) * AlmaLinux10.0 - s390/pfault: Fix virtual vs physical address confusion [almalinux-10.2.z] (JIRA:AlmaLinux-222507) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-zfcpdump-devel-matched-6.12.0-211.50.1.el10_2.s390x.rpm 094aa0c3d2decd6a5e774ec54897972c099ea49b4bbedb982a9561c6b70ec13d python3-perf-6.12.0-211.50.1.el10_2.s390x.rpm 0e4b4d3b35b92537b863fd45fcc5ed6d0f226191211e67d2df903831f6bae3b5 perf-6.12.0-211.50.1.el10_2.s390x.rpm 1f6efb74862ea53fe5b51a62b30e593852ad2fdf0cc425259342558d913e34ba rv-6.12.0-211.50.1.el10_2.s390x.rpm 1fb982e1ffa0c32c57e4698e7841b25a43fb7073cd63bdd95e9a892fe67fbbf1 rtla-6.12.0-211.50.1.el10_2.s390x.rpm 591bca0ba2739d6c6c4ea02f2858aa4d30bcb3d334a30d0a8aca9072a626af39 kernel-zfcpdump-devel-6.12.0-211.50.1.el10_2.s390x.rpm 786b2560f266ff1c3de04eabe4e3cf89d76aa9e5db3e0b1fe97e3fba9e65aa20 kernel-devel-6.12.0-211.50.1.el10_2.s390x.rpm 864e022ba94fb1475009090f4834a08c36b41388575148e72b43dae2e96b3988 kernel-debug-devel-6.12.0-211.50.1.el10_2.s390x.rpm ab315174f5462a7ca0d5dad1e3abd3d1d8c05ef39fed342c9b3362311b173d54 kernel-devel-matched-6.12.0-211.50.1.el10_2.s390x.rpm b059aa41c833260bc7ded1adaadab8c55e2cf33d045011c5e0439c8ae6b2932d kernel-debug-devel-matched-6.12.0-211.50.1.el10_2.s390x.rpm d311d8d6a045c3d66e5b4bf476cdc89d30b06a6279a10ba8b8d7a4b26acbb40f kernel-doc-6.12.0-211.50.1.el10_2.noarch.rpm eb72790272f507b41af75641e41929887bd00929b6c72f25db62b73df90181d8 kernel-headers-6.12.0-211.50.1.el10_2.s390x.rpm fe55f1fd64c16ba43b8d3d3798a135b8da9ad0836e906ea0daef2909ae5a7dc4 ALSA-2026:62142 Copyright 2026 AlmaLinux OS 0 1 Moderate

wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fix(es): * wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption (CVE-2026-58471) * wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute (CVE-2026-58472) Bug Fix(es) and Enhancement(s): * wget async unsafe code in signal handler context [almalinux-10.2.z] (JIRA:AlmaLinux-220498) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default wget-1.24.5-8.el10_2.s390x.rpm 57ab54155e7daa3b9de13f1593104750c1145256ba14d9f847b7e6086880296f ALSA-2026:62578 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default go-fdo-server-rendezvous-1.0.1-2.el10_2.4.noarch.rpm 0211aa299091abf4cfdbbe76f87520827c571e8db4a3770fdd0349a146e1d8c0 go-fdo-server-manufacturer-1.0.1-2.el10_2.4.noarch.rpm 84881985faeb5b98d8a5aa9bcdf5c151015a891734684a6dfae3071d412b6e96 go-fdo-server-owner-1.0.1-2.el10_2.4.noarch.rpm df71d99ab263c33a04002cecffd3691380cb99ec2d02cac000f9c35a6af35a83 ALSA-2026:62614 Copyright 2026 AlmaLinux OS 0 1 Important

php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.3.33 for CVE-2026-17543 and CVE-2026-7260 in 10.2.z (JIRA:AlmaLinux-223946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default php-gd-8.3.33-1.el10_2.s390x.rpm 0499df87fd624fbbacc5f65355007ec48f530c19311c53662a2d8638e796ce14 php-pdo-8.3.33-1.el10_2.s390x.rpm 06df8846db03852115eea1af1130a70e9ec91689c4e2d5cfaed222925939fb60 php-cli-8.3.33-1.el10_2.s390x.rpm 186d19fe4807ab75dfd303dbf4e13b99696386bc08fede8f1e751e32f337f11c php-process-8.3.33-1.el10_2.s390x.rpm 1a5ce8b7f84c2c393f39ab6fe30b71b4db1a1fe3174ee6aa3ed01f9e08ffd811 php-xml-8.3.33-1.el10_2.s390x.rpm 1a80806a8e53df2e794fad6a80cd9fbd2dca22a6a28fdd45b4742c55e52b8e4b php-ldap-8.3.33-1.el10_2.s390x.rpm 2222f6336a534b1d8136c8611bf73e18d3f0c9406614cb10624c8dc89e97cbb9 php-embedded-8.3.33-1.el10_2.s390x.rpm 2508e332b69bb4d4cee66e1e35357ebc7ac0e4ffc7670c67bfd7ac80a2fff538 php-bcmath-8.3.33-1.el10_2.s390x.rpm 4cb6eedfc4e9f91ca5dcfd952e7e632b3c02991dcca675ddcfdb03f4c1c000f5 php-gmp-8.3.33-1.el10_2.s390x.rpm 6328d2236397fca139d6bf0093a7fc9e1d4416192d72ef75d87b2bb40df60bf9 php-common-8.3.33-1.el10_2.s390x.rpm 6457902f2327bc59c2eb5a0ca6e385ad05b3dcbfdd5c636f85b12c3005c65640 php-ffi-8.3.33-1.el10_2.s390x.rpm 689850f67c2546c3130ef8edc06b9a77b1c50ebbf1de92d4c6784a65576ef0b1 php-dba-8.3.33-1.el10_2.s390x.rpm 76ba1f5c528cba6a1a87fe690add5d2fa1db4d565c080db91600229da78357f9 php-devel-8.3.33-1.el10_2.s390x.rpm 7e626e804a180437131508ce93266d411bbfa973439261547a4c2e02b6dc848c php-odbc-8.3.33-1.el10_2.s390x.rpm 8169cd9a5a6a89c3f1da7a46448454fcf3927fa4d40c0d072a45d1d2515a8c58 php-enchant-8.3.33-1.el10_2.s390x.rpm 9819a80deba173ee6ef6ee09c204cd6296a80ef7515180cff71a6eef7509dba7 php-mysqlnd-8.3.33-1.el10_2.s390x.rpm a9859c15fb1f0ad46ac82944d1f3237e2fec5dd4b671c214d11cc7a0dc22fd48 php-snmp-8.3.33-1.el10_2.s390x.rpm adab4c18b1a57895dc033db84a5dc9e2e2e572787bb990b649da3859213950da php-intl-8.3.33-1.el10_2.s390x.rpm b05e78de398425da5d6166a60f0a9e0571fa10788626831e27a1e644feec60c5 php-dbg-8.3.33-1.el10_2.s390x.rpm ccf4107fbf64c8cd36f0095178df65b7108246fc8dc38d49c98d4e4c480cf390 php-8.3.33-1.el10_2.s390x.rpm d024c39af249e4734ee158678b898cbfa6661f3fbe95d6ab40063a5c7920dcb9 php-fpm-8.3.33-1.el10_2.s390x.rpm d33816a631bc24256c54c7be746ba37e2dc1b5bbb9c46dc8d376fbdb960021ea php-pgsql-8.3.33-1.el10_2.s390x.rpm d6cc12ec812efef9ce1e596fdacf2677280c23ce42f200d67d6d5da18ca4dc95 php-opcache-8.3.33-1.el10_2.s390x.rpm dd2a4703aa3fed0484f5afec30dbdb37c6dde9f3c754fde7dd3b5f5072574346 php-mbstring-8.3.33-1.el10_2.s390x.rpm ddd0f11e80af2d79012dc18a518ed01c23fe0485376cbab4a9d5c894d22a858a php-soap-8.3.33-1.el10_2.s390x.rpm e6626dee697676b3a013923a3913fc1b50a4f6384311f4e16750cf2f4371b48e ALSA-2026:62631 Copyright 2026 AlmaLinux OS 0 1 Important

golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ipp-usb-0.9.27-7.el10_2.3.s390x.rpm c80787f763462cdcd9daee3fc2f4880856b27caba56435f667f828e1bd1baa0f ALSA-2026:63022 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default grafana-selinux-10.2.6-28.el10_2.5.s390x.rpm 1b3bf0f55eeeafe18b361a56f713909074402c490822d28268b1d795217c8b15 grafana-10.2.6-28.el10_2.5.s390x.rpm a88a2cb85f2fc7d07fe5d73b3e309a3f4ddf6e061c74ca2158f948fdfc1359e6 ALSA-2026:63119 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default grafana-pcp-5.3.0-8.el10_2.1.s390x.rpm 0c62413d1bfe1afbac1dac3e3fc3f59e4dbd22bbc935a3c1b2c9371051c8e849 ALSA-2026:63128 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073) * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808) * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824) * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145) * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-doc-6.12.0-211.51.1.el10_2.noarch.rpm 2e6e4a832d51991724a1696b6c38060e1abc354ca0d461f7a161f2499a8db46f python3-perf-6.12.0-211.51.1.el10_2.s390x.rpm 39c363207c3f6ca29f06ddf571d019ae1c4486b011ac87d42b4388f9ef96bac3 kernel-headers-6.12.0-211.51.1.el10_2.s390x.rpm 3b2ca514542947d5fcfd40c3d434124d7b286500001d3833d65af8224eff265b rtla-6.12.0-211.51.1.el10_2.s390x.rpm 684fb8e2038ae53f6ee678eadcbdbac4ff84621338200fa00e5f92d11ffe6d63 kernel-devel-matched-6.12.0-211.51.1.el10_2.s390x.rpm ac2ad55179b881361a1d458eabff5f738ca7d2668a2eb277e16505f854e33a3f kernel-zfcpdump-devel-matched-6.12.0-211.51.1.el10_2.s390x.rpm adc9de31b748bf080a5ea7a9114f4a161a72e9b59a3bd00eb8faff43cd6dcc07 kernel-devel-6.12.0-211.51.1.el10_2.s390x.rpm be79ab63b9e270044642b1f52612cb120f27689ce51a41b028d8aedebabc3f68 kernel-debug-devel-matched-6.12.0-211.51.1.el10_2.s390x.rpm c8334deed8ef5e241603724ca570fe081d2968eeb212b8e70dcf711c9c62617e kernel-debug-devel-6.12.0-211.51.1.el10_2.s390x.rpm d5a5abe9f5ef42367cbd74ed51c0a9e286efaec38a3a016037d9892ad7a6dad7 rv-6.12.0-211.51.1.el10_2.s390x.rpm efe1e6d84d3b419af07b0db0b548dab1ab02d59929775c1a848459d9e2b92238 kernel-zfcpdump-devel-6.12.0-211.51.1.el10_2.s390x.rpm f4e71d9074a517c6628e9cd232407f6915b3374a3812658ca7a247dbab413c4f perf-6.12.0-211.51.1.el10_2.s390x.rpm fb79a4b515d0939c683d42cac0c9daa46342a95df799bb56b459b8651ec57eaf ALSA-2026:63332 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default buildah-tests-1.43.1-5.el10_2.s390x.rpm 025f72ff1b0ea6d058a7685eb0c023c438d1c6f5c5efdc2053bbe8872418a8d0 buildah-1.43.1-5.el10_2.s390x.rpm eb4a5457fe2bbeb4b14aa6ce93a7b1100ad4aafaf831917834518f17bcd4937f ALSA-2026:64777 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default buildah-1.43.1-6.el10_2.s390x.rpm 04cec69e161fd32a243f46955adc810d14db280b15235cb87adc4337d7501f37 buildah-tests-1.43.1-6.el10_2.s390x.rpm 26a2917fe7bc8ae255c3b4809a71a9573c61b92338a11dafff8508be2add782d ALSA-2026:64785 Copyright 2026 AlmaLinux OS 0 1 Critical

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) * 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701) Bug Fix(es) and Enhancement(s): * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-10.2.z] (JIRA:AlmaLinux-244470) * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-10.2.z] (JIRA:AlmaLinux-248770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-lib389-3.2.0-10.el10_2.noarch.rpm 307a5e67b7efa8839b6753d9a1070e7d39a56a06e6b646f7e9121a21f6a89d52 389-ds-base-libs-3.2.0-10.el10_2.s390x.rpm 38812e358b752c3df3d5643d2d28fac915e5bec1fa4dfc0ccb8cc96245c3722e 389-ds-base-3.2.0-10.el10_2.s390x.rpm 623853bed782ba89a7992feedd9b611269ffd6bffbb80d0784188d3ebb37d480 389-ds-base-snmp-3.2.0-10.el10_2.s390x.rpm 976a2abcd46b24609c01127574a7bea6a351d3e3952261899ba17c4c12f249fd ALSA-2026:64787 Copyright 2026 AlmaLinux OS 0 1 Moderate

xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fix(es): * xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default xz-devel-5.6.2-4.el10_2.1.s390x.rpm 597197152263c1269fd038d4c2aa4d733b52eaa2fb5df36c1f41160d516fb43d xz-lzma-compat-5.6.2-4.el10_2.1.s390x.rpm 75ecbf00a0ad9e195f26abd237a6b212016cf59d4cbc86ff877555fc506f9c69 ALSA-2026:64788 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.7.s390x.rpm 0849658a64898db2be7a2402037b2791d30382a74a43a0c7ae58fcd1564d3b5a ALSA-2026:64795 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-cryptography security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building (CVE-2026-69249) * python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees (CVE-2026-69248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3.14-cryptography-45.0.4-4.el10_2.5.s390x.rpm af32dbd7cadb9a07a2dae959812e7c82076ade25b9087ecb9aa47c09fc825470 ALSA-2026:64796 Copyright 2026 AlmaLinux OS 0 1 Important

valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373) * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639) * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684) Bug Fix(es) and Enhancement(s): * [Tracker] Rebase valkey to 8.0.10 (JIRA:AlmaLinux-216776) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default valkey-devel-8.0.11-1.el10_2.s390x.rpm 078c8b6b531f1d8828827120c2bdf874cffa4a4469165a8feed9d516d884ed27 valkey-8.0.11-1.el10_2.s390x.rpm 758b7c5a1a7f234e2570718bdc71a045c8fac80b37c4e39c36fd11b5c3399edb ALSA-2026:64799 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glib2-devel-2.80.4-12.el10_2.22.s390x.rpm 2e9d408c555f06b92fd0b229f48d60dc0e94d5673c28dcf274c8e9f59b1521db glib2-tests-2.80.4-12.el10_2.22.s390x.rpm bcbf31aad7c696d701a0a21cec6a6c5804e7db19c447be52206938f2bb93b35e ALSA-2026:64810 Copyright 2026 AlmaLinux OS 0 1 Moderate

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking (CVE-2026-50219) * expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow (CVE-2026-56132) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.3.s390x.rpm 6b3d51bafa39ae6b6b942335ff64212fc460499d7e9376c99fcdacc0a309b453 ALSA-2026:64818 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default skopeo-1.22.2-5.el10_2.s390x.rpm 0c8a7b99ba2cf96b3536c969e0f384f21085bf3110c6aeac4661ff6b1497336e skopeo-tests-1.22.2-5.el10_2.s390x.rpm 4dd0b94bcc850887563f6e151dce6078e3e55d88fa1418afeb5d8310c72d88f1 ALSA-2026:65116 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default opentelemetry-collector-0.152.1-2.el10_2.s390x.rpm bc2ea67ffae96346d7578f41fc83109682778643592e7d188557f2f956b71381 ALSA-2026:65159 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default thunderbird-140.14.0-1.el10_2.alma.1.s390x.rpm 734d52e119d24972df15345ae1901db36de068dc73b1f4af2c0273e2e428a038 ALSA-2026:65162 Copyright 2026 AlmaLinux OS 0 1 Important

gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See <https://access.AlmaLinux.com/support/policy/gpsd-support> for more details. Security Fix(es): * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-gpsd-3.26.1-3.el10_2.2.s390x.rpm 0f94161c741f5a5075cbc04ba6fca4f87a9833f2d1cda2cd22135b377aea4c3c gpsd-3.26.1-3.el10_2.2.s390x.rpm 169a353c350e3a3407c36cef61304fe95e11ca6edde2405aaeb18b3a67e83111 gpsd-clients-3.26.1-3.el10_2.2.s390x.rpm 6c6bb13eef62d8dc85a1437e0942375ceb80bb2e3c29ab02c01083ea93950921 ALSA-2026:65334 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182) * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947) * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944) * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946) * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117) * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037) * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113) * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042) * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051) * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255) * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515) * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307) * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193) * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) Bug Fix(es) and Enhancement(s): * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [almalinux-10.2.z] (JIRA:AlmaLinux-193027) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rtla-6.12.0-211.53.1.el10_2.s390x.rpm 0a76f48ccefe46500dd263f6d1b8c8ca1ae71a2225375cb1ff109cc8fac6a40d kernel-zfcpdump-devel-6.12.0-211.53.1.el10_2.s390x.rpm 2edfaf641587fc1b46323152a50f868ec8b37105960606a25fa630e2deb8bca6 perf-6.12.0-211.53.1.el10_2.s390x.rpm 36319b95052658af10c3f55978c85420b1a6c1123f452b47f256106544d074ac kernel-headers-6.12.0-211.53.1.el10_2.s390x.rpm 3eca7583adb491f2c274f338dcf9eb3290a9ea0e47be1d740b2e39fa54535af7 kernel-zfcpdump-devel-matched-6.12.0-211.53.1.el10_2.s390x.rpm 5544c82aac7b40ee31dfdd699d3fc01cc84d0369f4c8d1cf3584ae9659b8eb17 kernel-devel-6.12.0-211.53.1.el10_2.s390x.rpm 5a563baf091e3015e12bcf4025f4c1dd1c53959eef60509db0b366f952c0bc08 kernel-doc-6.12.0-211.53.1.el10_2.noarch.rpm 695853f20bc714f3bd01366c739f95984ef9c54dd00ee1004b69189f11177cf7 kernel-debug-devel-6.12.0-211.53.1.el10_2.s390x.rpm 791796b615033d429e8999cea52a65373d62994972aa65442acf78d47d3b1d22 rv-6.12.0-211.53.1.el10_2.s390x.rpm 92127efacaf58096ef99fc790791626c892c3d6f2301e0accb6218b282669d85 kernel-debug-devel-matched-6.12.0-211.53.1.el10_2.s390x.rpm afde9464604eda6ab53da1881154098d5797c0b025cdc5b896205b3801c01098 python3-perf-6.12.0-211.53.1.el10_2.s390x.rpm ccc5a36827a45890dd4236a6d01bcef9f5740908c27105b91abeb0dd4c9358ff kernel-devel-matched-6.12.0-211.53.1.el10_2.s390x.rpm f75fd54c33a145de5ecfa93c97c47fef34fa92c6d9037cc7957696c7bf48ae3a ALSA-2026:65816 Copyright 2026 AlmaLinux OS 0 1 Important

qt6-qt5compat security update

Qt6 - Qt 5 Compatibility Libraries. Security Fix(es): * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default qt6-qt5compat-devel-6.10.1-1.el10_2.1.s390x.rpm 319e053b637c164bb2cfc27915d2db49dc8b8ec4db706a56437504c3ae3c7535 qt6-qt5compat-6.10.1-1.el10_2.1.s390x.rpm 676665a6e59e949579d427fad39983bf2584ab1dcebf1f45dcda6ec9f3c20a65 ALSA-2026:65887 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-19546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.4.s390x.rpm 9e7e9e1fe0ff84f514df9366aeab9a126f2a9bdc10b86f317c029c30d01b220a ALSA-2026:65899 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile. Security Fix(es): * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postgis-upgrade-3.5.3-4.el10_2.1.s390x.rpm 116d09124ce22059877ddf3dd360b5b85ada5e3b8700263fff7e0c7c1b41fbe8 postgis-client-3.5.3-4.el10_2.1.s390x.rpm 26d2554ef25ed684e6d7fa77e7f7a23ba56c1a4d6bb2baf14ac2c64ff0494b28 postgis-3.5.3-4.el10_2.1.s390x.rpm 30f43b3e2c72ee0130bfe020f969b094b2c1339cd107f9c1dd182d9045c48067 postgis-docs-3.5.3-4.el10_2.1.s390x.rpm be01e55e121a9099c09e9d961b4215513dadf5596e9cc6febc3fcf3a89074158 postgis-utils-3.5.3-4.el10_2.1.s390x.rpm e8813824e7983b660c24fb4f45db8da8bf00d5fe68d328aaf77c1ff2fc62b6a5 ALSA-2026:66336 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420) * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859) * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892) * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857) * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076) * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072) * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078) * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default vim-common-9.1.083-9.el10_2.20.s390x.rpm 5bf800f00eb05f4c17288776dfba755420173b339f359dd89c5b6350faa2f68e xxd-9.1.083-9.el10_2.20.s390x.rpm 7ce5099f24bc3bc57f0700d929e73066eb22a6651d8b8d8ff0b99eb8c0cae334 vim-X11-9.1.083-9.el10_2.20.s390x.rpm cc200d7bf72b9b16b5792f71aa9393acb68aa7cf7caf2eadab1e5c1e08a1e8eb vim-enhanced-9.1.083-9.el10_2.20.s390x.rpm f19cea9135b45e04fcce2b48398d01534766dd4a97d4c8ca4724bf6a5d8bcf0b ALSA-2026:66349 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway (CVE-2026-55193) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libwinpr-3.10.3-12.el10_2.11.s390x.rpm 106b6b9a95bf83a669e150a0881538508629674725789a7725e278610ac0ce21 freerdp-libs-3.10.3-12.el10_2.11.s390x.rpm 8ecdd0df07725cc4d442afa711290ff0453c809bbeb366ad0c481fdb220c8cfd freerdp-3.10.3-12.el10_2.11.s390x.rpm 9277c965290ca80d239340dd37914796729f1dd9f675a162a4846a81e0a95fb7 ALSA-2026:66355 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.54.1.el10_2.s390x.rpm 189618fb619303b65d5d12c677a055989c604411a696d37d18dc4a7219410e71 kernel-devel-matched-6.12.0-211.54.1.el10_2.s390x.rpm 3c0289129620729a71337392fccfaca73e48fc87d9f519e24e5d2bafdda6b734 kernel-devel-6.12.0-211.54.1.el10_2.s390x.rpm 4a9cf165f2a1c55d49627dc5fa17560e81359a73d1121548fd68036cac1189ad kernel-doc-6.12.0-211.54.1.el10_2.noarch.rpm 7211c764f3e75c59e014b6650c3e0ec6f19553aef6819b3853a7c4b27ea7a704 perf-6.12.0-211.54.1.el10_2.s390x.rpm 85f00424e9699fc73194dbb632ba1429b3a748e754c222278aa807f92f64a3ab kernel-zfcpdump-devel-matched-6.12.0-211.54.1.el10_2.s390x.rpm 9b726e5ca1885bd2299e72aa188a2098f2f3df3cd1d4dd8a6a0ad27ba2c0a01e kernel-debug-devel-matched-6.12.0-211.54.1.el10_2.s390x.rpm a20a3520aeef420405c5ec31379f5b9673fb521f8092cfbf4da1565541ffb170 python3-perf-6.12.0-211.54.1.el10_2.s390x.rpm ba8549c57c302cd5ae952b5ccf08489df31bb524e559a9c322c8b42a8740da37 kernel-headers-6.12.0-211.54.1.el10_2.s390x.rpm bc24c9b7e61e7fe6c5548bb29fa6a8ffa97809a48bceb5ffc45e71b08d3d87f2 kernel-zfcpdump-devel-6.12.0-211.54.1.el10_2.s390x.rpm d5d4198880c13ecca171e835e0b963d502f4ee29f1e72a299047d8bfa5c992a1 rtla-6.12.0-211.54.1.el10_2.s390x.rpm e14b107bb2f250975e686e7c273d3c16e2b96b27389245eea4fb6b6e9e3835d8 rv-6.12.0-211.54.1.el10_2.s390x.rpm f5f8c0fb3ba7a067d72cd66f8b4835f5121b56d876811079721ce2462f6a844a ALSA-2026:66392 Copyright 2026 AlmaLinux OS 0 1 Moderate

apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fix(es): * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501) * apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506) * apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327) * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default apr-util-ldap-1.6.3-23.el10_2.1.s390x.rpm 05befed63f1c5d3e8048abe418ac3688ec9e6cc0895a715457ff4700844caeea apr-util-1.6.3-23.el10_2.1.s390x.rpm 0dd566fb819bd924b6c0e5cd5d370a9158b8478d569cb043f67945c9e25544d8 apr-util-odbc-1.6.3-23.el10_2.1.s390x.rpm 74fd1c38b63d80fbc6fab60ef4ee01351416a028b095c640802749dc73b5da55 apr-util-mysql-1.6.3-23.el10_2.1.s390x.rpm 778c3c737b969751d86fc2f0b9d0c1fffc44e41ea194348adb62ac40adeaca02 apr-util-openssl-1.6.3-23.el10_2.1.s390x.rpm 7813b678cf8d727a32ea616ebbbed81f992f8bfd30f98fa17f90311ceef95490 apr-util-lmdb-1.6.3-23.el10_2.1.s390x.rpm 7d03a94981a29117779935b356c48de5e5e28010535e21b88c03e3cca4385ed5 apr-util-devel-1.6.3-23.el10_2.1.s390x.rpm 9e2279e25f8295c73dde8960ad239909505d458f29d98b0852d500586530a021 apr-util-pgsql-1.6.3-23.el10_2.1.s390x.rpm bdf549ddaeb800db75344b23dbabb0e7e497c87d428cb50a3c5f7193dc5b07ac apr-util-sqlite-1.6.3-23.el10_2.1.s390x.rpm e58bbf22cc9185f30fd7b3f70b95fc345a360960618f8deb3d5a51ffdfc74a57 ALSA-2026:66432 Copyright 2026 AlmaLinux OS 0 1 Important

osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default osbuild-composer-165.1-5.el10_2.alma.1.s390x.rpm 606e90085c81793eaade1cf901866058a9cd57d0f2f270b63bb4226ab30bd9bb osbuild-composer-core-165.1-5.el10_2.alma.1.s390x.rpm a228acfc655264dcb1c13620f0495580cfcc4da04d02a17765374e3dc527c073 osbuild-composer-worker-165.1-5.el10_2.alma.1.s390x.rpm f089b0207f426cc99f87a7e8013af313066e73333300acde754fdf83f0ba9471 ALSA-2026:66460 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header (CVE-2026-85150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gstreamer1-plugins-base-tools-1.26.7-2.el10_2.2.s390x.rpm 15211ff5f1ca54b096bb1a50955d6640f86c5949eb09225b114c8968a3843a01 gstreamer1-plugins-base-devel-1.26.7-2.el10_2.2.s390x.rpm 2051380e16ccbedcc8b4005f0c5f89e9398e57bc316740473eb826137ce4c417 gstreamer1-plugins-base-1.26.7-2.el10_2.2.s390x.rpm fe7fc7fc728816dd0701cbf23236ed1640f83da20280b2e26e015633c62c8da3 ALSA-2026:67129 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default firefox-140.15.0-1.el10_2.s390x.rpm 96eea959fb29c3f3b048acc25eb00c913e67959d34c3b8a812217419bd209100 ALSA-2026:67147 Copyright 2026 AlmaLinux OS 0 1 Important

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853) * tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-tornado-6.5.8-0.el10_2.1.s390x.rpm db63f918b298172aafb5864b8510c28c1f1b7c170dd19669186d146b17c1bdc9 ALSA-2026:67154 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456) * openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798) * openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072) * openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076) * openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457) * openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874) * openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073) * openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074) * openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075) Bug Fix(es) and Enhancement(s): * openssl: HollowByte remote memory-exhaustion DoS fix may be missing [AlmaLinux 10.2.z] (JIRA:AlmaLinux-212362) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssl-devel-3.5.8-1.el10_2.alma.1.s390x.rpm ec31106fae2e1f7b654a4825af72b48d3bc982807cce39d96cf414a898c32b7f openssl-perl-3.5.8-1.el10_2.alma.1.s390x.rpm ff13daad1463e955cb598b8947847d66b13357150e4df7154857a820197da08f ALSA-2026:67156 Copyright 2026 AlmaLinux OS 0 1 Moderate

perl security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es): * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-I18N-LangTags-0.45-515.el10_2.noarch.rpm 069d8a8848580110635885e2c251c7423daaed882265d3fe5c2f4465f09dd325 perl-vmsish-1.04-515.el10_2.noarch.rpm 114d1690b48e176ae300aa8758eb208c31d1b490b24d8ee9e87ba6f5d21cc209 perl-User-pwent-1.05-515.el10_2.noarch.rpm 116856c6ec904a94c4b9e26465c0f24d542f6ac279c1065c986de45686011ec0 perl-Search-Dict-1.07-515.el10_2.noarch.rpm 1a7a937662f78d99a2dc924c7f668c42980aca692656cf16a5a5d1e21e6a4315 perl-AutoLoader-5.74-515.el10_2.noarch.rpm 1b540d06f1b3584f80113b6c546b8864cd617dffbb8513045b03d7132e826012 perl-File-Basename-2.86-515.el10_2.noarch.rpm 20a9f2b8c608e5b9882e2d7cc64546b067e53ccd2148bbfee2b72c0bfae4b16b perl-NDBM_File-1.17-515.el10_2.s390x.rpm 27e27eff9971950a1d0da6d3910f3d1c695231b9d72dacf0d0406572634378e4 perl-ExtUtils-Miniperl-1.14-515.el10_2.noarch.rpm 2b7283b3c5536e3fd89917266b3465b22de4dfbf604834e918ccc589888a8a26 perl-Thread-Semaphore-2.13-515.el10_2.noarch.rpm 2d138bc731d07a757d3301cd9d65f224ad3c2a96be63b1b60cd24e1c3ddfd0e5 perl-IPC-Open3-1.22-515.el10_2.noarch.rpm 2fe04d10b167fa28ece32046dc240d5132475190736ac8dda602198c8b51e0ae perl-FileCache-1.10-515.el10_2.noarch.rpm 30820f41d03438df0a89b8dea91241e253b67eacf1cf81d8fff01551dd83ab5e perl-Net-1.04-515.el10_2.noarch.rpm 32c8b627ee7e2970b1dabfa3c1024adbd59dd604b26059aa8c2dd768f3843337 perl-Thread-3.05-515.el10_2.noarch.rpm 342387b69d0d36619df2041b925e664c5a207142020f6c17137a4ef5e7f9f184 perl-Errno-1.38-515.el10_2.s390x.rpm 4054d98a69e483aab63ad426007140bc60144b4e5b129e196e38fb4e67cafc8e perl-Term-ReadLine-1.17-515.el10_2.noarch.rpm 41bde263dee0557bb68f9f1d2baa8d57c8d3df3fba08a5d94ecdde225220d3b2 perl-Unicode-UCD-0.78-515.el10_2.noarch.rpm 4307fa601ecd6edee189194d08a35b90113a9dc2e1e1c6a6a66195ec18e8d8ce perl-Text-Abbrev-1.02-515.el10_2.noarch.rpm 43665b451f519dbeb4b8a05f066cc6481f8b6c143cf3e594852598a3a6b222ee perl-Sys-Hostname-1.25-515.el10_2.s390x.rpm 46cba07c83fb487b9cfb3a8f5f88297cafe1d0bf4c59b0fba086b21faca3b412 perl-File-Compare-1.100.800-515.el10_2.noarch.rpm 4812e8816160f70feaec391bd210415bca4a44a5155b126c3fb1ef14674b80d2 perl-Getopt-Std-1.14-515.el10_2.noarch.rpm 49e8e4357d64fff7c22f72bda9bbab91c9393e87d6b40473e2f3e03a651d79ad perl-SelfLoader-1.27-515.el10_2.noarch.rpm 4d9f02c0fedb9b29b19bc90d97045e6d723657d1f214c7e2f2490390a781c3a3 perl-File-Copy-2.41-515.el10_2.noarch.rpm 52be131ea7d5f9df8f083bcaadde9c8b8cf8165b5dbba326c37eee56e9525871 perl-FindBin-1.54-515.el10_2.noarch.rpm 541141d26cff39e511d41ad2e104dbedff7ae004eb7b60a75f1d264f0da639e7 perl-Memoize-1.16-515.el10_2.noarch.rpm 568f92b74173236bcdb6ffd602c20f30d5ce36ddc15a9ef60bdd9531791e5d38 perl-lib-0.65-515.el10_2.s390x.rpm 59bcde712a3865bcb675f425faf7b0d6a09b5c83d603253aa3454e97c7074eb7 perl-DynaLoader-1.56-515.el10_2.s390x.rpm 5b4d5322df2ece08842d103985e3bd14d476c351cb40191f4d9a4715a4842a96 perl-Dumpvalue-2.27-515.el10_2.noarch.rpm 5c387af29496631904e0e4512b0042204cdfe1760561da0a1a7779cd1b9432c1 perl-filetest-1.03-515.el10_2.noarch.rpm 5ea84443d067654a9188b0fbdea88de0a413a87cca469418d8a7a2c81a63eb47 perl-Module-Loaded-0.08-515.el10_2.noarch.rpm 5ec1d001a8904f13be93731dc3ee10d52fea7b19718e01dde887e892f9d59e9b perl-Time-1.04-515.el10_2.noarch.rpm 648dff6e0b21d2c42534adf498ff6f73ddc53f26c65c64ad56180a18d42fc119 perl-Opcode-1.65-515.el10_2.s390x.rpm 64a44bebb3db44b2b8a495d6776b941e403b9b3e78c0a81f2a980eaba04eb808 perl-I18N-Collate-1.02-515.el10_2.noarch.rpm 680f8b26caf1903d88f8d96263ad903bc239369406b6895e6bc27ed923fbae59 perl-Symbol-1.09-515.el10_2.noarch.rpm 6812dec84019716837e33bae8700473e5b2e874091c1a288a8dbb1726153c5c2 perl-ExtUtils-Embed-1.35-515.el10_2.noarch.rpm 68dcc2966462f39ae38c5ebcae4c337dc9e0b06c3ea981844a143d3995c06753 perl-AutoSplit-5.74-515.el10_2.noarch.rpm 6b59cf08fb7286fb3f4198e45cd3d4f5006406267051a10617fb5304cd5266d1 perl-doc-5.40.2-515.el10_2.noarch.rpm 6cad19426ac95604a5cd8d62f8a8ffb5a38b8e8d807a982102a412825683beb8 perl-IO-1.55-515.el10_2.s390x.rpm 6fa76c241aff55b5d5443cefeaaac4e43b372a7fdc72c6552d4fc91866b27d14 perl-Hash-Util-0.32-515.el10_2.s390x.rpm 6fee6132606a9237357d62d82df1b2a5e11dd88980ae70e71f0d0ec76f218d6d perl-Safe-2.46-515.el10_2.noarch.rpm 72689b14d3ed67db6d8a591e812f40b77b791b19725266586057351632e00fd1 perl-Config-Extensions-0.03-515.el10_2.noarch.rpm 735ba0cc433b5cf1e24d38cde1b3370a929cb3d7e9d19a4191862d988e7e06f2 perl-overloading-0.02-515.el10_2.noarch.rpm 7696783c9ba2e5642cd1a30e303621daf02bf97a44f97abb2711b7d17befd20b perl-Attribute-Handlers-1.03-515.el10_2.noarch.rpm 77b3940fa81302f640a8fc18a554e27c5a3788da8a3c05b1f3e1bc3d75795a37 perl-SelectSaver-1.02-515.el10_2.noarch.rpm 7b99d763a3936e28b58fa9304fed7b558d8c71ad7e808a5751f3969dac867a76 perl-ExtUtils-Constant-0.25-515.el10_2.noarch.rpm 873bb09b54d407b9bf5ff9c9e00e0c0053f12ca3a38e094acf6fe08c2101501e perl-Tie-File-1.09-515.el10_2.noarch.rpm 8a33b58207a8349608b744f83eb4dc94995c8d4315559c15ba26bfd0793fac03 perl-Math-Complex-1.62-515.el10_2.noarch.rpm 8dc64964e85a19776cd9190076559c2f76282a5d55cc10f9dcdfe14dae924e30 perl-vars-1.05-515.el10_2.noarch.rpm 93da3932faa665745d14ccf5a9ddd860f562d08fbe184619cd4a7b8b274fe012 perl-base-2.27-515.el10_2.noarch.rpm 9be41847f8862fdbf8b1e5c6e81cd416a80f62bffde4ab2cddf02837e9ce25ff perl-Devel-SelfStubber-1.06-515.el10_2.noarch.rpm 9bf0cebe98e3c5d7c7391fc556d152673f3f4ac637e62559e72f00322c9665ae perl-DBM_Filter-0.06-515.el10_2.noarch.rpm 9c44ff926043c1465c2b3f769f5d460af437848027936af2885671f71c45b6c3 perl-utils-5.40.2-515.el10_2.noarch.rpm 9cf990e411b795dac07fb0e455ab88d72d70095974d3606451d554b1a89ed148 perl-GDBM_File-1.24-515.el10_2.s390x.rpm a35ad2c69200c6b13ade6c6d463f15f206b16239630c70cbe1ce988f53b20432 perl-subs-1.04-515.el10_2.noarch.rpm a45bb41b5f9be010da79ffbb237a445e115026b6a66594ff029d7993071754f8 perl-Tie-Memoize-1.1-515.el10_2.noarch.rpm a59eb6b1ae8899f296df3fcf49cd61046571493289821a2c792002f2a31c4027 perl-English-1.11-515.el10_2.noarch.rpm a81d60d0b8acf592731701a57479d115867187afff5573bd5a82fe8b130972a1 perl-mro-1.29-515.el10_2.s390x.rpm aae3dd93f8c06a444a55c76d3cf3e9d9fba0d57e01dc1cfdebc55ccd185b3768 perl-Pod-Functions-1.14-515.el10_2.noarch.rpm ac655c5595560dcb46f735702ea26b21b12051be8238ba0d5e0a38ab6f6b598d perl-Locale-Maketext-Simple-0.21-515.el10_2.noarch.rpm ae46f3e2dc6318944c86ec74827ce3532cdb6a197c6944b69e880923c4c65136 perl-less-0.03-515.el10_2.noarch.rpm aff27fa71a37ec8dd7133ac6cfe955671da4baaa92fd1ce496e7930d188a4556 perl-devel-5.40.2-515.el10_2.s390x.rpm b51b79db54485d47a7b446af40db2bbba6073993c2a42ddc2a4ca6e03fecab0d perl-libnetcfg-5.40.2-515.el10_2.noarch.rpm b6dd427dc290c38944e15a0c841f529374558fd9cc21cdb584dd0c8fe7bf32f7 perl-Benchmark-1.25-515.el10_2.noarch.rpm b7973b40a45771d3dfd56138ebae057d2fbaf20fda1998e379b0210fd9be01a1 perl-Hash-Util-FieldHash-1.27-515.el10_2.s390x.rpm b8e6b1f14e9ea7c297f017c613c9e61582b5cd24cae65629a79c7ebc02f007e4 perl-encoding-warnings-0.14-515.el10_2.noarch.rpm b8ecd57b3ebe7a0915a2932be16e7cefb2daa9d9c21ab1bc51e41bc4b14f252f perl-5.40.2-515.el10_2.s390x.rpm b8fc248e96e5943e34e5dfe396c897de51d14c1fe891496d68b25e489792f3e0 perl-NEXT-0.69-515.el10_2.noarch.rpm b9d74ebb73608e7ae8a41f1845f6ddffbde82b348053bf57d772c4cf1298e2f4 perl-deprecate-0.04-515.el10_2.noarch.rpm c05f4aa40a78c4f09380639cbcbbbd486d773026ea9acccf16495fcdb03be30f perl-Test-1.31-515.el10_2.noarch.rpm c070ca356ba1f71ae941a4b48c70eb6eea140fb8851e89fe70b444e7c15c5a25 perl-locale-1.12-515.el10_2.noarch.rpm c17fc22826e6adf2289f1e63d4d28f43d7938df26a23fabca9f891cd7a93313e perl-sigtrap-1.10-515.el10_2.noarch.rpm c4a150e1b3c392d2bb8602ece64c0a1216c248abcea67c2a9379cb46a1911ce8 perl-ODBM_File-1.18-515.el10_2.s390x.rpm c5a9f6db622ddda2d0088d53ba1f40e6f0c7b91397b6c4a7e15b1a98e6dafc29 perl-DirHandle-1.05-515.el10_2.noarch.rpm c74ec5ab698006562d3ebd6b4dcbd879c336390d3e5cca29cb4cce85b85b5a7d perl-ph-5.40.2-515.el10_2.s390x.rpm c8d317f36a260beabdf3af75a3ce1cbcacfaae20f3a1f07a007f137d412e8955 perl-diagnostics-1.40-515.el10_2.noarch.rpm c8f1dc682cb1f2bf17efbda24578b0e02926b13a3e818a6d145dd4265d6ece39 perl-autouse-1.11-515.el10_2.noarch.rpm c92493fe5c4a3219b4b5313325c3ff68fc3d174cbe86b442e42cb89e470aac60 perl-blib-1.07-515.el10_2.noarch.rpm cc2a05ecd7afe0c7472aafc23a4ebe0fc7d88f744f8db7f22c533cb55779d38a perl-Pod-Html-1.35-515.el10_2.noarch.rpm cde6d99dc6bedf83080168ce89ab7278dbae79370c09def2315c05a847acf9dc perl-File-Find-1.44-515.el10_2.noarch.rpm d2938662e54a406e838d0dd5c4ea5832760add3e33b8ef1251185069975d53a6 perl-overload-1.37-515.el10_2.noarch.rpm d3c7074b151fa50dc7404bf110e451f8a9847525e8e29fd17009086ae4ebb2e4 perl-if-0.61.000-515.el10_2.noarch.rpm d81719bd35a08f147b531c2c7251abb2fdd658f32d157ad322f18d5db317b398 perl-File-DosGlob-1.12-515.el10_2.s390x.rpm dad48822b455c4c710d3591cc314f6f715adbbe7e7e600efe6364522540838c3 perl-Fcntl-1.18-515.el10_2.s390x.rpm e15eb63cdc2a71c1d96f2ae036675c2b25baa5a168fdfbde7deefae112c85ebb perl-B-1.89-515.el10_2.s390x.rpm e3e219939cb85451a743c2e0ffa04445912dc5f511e20d8d7a7c437670af78c3 perl-I18N-Langinfo-0.24-515.el10_2.s390x.rpm e4f13637fe3c3d595377358a323c79ef1f9bee45e01d3288c08bc1f148526a62 perl-fields-2.27-515.el10_2.noarch.rpm e70d012a4965534f70adb38c3bada5c20cbb42fc8ab2e8b685cba1d6ae51ac75 perl-Tie-4.6-515.el10_2.noarch.rpm e7694d6af15a4e0a27f0f2619e94bf0671e47509e7b2fadd52f4f6e193ada11c perl-interpreter-5.40.2-515.el10_2.s390x.rpm eab7bbacc169ce599ec92630e8891f39c6e78b106a9496e548e3ecd6b250c4e1 perl-Devel-Peek-1.34-515.el10_2.s390x.rpm eaffa5439187881d94142e6c724c8469d5632134dc5e3f5a646f186c863a549a perl-open-1.13-515.el10_2.noarch.rpm ef32423ccb9fb8aadb65d75956ca93b17f2d48ad869a00265d5b18e074f9e67d perl-sort-2.05-515.el10_2.noarch.rpm f00ca350e4e5d6843b1ed839dabd26abfce7f303dffa9b76559b86b7160eef9c perl-POSIX-2.20-515.el10_2.s390x.rpm f0ddd8d2f20c3755520ef937129b78dd9a2430fc764b29d1d9017095127bc7ea perl-libs-5.40.2-515.el10_2.s390x.rpm f1256a5bfc52609d476b50b0fdd659460b93b2cf60900103721c7ceb01b98465 perl-File-stat-1.14-515.el10_2.noarch.rpm f31ab167489a383653e674718b8132503908c89658587c11e60a45911165c658 perl-Class-Struct-0.68-515.el10_2.noarch.rpm f67705171349b9de0f487263220dbf6cb9e59eb628540da756ce686222c81324 perl-Term-Complete-1.403-515.el10_2.noarch.rpm f79ccfdef83bcc3d0425411387915ed8065e98f2ceb6fe02965034b5ade87dbc perl-debugger-1.60-515.el10_2.noarch.rpm fb02e587b5524c489f54e76bb0796c696e9a08765198c33a0f44aa81847457a2 perl-FileHandle-2.05-515.el10_2.noarch.rpm fb1ce05e33fb4e041f6807b80f5895d12700cc578bc662ee3681533d04d61e27 perl-Time-Piece-1.3401-515.el10_2.s390x.rpm fb7c1ed476c1e62452ebb87e401335ab0ed8745f600fa76cb5ce9557dcafc88b perl-macros-5.40.2-515.el10_2.noarch.rpm fc7b48c861b581799e1c2bfb69697896fbacdd6dc84be691b3671b469cbd76bc perl-meta-notation-5.40.2-515.el10_2.noarch.rpm fe5a31ee08cb8e227798d7a83e589736648047ac72ce10ce68043d70bf3bd8f0 ALSA-2026:67166 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile. Security Fix(es): * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postgresql18-postgis-upgrade-3.5.3-1.el10_2.1.s390x.rpm 0d481bcb611598be251ff8fb61fb267368ca44f2e95d13a32fae9998dc2114d6 postgresql18-postgis-client-3.5.3-1.el10_2.1.s390x.rpm 24ea5959efbc156bfefd03ef530de81edcf4308a6835e48b3d1455e62a3f8322 postgresql18-postgis-3.5.3-1.el10_2.1.s390x.rpm 31814581c020c83852799cd3aba2653f231a5d29fad3f06b89a9fbf1ce600719 postgresql18-postgis-utils-3.5.3-1.el10_2.1.s390x.rpm 8271cb15b8eb2f4067c859a9ab82d066402bf1638e6ec4a9d7bb921207bf0029 postgresql18-postgis-docs-3.5.3-1.el10_2.1.s390x.rpm d1448abef1c52bc944113e2db85f6db4bbb84663eae4bb53f0d2aceae09f773c ALSA-2026:67280 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476) * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postgresql18-docs-18.6-1.el10_2.s390x.rpm 09dba49c4299863bec55afbf85fbfc51e8028a3b9b5191af7c18d928a0c78cd7 postgresql18-server-devel-18.6-1.el10_2.s390x.rpm 1ded5f08d79747e4a1c5aad81fff7262e24890f03efd33b71288ec058ce0f73c postgresql18-contrib-18.6-1.el10_2.s390x.rpm 26cebc36e09de0eeaad6ac84d893b39465b011b5556bd353cea95ef473697a47 postgresql18-upgrade-devel-18.6-1.el10_2.s390x.rpm 26d5761eb41e83319ae3fcea9157c3f82fa9195b334484bc2159fdf5eae28631 postgresql18-upgrade-18.6-1.el10_2.s390x.rpm 32e4a55a4b34b0ce133d87b28d5336667faf92df552c17a122c4c608b365c080 postgresql18-18.6-1.el10_2.s390x.rpm 5f4430e0b29351c75af975f55cd5e9c078e2d8d830e6e30a395cd11e7c649ac6 postgresql18-test-18.6-1.el10_2.s390x.rpm 883408ad86364684f91040008f248f528e0f5ce877f28555c9897e4d5ffa8ae6 postgresql18-server-18.6-1.el10_2.s390x.rpm 8edf99b87a15585042bcb892014539d25e9cc14214247ae504ae9862d8ad44bc postgresql18-private-devel-18.6-1.el10_2.s390x.rpm a3fa79480ec3184d65fb95bf55603c3dbf58b771d2997f1a8d816923cca5a3ae postgresql18-plpython3-18.6-1.el10_2.s390x.rpm ca9fea2faaa01fea01c434e322b4edf305d612acd6d2799d00db75033d5c1896 postgresql18-static-18.6-1.el10_2.s390x.rpm da6798e02851d7b45a007dba3eeb1dbd44010f0c5d3cb5a9b75771409abd5ed2 postgresql18-plperl-18.6-1.el10_2.s390x.rpm e6b45e3ac8c34cbeb10d001a966c65933eaaadf721a3ab6fa36991f297a8f192 postgresql18-private-libs-18.6-1.el10_2.s390x.rpm eda0885f8f183c06079e9167f1dbf6d68f71a89adab543f47b76f3e5eeaf0507 ALSA-2026:67286 Copyright 2026 AlmaLinux OS 0 1 Important

rust security update

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator. Security Fix(es): * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server (CVE-2026-53587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rust-std-static-wasm32-unknown-unknown-1.92.0-2.el10_2.alma.1.noarch.rpm 0138e6cca138e3a8bd6140d713af45cad285722fdf927f02ee745a5170eaaf11 rust-debugger-common-1.92.0-2.el10_2.alma.1.noarch.rpm 066364c3cf81426f4483e19c67d727520f30fb4946106f8163cb8d7ef1b57c3e rust-toolset-1.92.0-2.el10_2.alma.1.noarch.rpm 076c2a9168005bc63f127403b7ba6ed47e6888351515f4e711c7257770e7a693 rustfmt-1.92.0-2.el10_2.alma.1.s390x.rpm 0b57cb3e013b7019073112860b34b8456d433f9b03f715964f7f7dee5f5933d2 rust-toolset-srpm-macros-1.92.0-2.el10_2.alma.1.noarch.rpm 0ceeb326c7211eeb9140d0ea6d45b8d21a41469f24b87463f3b664fe7fd67c4d rust-gdb-1.92.0-2.el10_2.alma.1.noarch.rpm 36416c11e35f5a7ed2f73b8fd1e17ac9c268d87e61a02b736141c00f43e837d0 rust-src-1.92.0-2.el10_2.alma.1.noarch.rpm 3a191c97568b6ef7689a8161ad1e6f84a2c0b0d8d589b9b2c435126799f2afce rust-1.92.0-2.el10_2.alma.1.s390x.rpm 453c2d0313a6cce2c6e1ad6ef63eb5bffdeb66baf3a1bf440951f3a4e177b36b cargo-1.92.0-2.el10_2.alma.1.s390x.rpm 45a81044b5fb70d565c8cc7351794add312de0610c6c130d71ce10faafdc0c0e rust-doc-1.92.0-2.el10_2.alma.1.s390x.rpm 5faef10ba417de2440b0ea4559f56ed3cf34d18e3022a63fd573a49a71dfc565 rust-std-static-wasm32-wasip1-1.92.0-2.el10_2.alma.1.noarch.rpm 6b59c9879cc5f8495b5c0dd0629cda1e72584f6b770fba245605007f4c8b070b rust-analyzer-1.92.0-2.el10_2.alma.1.s390x.rpm 7f76f9a2bbf2d3ce6365f434c4bff5d2aeec11508be4c4d0549b8d2701216e23 clippy-1.92.0-2.el10_2.alma.1.s390x.rpm 9c975126f9417f668681ad18bc8ae838b7313c740302a9d3d88e55bec324253b rust-lldb-1.92.0-2.el10_2.alma.1.noarch.rpm b5fd5f65f431e4ce5bf5b35b1763ab998bd818db537d321ba792bf0a1f0ed29c rust-std-static-1.92.0-2.el10_2.alma.1.s390x.rpm ff160e261b101023f72e3fee7cea9069e512ef0b870c0de83335add0bdb1459b ALSA-2026:67314 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nginx-mod-stream-1.26.3-6.el10_2.7.s390x.rpm 138796b35b8e56b972e95de44b108652564dc073958fa3701986e2f38017ecdf nginx-mod-http-xslt-filter-1.26.3-6.el10_2.7.s390x.rpm 3f0eef809eec3f222da25d077a6e0ec54cac8b992d9e3298f19fc17eefac1bcb nginx-mod-http-image-filter-1.26.3-6.el10_2.7.s390x.rpm 5be20dedf713c632936acd1a7a4da795d7ef13b1aa3ee2f48959f3e4a2032bc1 nginx-mod-http-perl-1.26.3-6.el10_2.7.s390x.rpm 5daafec7fc7e21c2a923f66ef931d25c79cfcd2a9f0c5e9f98a95d393e3a0543 nginx-1.26.3-6.el10_2.7.s390x.rpm 85f40fa70fee63a41292ecffe3b928a456260bf30e4ab94f546040e59e584719 nginx-core-1.26.3-6.el10_2.7.s390x.rpm 8d16ab35adb67136d9787da4e5b74501e1fe7ab08d78d58d8e22480bf7c5dc21 nginx-filesystem-1.26.3-6.el10_2.7.noarch.rpm 9e02356ee55819abf5dd9f44929c35a20fae932d02ce8934f7cf4b184f83edfa nginx-mod-mail-1.26.3-6.el10_2.7.s390x.rpm bb3235aeecc32a72b9777c9b2b63f65759ad6e86e0d9aa111b861a0b893d50f3 nginx-all-modules-1.26.3-6.el10_2.7.noarch.rpm c401bf9f42c3bc11357a0635ba27b08076df988c187958490043e82bcf9ca248 ALSA-2026:67463 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460) * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454) * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789) * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790) * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458) * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464) * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803) * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784) * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463) * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452) * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791) * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795) * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456) * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793) * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453) * rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455) * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457) * rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461) * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802) * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785) * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783) Bug Fix(es) and Enhancement(s): * Rebase rsync to version 3.5.0 in AlmaLinux10 (JIRA:AlmaLinux-246094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rsync-daemon-3.5.0-3.el10_2.noarch.rpm d9eeb4e538648566b7bc50ebdf47325f2158a1f110be3d5a1451d1dbf7b786e9 rsync-rrsync-3.5.0-3.el10_2.noarch.rpm f379c5d18d7e720110d224d854c2e2796f7af861e7e3c5b78903eaadc9caa299 ALSA-2026:67471 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149) * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539) * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131) * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361) * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111) * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) Bug Fix(es) and Enhancement(s): * [almalinux-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:AlmaLinux-245035) * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:AlmaLinux-255233) * [AlmaLinux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255348) * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [AlmaLinux-10.2.z] (JIRA:AlmaLinux-256731) * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:AlmaLinux-256890) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.55.1.el10_2.s390x.rpm 1969ca8aeed5f755c29c3e8cb7411c13f6930a6e7b799cf6ad99ef7d31d6c65a kernel-headers-6.12.0-211.55.1.el10_2.s390x.rpm 1faf15705cd4dcecefcc4595e42c2e81e65bcefedf6dea1dd0fb4b91358906cf kernel-devel-6.12.0-211.55.1.el10_2.s390x.rpm 36a3e59edc9af760b602096a949f58014765ee53b1ee03a1f4233012f63231be kernel-doc-6.12.0-211.55.1.el10_2.noarch.rpm 417f2ca88de88049f750692aed24d02c1aae2bdedac4761c6e14342603e41806 kernel-zfcpdump-devel-6.12.0-211.55.1.el10_2.s390x.rpm 5ba2e6fa6df31c07f179cba24a9b8af1ceb627742c0c2599b5b1327471f589fc kernel-devel-matched-6.12.0-211.55.1.el10_2.s390x.rpm 974d803048f9ded5194937b967694a734c07aab8d843d08b26476f97b98619d3 perf-6.12.0-211.55.1.el10_2.s390x.rpm acdffb6369fe2af16697c4ff8e967b9fa8353a684385bebcb1c8dbc2b37586f9 rtla-6.12.0-211.55.1.el10_2.s390x.rpm e3af25fdfa126a12a626ccdc80bde0520937d14b1eeec35109190e73d4ffbe63 kernel-debug-devel-matched-6.12.0-211.55.1.el10_2.s390x.rpm e8c7de381aaf1353b233ccc5573464a8e41d22f6a3f6d3c292b5fcbc3c644432 rv-6.12.0-211.55.1.el10_2.s390x.rpm f44c9dc04ac6dd2e96e8e1c94780a084c00157a5fb741c63db60974136d1102b kernel-zfcpdump-devel-matched-6.12.0-211.55.1.el10_2.s390x.rpm f64aa6ad930744b21fe61ce85c29d02b9bf9a07748ec7938b7baf99edec0afc0 python3-perf-6.12.0-211.55.1.el10_2.s390x.rpm ff3e99aac164074bdbe9d1e2b3664e653fc886b9bb23d778b82588391dc83c03 ALSA-2026:67525 Copyright 2026 AlmaLinux OS 0 1 Moderate

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.131 Runtime version: 8.0.31 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.131 and Runtime 8.0.31 [almalinux-10.2.z] (JIRA:AlmaLinux-252248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-sdk-8.0-8.0.131-1.el10_2.s390x.rpm 0f1765bbfc602f9e3d11ec35e0f354cf2da542f3c3f5dc542b5eb6a20fb5780c dotnet-apphost-pack-8.0-8.0.31-1.el10_2.s390x.rpm 300682660ba29a7b1a83c0f9cef14ae32014ef88f33892adba0a90e9bfdf7ccd dotnet-templates-8.0-8.0.131-1.el10_2.s390x.rpm 39b3a72efd3fbddfd04f056f5cab869d8eda36b833da83514ef9b8a97edbc58c dotnet-runtime-dbg-8.0-8.0.31-1.el10_2.s390x.rpm 593a0c1078649ddeba2209b4d55d2ef842e52c4fd3c79e9b8c703fc396def4f3 aspnetcore-runtime-dbg-8.0-8.0.31-1.el10_2.s390x.rpm 617f76d81007c2ffda094eb0e600477352db69f933cda801b7d55dbcf059ef82 aspnetcore-runtime-8.0-8.0.31-1.el10_2.s390x.rpm 6ef39264496236eba1b36ec9178adc2c9456373703b04e6019e7b34f82d16cc9 aspnetcore-targeting-pack-8.0-8.0.31-1.el10_2.s390x.rpm 85975ce9028cfcbe5faa4d418692e19c78639f964a1b4d59e1ee55560b0f743c dotnet-targeting-pack-8.0-8.0.31-1.el10_2.s390x.rpm 89d50585008f9000cf3bd3a75cf564a8a535408ac458c4cddb5b89e1a2ad2789 dotnet-runtime-8.0-8.0.31-1.el10_2.s390x.rpm bd415b4bed50aba368d37cc6fd90e9706f5a9c7b13bda16ed25d494190211386 dotnet-sdk-dbg-8.0-8.0.131-1.el10_2.s390x.rpm cb2f87d1dd54f4a8157ef8c1e890a9df47b440013519216b743ffbbdad2c8016 dotnet-hostfxr-8.0-8.0.31-1.el10_2.s390x.rpm f94d0a13baf25ce88de148e8d5b79bd9cff71df58b123ba5e65379110f6ade8a ALSA-2026:67528 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.121 Runtime version: 9.0.20 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.121 and Runtime 9.0.20 [almalinux-10.2.z] (JIRA:AlmaLinux-252279) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-sdk-dbg-9.0-9.0.121-1.el10_2.s390x.rpm 1c0831e99f6744614f04299eccb98fec8f30512c74801eeb48acc2879e1d47ef dotnet-runtime-dbg-9.0-9.0.20-1.el10_2.s390x.rpm 29e8156f956547bfe3542debbd8505cbce6ad0246e8294ea170ed92d94c78a07 dotnet-apphost-pack-9.0-9.0.20-1.el10_2.s390x.rpm 48dd0565eff827e438edebc57c6fda694108fdfae8a7fcab6c53de0fb997918a netstandard-targeting-pack-2.1-9.0.121-1.el10_2.s390x.rpm 5b92046802dd8c7ece604da08c85c3912e4fc48adae819fc76d659bc7e99ce2e aspnetcore-runtime-9.0-9.0.20-1.el10_2.s390x.rpm 604edb6b9204fd9b3cb8a4ea54f90e339dd4d45a704d6ec6983dc6d3d384b51e dotnet-hostfxr-9.0-9.0.20-1.el10_2.s390x.rpm 788169ea069e80dfa2fb65337331c4d6c0098b8e1e483dae991c7f4b92945d4d dotnet-targeting-pack-9.0-9.0.20-1.el10_2.s390x.rpm 8eb6ef847d260099401c161b356b829f44a5899ba534078117f4378dcdb3f555 dotnet-runtime-9.0-9.0.20-1.el10_2.s390x.rpm a924f928aa1fae6dba6c9759d46070df6d1bcb0b5f58050ed90e5b4a597015ef aspnetcore-runtime-dbg-9.0-9.0.20-1.el10_2.s390x.rpm d73e012a6965a31c7ee41713eb6af11b3a257041d97484cfbd4e6255904f1361 dotnet-templates-9.0-9.0.121-1.el10_2.s390x.rpm d843a57ed925ef3fa74cf5f30cc9e2fabe561c92e40554a450e2900bd144a1d8 dotnet-sdk-9.0-9.0.121-1.el10_2.s390x.rpm e00e5d14cfcca134291af84481b01d7431accfcabec57807daf819dd86b1e54c aspnetcore-targeting-pack-9.0-9.0.20-1.el10_2.s390x.rpm e22724614f975bdbbeac9e92096f27ac2f0e08a385f80c58361d9d612aa3bd53 ALSA-2026:67530 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.112 Runtime version: 10.0.12 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.112 and Runtime 10.0.12 [almalinux-10.2.z] (JIRA:AlmaLinux-252320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-templates-10.0-10.0.112-1.el10_2.s390x.rpm 075093110393af199c5a79bccaf39f265f4e9ac0a5a7c917c0b869fd12fdcd64 dotnet-runtime-10.0-10.0.12-1.el10_2.s390x.rpm 11013439832f0f94cf77fe8422fb3b53ace1d5a9ec851d61b979cecb81b87137 aspnetcore-targeting-pack-10.0-10.0.12-1.el10_2.s390x.rpm 308afb0366f0bf4b4b067360255c366e8dcb702cf551c59c23abf4fdb8097ae7 dotnet-sdk-dbg-10.0-10.0.112-1.el10_2.s390x.rpm 34745927ad3231de6ab09eeefe14b848cc06f572b135bac86683d7aba35e1eec aspnetcore-runtime-10.0-10.0.12-1.el10_2.s390x.rpm 45bbf5c969fdfd71dad117e70c674b7041f8207671c1067267c81848f52d4e00 dotnet-hostfxr-10.0-10.0.12-1.el10_2.s390x.rpm 4607d9ef3f7207b761a56573897c6c4dacbc3c01deada7c7bde7f225340e4b3a dotnet-host-10.0.12-1.el10_2.s390x.rpm 5deaaf7b0b30e64a9ba5f6cffbc026a7022d94d00511084f6e281c242a099f95 dotnet-targeting-pack-10.0-10.0.12-1.el10_2.s390x.rpm 8cad06713b3450b9b1fbc9bc82b58fa75db045b8eb6d29a215439f821dfb0e32 dotnet-runtime-dbg-10.0-10.0.12-1.el10_2.s390x.rpm b6981d488871187dcfa2dee28a9e3c1a394f41ba09b0b40bdb72000ce66303ce aspnetcore-runtime-dbg-10.0-10.0.12-1.el10_2.s390x.rpm ba4b5b53099e62942fba387fee86b5c8986da1ed1598901e2c3766b3c028ae65 dotnet-apphost-pack-10.0-10.0.12-1.el10_2.s390x.rpm d8fe3d51068ad3351df313ca70a02e7af55a7daa44da914f7c65197f50554195 dotnet-sdk-10.0-10.0.112-1.el10_2.s390x.rpm fde626f83b2b891e5cc4b657b57b24d9f1a914b6bd20c1d3853c7238dd53c48b ALSA-2026:67584 Copyright 2026 AlmaLinux OS 0 1 Moderate

rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rsyslog-udpspoof-8.2510.0-5.el10_2.1.s390x.rpm 1379ea5a2967650b1961b89af08da020e1633a58b99e9db0e7d519ad4f699cf2 rsyslog-mmaudit-8.2510.0-5.el10_2.1.s390x.rpm 1f14c259e56b553e7ff8782052a9179eec61ed94ccef22d522e2bf41e87b85ba rsyslog-mmnormalize-8.2510.0-5.el10_2.1.s390x.rpm 21320e5a2fe13ccf1803330e63af722ef49a874a7262be6198b24168ce6ef6f5 rsyslog-snmp-8.2510.0-5.el10_2.1.s390x.rpm 3c4482afae96a55adfce97cb89eb3ede1eb7906de93d455d4eebcefd5a5dc6db rsyslog-pgsql-8.2510.0-5.el10_2.1.s390x.rpm 44c9313e7e44ef18ff953379b75915de1e6eebad7e5ef805ab86de28e6351e7c rsyslog-doc-8.2510.0-5.el10_2.1.noarch.rpm 5eb376ccbd5574465d95f79c551faadf1b77b055b2e397074abdf8290145b706 rsyslog-gssapi-8.2510.0-5.el10_2.1.s390x.rpm 6115ddc47d15446711802b0ba93185ab93969ecb09a9649164d4fdb0764a546f rsyslog-mysql-8.2510.0-5.el10_2.1.s390x.rpm 6768326fcc20f78bf879119fdcca398fccdba6a0f5d0abc4af4413996ce8bef7 rsyslog-8.2510.0-5.el10_2.1.s390x.rpm 6ee4891b522453f61255d832d5649ba8f3210e529cac1d2f30a8fa97bb56a655 rsyslog-mmfields-8.2510.0-5.el10_2.1.s390x.rpm 76a34f9a806b69293e7a26aa6b889ac1be058825e373f2c43e4918b6c5d44e1f rsyslog-relp-8.2510.0-5.el10_2.1.s390x.rpm 7ee7c15a8250fa6aa5cb5f2a994d09b1db870eb4eef35fcf7329d3d27624491b rsyslog-mmkubernetes-8.2510.0-5.el10_2.1.s390x.rpm 914b1f532d08b74796b8494b390922e1832c309c25471b8698909a2d29480fbe rsyslog-mmjsonparse-8.2510.0-5.el10_2.1.s390x.rpm 9d5e31aae681cfbfacb22a3036de52436ba7cfe1b68bb5a8bce7de6a52a27127 rsyslog-elasticsearch-8.2510.0-5.el10_2.1.s390x.rpm 9e7728cb8227f458d77689b99cdd49a1f18b06e61ebc31c714927f0d25bd601c rsyslog-mmsnmptrapd-8.2510.0-5.el10_2.1.s390x.rpm a7def5ac563ecfefd10f37ab63fe54be176d0eb4181bbd1c81005120230d71ec rsyslog-kafka-8.2510.0-5.el10_2.1.s390x.rpm ad283402db1e9e6dd5524f4fd16ab34b13d4b765ea19fda0e807d491463f9eb4 rsyslog-gnutls-8.2510.0-5.el10_2.1.s390x.rpm af7f14a1d862889c8a589a2d1489d828e84160e1034e6e120fb3810f330b2692 rsyslog-openssl-8.2510.0-5.el10_2.1.s390x.rpm b83ba24f60e3ec092c0dfcb7ffd3202d18278afffbf4e67b3bb2d39b5a677302 rsyslog-omamqp1-8.2510.0-5.el10_2.1.s390x.rpm dcda0f09bce55aa612e2d86ff86d925d752860e2faea8d2e5f8dedfdae863566 rsyslog-crypto-8.2510.0-5.el10_2.1.s390x.rpm eae5c692707fdd4a98e498b0b9f5981445f4f226ffe82acd26277c5d5cf1255e ALSA-2026:67872 Copyright 2026 AlmaLinux OS 0 1 Important

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default corosynclib-3.1.10-1.el10_2.2.s390x.rpm 11aae9f4db6be2b7509058179f2067bcf76c49a352941f7922404a393f40d0c7 ALSA-2026:67909 Copyright 2026 AlmaLinux OS 0 1 Important

libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fix(es): * libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383) * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387) * libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381) * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384) * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382) * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388) * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385) * libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libevent-doc-2.1.13-1.el10_2.noarch.rpm 8f97e5ea7d9bd2f38f36ae5c546a1143c2438ea22193be05cfb08d3a9e3159b3 libevent-devel-2.1.13-1.el10_2.s390x.rpm e30591f312cdd74411751bcff717b2225092c5006ee6ce1fc21624353f00daa4 ALSA-2026:68235 Copyright 2026 AlmaLinux OS 0 1 Important

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service (CVE-2026-15709) * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation (CVE-2026-15711) * libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body upload (CVE-2026-85197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libsoup3-3.6.5-3.el10_2.14.s390x.rpm 0a466d984bc061307a8322919d15e0228608293a94f1b5433795cca96a284b93 libsoup3-devel-3.6.5-3.el10_2.14.s390x.rpm 749c5a28094c0da32218397baa581b6514b75fa0a5e0b1a6112f92c53f727123 ALSA-2026:68291 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default unbound-utils-1.24.2-7.el10_2.5.s390x.rpm 2b69aca5dba2db99c86bc88e3d294c23070787fb8c7cd70b41e960996e388c1e unbound-anchor-1.24.2-7.el10_2.5.s390x.rpm 307bd32c2e6cec22b1baeb88e727cca89a3d18b46d4d3008ee330908f797668a unbound-dracut-1.24.2-7.el10_2.5.s390x.rpm 564a22f84ff0a67a9199f88c42e55d5d3fa69e235756f18d263021ef25deff77 unbound-1.24.2-7.el10_2.5.s390x.rpm 7f18e19fc50d899338e21f443e98c613de5fd63a7e8e35f27d50da87c979ebf1 python3-unbound-1.24.2-7.el10_2.5.s390x.rpm 8cc0b9abc5f323106b2566aa66117de78ac9355445fe90fb67579caf3e97d7ee unbound-libs-1.24.2-7.el10_2.5.s390x.rpm 9de962f8735c5b7af0bc114f31f49bf852e148f3b239d7f8c79a6bd03f61ee4b ALSA-2026:68507 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007) * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923) * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176) * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175) * kernel: netfilter: handle unreadable frags (CVE-2026-64414) * kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456) * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200) * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143) * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128) * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102) Bug Fix(es) and Enhancement(s): * nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0) returns EBUSY [almalinux-10.2.z] (JIRA:AlmaLinux-239776) * AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-10.2.z] (JIRA:AlmaLinux-254105) * RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:AlmaLinux-255225) * RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:AlmaLinux-255516) * RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:AlmaLinux-255518) * RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:AlmaLinux-255519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-perf-6.12.0-211.56.1.el10_2.s390x.rpm 1dd3bbfd3e0dbfc2c0dbcb983941e68d948b855839fd954cd136882e6f555ee6 kernel-debug-devel-matched-6.12.0-211.56.1.el10_2.s390x.rpm 1ddc76085903321598ef4e211e2ca897fb534b42c5e0fccc6f545c3c72e4f414 kernel-debug-devel-6.12.0-211.56.1.el10_2.s390x.rpm 2c6eae55434f389e0f876a45e03a44058c37e4a11e9987f421f711e59b35665e rv-6.12.0-211.56.1.el10_2.s390x.rpm 2c8ef30e61507a15c9c8cf56080914b15172e578bb420d4919c57020020f5b02 kernel-devel-matched-6.12.0-211.56.1.el10_2.s390x.rpm 43145715f7d3e196674ae268800b7667134715e658a8e63cc30dc7c9cc48f08c kernel-devel-6.12.0-211.56.1.el10_2.s390x.rpm 5a8fea3e6753ed5ec257d0b36103d39f0bcdac8c4b599ee157fc61da40adbb0e kernel-headers-6.12.0-211.56.1.el10_2.s390x.rpm 6b25c9c0df493704cb14987c3a846e1464278bff238d1fb26ca1ebc36434911d kernel-zfcpdump-devel-matched-6.12.0-211.56.1.el10_2.s390x.rpm 7581fbf967f3a9a0f34f21685b5f93d1b1ef5cd706747538bd1e97716a46a78b kernel-doc-6.12.0-211.56.1.el10_2.noarch.rpm 9ac495690b0f89bc57aec2d253ec27914f0238abd009f57c498b6a2668c73807 rtla-6.12.0-211.56.1.el10_2.s390x.rpm a9eaab9459a04e88e6f4f471234e724a99f9b977d1ff98eb4b8ec49831342f6d kernel-zfcpdump-devel-6.12.0-211.56.1.el10_2.s390x.rpm e116041bc9240859021e71852e4d0f4fab7f3abe56b336034a868cff0131c949 perf-6.12.0-211.56.1.el10_2.s390x.rpm fb524924feaf9a62862dd6338c7a4bf3661f2a10bb4db5a05687b88445d7f6fd ALSA-2026:68651 Copyright 2026 AlmaLinux OS 0 1 Moderate

tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default tomcat9-jsp-2.3-api-9.0.120-1.el10_2.alma.1.noarch.rpm 079235eb90790724bd53fa760599c4fabc2ca146f0df04dc03b825473f6929f0 tomcat9-el-3.0-api-9.0.120-1.el10_2.alma.1.noarch.rpm 127036aa147028de0c591c915f5913b3c80dbbbb60b91558081f3842befb9deb tomcat9-9.0.120-1.el10_2.alma.1.noarch.rpm 4345bedf4762f697d7820e4c40e33db6d512fbb7bb3aa1bb1736a9517eb26bb1 tomcat9-webapps-9.0.120-1.el10_2.alma.1.noarch.rpm 5438a76184cee45e329a47afa3263e09dfcd6150cbd0ff81c9aa64f29718fbaf tomcat9-admin-webapps-9.0.120-1.el10_2.alma.1.noarch.rpm 5abf8cce64844d9b8d793f656ee9059ff88d5778b36b2132610327becea70b50 tomcat9-docs-webapp-9.0.120-1.el10_2.alma.1.noarch.rpm 8f39945c344abb46ae48edaeeb08c9422248d21b0fa78a5168faae09fb3f81ef tomcat9-lib-9.0.120-1.el10_2.alma.1.noarch.rpm c47704f2da56adf112c8a1acc1d7fe27bb3e7896bbfcbcdff7dcc0673fda1877 tomcat9-servlet-4.0-api-9.0.120-1.el10_2.alma.1.noarch.rpm ddabae1dd27c35dd4cee5c1eae2a7f3dd9d8d1aa22810be1c19a7df07b7d56ed ALSA-2026:68692 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security, bug fix, and enhancement update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Policy bypass allows unauthorized program execution via execveat (CVE-2026-82474) Bug Fix(es) and Enhancement(s): * Use canonicalized path if user path contains ".." (JIRA:AlmaLinux-212546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-10.p2.el10_2.6.s390x.rpm 26849cf9f5b59abfc6249ac151fdf467147308dce31b2da88f87431f261b37b8 ALSA-2026:69099 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-7.el10_2.8.s390x.rpm 6b473317697369c6a6825125d4b78a2d4b6c66fc8b811437a198a88ce3b9728a ALSA-2026:69125 Copyright 2026 AlmaLinux OS 0 1 Important

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926) * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.6.s390x.rpm 5bf526f99a36b016e8ebedfad23851a028da99ab307510bcd9b3cd8930114c31 ALSA-2026:69129 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995) * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999) * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283) * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281) * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssh-askpass-9.9p1-27.el10_2.alma.1.s390x.rpm 4795cc4823602e621c3c37be72c5b6b943db0cd30e82a55847e8860e5d583d6c openssh-keysign-9.9p1-27.el10_2.alma.1.s390x.rpm f6fd2cf9afb183d016d52891b802ea92f9937174994eafab5e282c210b89fef2 ALSA-2026:69259 Copyright 2026 AlmaLinux OS 0 1 Moderate

tomcat update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default tomcat-10.1.49-4.el10_2.alma.1.noarch.rpm 05f66cc8b41b005142502d651ba514eded6e74fadebc4bdc6c0d92950d6879df tomcat-lib-10.1.49-4.el10_2.alma.1.noarch.rpm 1ef407ca747b0004e12dfb23f976be66e723a1e587ab0958cba13bdb751f2505 tomcat-webapps-10.1.49-4.el10_2.alma.1.noarch.rpm 3039facea1830d6007abf1fdc9482c06d32fcb2fb13da8d1c71963066f81e351 tomcat-servlet-6.0-api-10.1.49-4.el10_2.alma.1.noarch.rpm 3b705c8b7203a1082a75a9137b187f792afaaf227daf36911e2dbeccf5e0f1b1 tomcat-el-5.0-api-10.1.49-4.el10_2.alma.1.noarch.rpm 4df179b81ca2db0f43fec568ccc75a8679fffe363fec2fb6561e4f02955b8ae7 tomcat-admin-webapps-10.1.49-4.el10_2.alma.1.noarch.rpm 7c7acfc2c6790f4c32d6cdaf0b0ebdfa664f793a282af54ec03f3852621bb52f tomcat-jsp-3.1-api-10.1.49-4.el10_2.alma.1.noarch.rpm a6fc4fb2bc554f7fe792d34fef93212e54a6708c02ec0a9ef3f40adf76158df1 tomcat-docs-webapp-10.1.49-4.el10_2.alma.1.noarch.rpm d77aa50850c7291ba9872ee696549bcb39f63510d6dcf156bfa5d47ae3113c12 ALSA-2026:69308 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.3.s390x.rpm c04285e1d67a2703b0bd77dfecd190e7c39f3ad963a52446a98b058152152b02 ALSA-2026:69461 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031) * firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011) * firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028) * firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013) * firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012) * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014) * firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) * firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021) * firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008) * firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007) * firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029) * firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default firefox-140.16.0-1.el10_2.s390x.rpm cc3b2c3d679ae15c643da70e7b8184c5302af0c3bb5b87612264c83b6d6eab15 ALSA-2026:69541 Copyright 2026 AlmaLinux OS 0 1 Important

rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rsyslog-mmkubernetes-8.2510.0-5.el10_2.2.s390x.rpm 16d12834b3f9fa56fb52ddd0d9a3e6e3dd16df175a9b1c249ef5b596555d8f12 rsyslog-8.2510.0-5.el10_2.2.s390x.rpm 1adba8cac44da307c0a8bf8b1ded5546014d61e19b2421fb332f00e77f9483e3 rsyslog-snmp-8.2510.0-5.el10_2.2.s390x.rpm 2f56cd0c3905fd0ed079b88b6932c5a5b4d697817c426eefc97dd04c5f662b70 rsyslog-gssapi-8.2510.0-5.el10_2.2.s390x.rpm 3ab47b62a0e6f4aea342dc6f1b3746c543ac3439671f06beec09f616cbd1a6e8 rsyslog-mmjsonparse-8.2510.0-5.el10_2.2.s390x.rpm 4c03df49d311e488c79c85d70c5ee2efc831521db053c676ec68c015d5007d6a rsyslog-mmfields-8.2510.0-5.el10_2.2.s390x.rpm 69e0951907c5950bc1a191e08d81eae714b79d0d5cb2c35592ba1d3bb75bca29 rsyslog-udpspoof-8.2510.0-5.el10_2.2.s390x.rpm 73e6b2c02e2a5a4b48dbf2641a41fb73d4685f5f2e43cdc19297fa86575e6663 rsyslog-gnutls-8.2510.0-5.el10_2.2.s390x.rpm 76a16f4527a954d4d338a1baa5b36065af7e2823b9689451fe42e9250ff3e3b7 rsyslog-crypto-8.2510.0-5.el10_2.2.s390x.rpm 773f753e9f8eed56f2a17678c0b8039a034d1ea98bd2f0c837d06282333ce46f rsyslog-openssl-8.2510.0-5.el10_2.2.s390x.rpm 851ee7e6ccbe5626550e9606c82359809f163b585b0ff2f94918862d6db47ee6 rsyslog-mysql-8.2510.0-5.el10_2.2.s390x.rpm 87b2252ca01915be2d472c1eef4317805ad1f86486ed7f7a60c7e6e0b2856464 rsyslog-pgsql-8.2510.0-5.el10_2.2.s390x.rpm 904356e91cf62191950cb161361d54cb58a220d2aced5c577904dc0f432e98b6 rsyslog-mmnormalize-8.2510.0-5.el10_2.2.s390x.rpm 9784e0bb3bfd1421700e604c44f72ddd83a1f18e3ff8f56d653cadf39550d1aa rsyslog-omamqp1-8.2510.0-5.el10_2.2.s390x.rpm 9976be2ea9f643850e3e616f14f594dfc62e6c00a4524e62f802312e560e158a rsyslog-kafka-8.2510.0-5.el10_2.2.s390x.rpm b4414af302550ae9ce9c2a2152b47eed22028c6720db6460014a1c16442c9179 rsyslog-mmaudit-8.2510.0-5.el10_2.2.s390x.rpm be78b4ddf0220174be130655789293f9f80f8e120cc415cca831cb6570eae936 rsyslog-elasticsearch-8.2510.0-5.el10_2.2.s390x.rpm c5f1869bf947f5ba08abe3e41b81f1ddb42049c5a9d5be1876eb7140b350524b rsyslog-mmsnmptrapd-8.2510.0-5.el10_2.2.s390x.rpm c5f7b816b6f60d01aa97d2b3eaeb6185d38d3baab4e49ceba1d975e776b7c8aa rsyslog-doc-8.2510.0-5.el10_2.2.noarch.rpm d0db75ed47fc8d888cb8c7c423f927c07b67ef296633a799feaa348cac1a5e74 rsyslog-relp-8.2510.0-5.el10_2.2.s390x.rpm e1dbabac01d7e0306d9cc1f6885c7b9c793c84e18ca054bebe006242e31ea1b2 ALSA-2026:69553 Copyright 2026 AlmaLinux OS 0 1 Low

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header (CVE-2026-15028) * libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libarchive-devel-3.7.7-11.el10_2.s390x.rpm 190f346396e8acecf7287d3458d538f369dbecbeec2d01ab297d74af3d28d221 bsdtar-3.7.7-11.el10_2.s390x.rpm 19c2a0320fc5e8be2fa4f727d0ce3b452327a9964c835f3f35003543e373fcc3 ALSA-2026:70186 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default postgresql-docs-16.15-1.el10_2.s390x.rpm 0ddf8f79be25995220a8503edcf81f31e1f324c39fee88a3eb2354cba7b3d0d0 postgresql-contrib-16.15-1.el10_2.s390x.rpm 16c14e896147718ff4033c914587f4471e46c493455eaecb610dd4231f3d57af postgresql-plpython3-16.15-1.el10_2.s390x.rpm 1e06bf6cfd8375bf5212ce49912c90c87dad137fb3c46334ff858de90cf4ac40 postgresql-upgrade-16.15-1.el10_2.s390x.rpm 1fe4819eba1fa746639dc664e4e54eee498184a2ec8aaaaa68397a2fe18fbbed postgresql-16.15-1.el10_2.s390x.rpm 2731ce240d429a299da6b56e98980cc705fa95c3f259b6b74d4d1755a3801b8e postgresql-private-devel-16.15-1.el10_2.s390x.rpm 31c67476137e46bd5a2c0ce08132c23414d8b8cae8033bc6938bdee5edfddf75 postgresql-server-devel-16.15-1.el10_2.s390x.rpm 5bf950b6d91f148ac301a8efd8f34b5be3e2a3ce5fcfa874cf7301586e2cbc37 postgresql-static-16.15-1.el10_2.s390x.rpm 5ce2e057c50a77c796f20f25f7cd513701d200691310b3507ef34073e77038b7 postgresql-private-libs-16.15-1.el10_2.s390x.rpm 9b98f597bf0195ac2b7e057f1e1e893ec4a8adf222424f45d6dc1d1560f92796 postgresql-upgrade-devel-16.15-1.el10_2.s390x.rpm ba6cf78bee5b547dc9a8b49526255fd98484ef8c9ae7119d60f641125376b652 postgresql-plperl-16.15-1.el10_2.s390x.rpm c0e47978cfa2f775c50e4cba72f841425d0b2d2f5f6459750ddd2d1e31e05872 postgresql-server-16.15-1.el10_2.s390x.rpm dbb8dd80e626e69cb713a77d07a652e0c51a6cc02445821b40e1efa955ff4190 postgresql-pltcl-16.15-1.el10_2.s390x.rpm f15d64362f8ac4cdf7e7d092ffc9c221bd9a40973768d3158d91804bf97c28ed postgresql-test-16.15-1.el10_2.s390x.rpm fbe260084d7d554d8d89b2b32483d4393e298a939f9ccd09b9ca413d210d5a7d ALSA-2026:70201 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * podman: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852) * podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730) * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default podman-remote-5.8.2-9.el10_2.alma.1.s390x.rpm 6c3f885f9c23a7e0d3e26e06a668557dc60b4a0f2dada209744ec8cb9325ac52 podman-5.8.2-9.el10_2.alma.1.s390x.rpm acba4292e47b07b3c4564b756937af49d0dcf4d470a460df00f462be276c93a6 podman-docker-5.8.2-9.el10_2.alma.1.noarch.rpm f46c4a2f1c8d19490236bd31637b67ed406bf45d03eeaf0ed986334693a23e6a ALSA-2026:70498 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518) Bug Fix(es) and Enhancement(s): * Update kernel to use new certificate paths [almalinux-10.2.z] (JIRA:AlmaLinux-169478) * RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:AlmaLinux-255517) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-doc-6.12.0-211.58.1.el10_2.noarch.rpm 2759cf0eebab0e931daf54293a7fa911cfd7d55cdb55ae2d2ad8d9f0fc021217 kernel-devel-matched-6.12.0-211.58.1.el10_2.s390x.rpm 39064f9db62c7c62eb4a3dc47dc26b031541570935b0fe782dc112702d7cb650 rtla-6.12.0-211.58.1.el10_2.s390x.rpm 3d2d6e4b8f75a61d6e8beffcf4d16ff55c342467c9b46fb061170089ff82bab6 kernel-zfcpdump-devel-6.12.0-211.58.1.el10_2.s390x.rpm 547bf85838df532e450318e9385b3ad72e179df604c09bf1a4a37d9d111c3343 perf-6.12.0-211.58.1.el10_2.s390x.rpm 5714a36d9d1446b27f24784300ffa47a1685cf282dfb2e482a02951f54713a06 kernel-headers-6.12.0-211.58.1.el10_2.s390x.rpm 676d36fda8ad5eeffef964e3e7a443376236f46307aab19ae1ac4d36a7230a92 kernel-devel-6.12.0-211.58.1.el10_2.s390x.rpm 94867ec4641da40387f86191415ca2a648f1c4eb2570f6652db7e182246607c8 kernel-debug-devel-6.12.0-211.58.1.el10_2.s390x.rpm 950d876e7793ba1eb1a0a8f1ecdc93cc070b922fd48546ba548db8997b33c589 rv-6.12.0-211.58.1.el10_2.s390x.rpm 9c96c42b66e0f7eaa09d2b7cd7033793d9247fa4cb2b130e40f22e02ae23eea1 python3-perf-6.12.0-211.58.1.el10_2.s390x.rpm ad4ce536bef14578d26c5a0cb459c5c7d8c6e56912155edf49d7f28fac866614 kernel-debug-devel-matched-6.12.0-211.58.1.el10_2.s390x.rpm cd76c447010e02a7e1d6d8b16caed0405597f9a086597db77d09cbbe0bb61497 kernel-zfcpdump-devel-matched-6.12.0-211.58.1.el10_2.s390x.rpm e019547e210b6e2bb5b501be3c0836b8134463c569dc2c75903b8914a14e850e ALSA-2026:70753 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder (CVE-2026-73194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.6.s390x.rpm 563d6522df633db4e7d6d23967a3c4bc989e7f23bfa7ec142085aee322971132 ALSA-2026:71233 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007) * kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) * kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831) * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802) * kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053) * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383) * kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564) * kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569) * kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844) * kernel: net: tun: bound receive headroom (CVE-2026-81000) * kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846) Bug Fix(es) and Enhancement(s): * kernel module .ko ELF files with non-zero sh_addr section addresses [almalinux-10.2.z] (JIRA:AlmaLinux-159298) * sctp: prevent peer transport count overflow [almalinux-10.2.z] (JIRA:AlmaLinux-216247) * [AlmaLinux 10] bnxt_en: RX queue restart failed: err=-95 [almalinux-10.2.z] (JIRA:AlmaLinux-247283) * RHIVOS - S32G: backport missing fixes to 10.2 (JIRA:AlmaLinux-259788) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-headers-6.12.0-211.59.1.el10_2.s390x.rpm 0860bbe4576b023174fa5faf59f3afc64e59dc0c9563819484e27b2f839f80d9 python3-perf-6.12.0-211.59.1.el10_2.s390x.rpm 1800a0a1d1b6824ff4905301fbfe9a0d6d9c26b02df3400455988b0af4d73d16 kernel-zfcpdump-devel-6.12.0-211.59.1.el10_2.s390x.rpm 4c4bea36f530c16dad43ac5b88fded505b77a293c8b84c48034c1eafaa5b0351 kernel-doc-6.12.0-211.59.1.el10_2.noarch.rpm 570136fba25a6b0e607b32762ab0b5f9a1bf9803cf7c18d367189ed301f9afbc kernel-devel-matched-6.12.0-211.59.1.el10_2.s390x.rpm 6a5064d8f364f936a9d305c28205283a2fc477b9af713c8976025791ac598c53 kernel-debug-devel-matched-6.12.0-211.59.1.el10_2.s390x.rpm 75cdfee47a385c1ae956d0e3c5dce8329aa9e2361bbd80fd5866e38c391b6dfa kernel-zfcpdump-devel-matched-6.12.0-211.59.1.el10_2.s390x.rpm 83330cf6f6c7f158aed3ed1f540da2681b99aae4969b5b9d0d013523638fea69 kernel-devel-6.12.0-211.59.1.el10_2.s390x.rpm 8b20796db075a16d4161621f85f1c086bfb40caffdaeb1dad362ec85292de07b perf-6.12.0-211.59.1.el10_2.s390x.rpm b37b8b583f2e805ed79fabc7b84a231e54798e36e7bf102cde60d5b2fdec312a kernel-debug-devel-6.12.0-211.59.1.el10_2.s390x.rpm c9868d01e36b7942124e57fdaf2005c94515d4659f924b0e27bef2d190ba2d7c ALSA-2026:71419 Copyright 2026 AlmaLinux OS 0 1 Critical

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717) * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634) * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default unbound-1.24.2-7.el10_2.6.s390x.rpm 0a4651c829cdd8a59970aca88fb5dd796809b34ddebfadc0c172c4ae69ed7a79 unbound-anchor-1.24.2-7.el10_2.6.s390x.rpm 0e20a73a6811bb9dd4b2e69a8025f7cf82d4eea3c4f4474a03ff34d4cc225126 unbound-libs-1.24.2-7.el10_2.6.s390x.rpm 0eaf1736807dad674ddbb440eff5cad93f1575a6e7706300839fc1f157175d53 unbound-utils-1.24.2-7.el10_2.6.s390x.rpm 3bf3741b4a6f500ecb51e1258d5969840dba3143b8cd5d4b2191cd5d1e9e1819 python3-unbound-1.24.2-7.el10_2.6.s390x.rpm ab05182dcd3626a366c4429269ed9b964315e8b848d12a1780b60a09eca97427 unbound-dracut-1.24.2-7.el10_2.6.s390x.rpm eeadfbf1950ba9abb94f7f24f96e3d59b96e0c076fe2f5c7232337b39ec6b032 ALSA-2026:71543 Copyright 2026 AlmaLinux OS 0 1 Important

cockpit-image-builder security update

The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild. Security Fix(es): * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899) * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975) * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172) * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default cockpit-image-builder-94.4-1.el10_2.noarch.rpm 6d46bc65678588738897e9833c8b0821f6f410eb59d37f70469150a20636cb8a ALSA-2026:71586 Copyright 2026 AlmaLinux OS 0 1 Important

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138) * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143) * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140) * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142) * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144) * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.4.s390x.rpm 8c046755f02c6676a2869f9af79710c4941f681de17f0e1d4f517bfdf561297a ALSA-2026:71602 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323) * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285) * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984) * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990) * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199) * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311) * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005) * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203) * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290) * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098) * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121) * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108) * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257) * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267) * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266) * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273) * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714) * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481) Bug Fix(es) and Enhancement(s): * Bypass DMA APIs for coherent allocations for pre-mapped memory [almalinux-10.2.z] (JIRA:AlmaLinux-252331) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.60.1.el10_2.s390x.rpm 2b2c5dbfbd730ec448b6f0806c8054e9bb10120e946a6df4c857b166fc0d3b46 rtla-6.12.0-211.60.1.el10_2.s390x.rpm 2dfac907bb60f465c677d2244c64392c8909822821e5e326fd3d404144a77f41 perf-6.12.0-211.60.1.el10_2.s390x.rpm 52d299c42dee8d1431e15ad9736e88269e4fd1595b4daffe1d88063cf004ca93 python3-perf-6.12.0-211.60.1.el10_2.s390x.rpm 94474c2b36eac4076819db8d2877221a8dff91fb7c2595a0ae5b0d110d8424aa kernel-zfcpdump-devel-matched-6.12.0-211.60.1.el10_2.s390x.rpm 9697b3287ba18fe49d358a2bcdba2e2f6fc1c36648df5cf4c9066838bf8c4043 kernel-debug-devel-matched-6.12.0-211.60.1.el10_2.s390x.rpm ab2f47a1b65b23ab140b74263d4cb7a69ef4aaeae737b16ad97689bd5ab7c4e9 kernel-debug-devel-6.12.0-211.60.1.el10_2.s390x.rpm b1aa6441be3267e1dc647a37cfb6a28a6854db7675c7f9fd53e5aa89a96b4f75 kernel-doc-6.12.0-211.60.1.el10_2.noarch.rpm bbbe1ee1c8c000232e1f59ed8256dab96ac04d67ae9d73b4bf3a15fc22954391 kernel-zfcpdump-devel-6.12.0-211.60.1.el10_2.s390x.rpm ebec487548ee6208ef6ed2053498169a1edad60f275d6723766a690a35cfe05a kernel-headers-6.12.0-211.60.1.el10_2.s390x.rpm ec84b4f9b79eb3c6f01ea8b18eaddd75f1327cf9565a0ea5321d5aaeac3c0f64 kernel-devel-6.12.0-211.60.1.el10_2.s390x.rpm f5e06c05947b83445889595533f6b9b7a9ac27b1a623995f6f53386b47385c89 rv-6.12.0-211.60.1.el10_2.s390x.rpm f90631fae07b4d831c2bea7e7d21918721681b33b5bc6738c9992fc41b82b8c1 ALSA-2026:72279 Copyright 2026 AlmaLinux OS 0 1 Critical

ipa security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux10.2] (JIRA:AlmaLinux-173375) * WebUI Hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238510) * ipa-otptoken-import hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238518) * host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-10.2.z] (JIRA:AlmaLinux-238522) * ipa env: support only simple * wildcard [almalinux-10.2.z] (JIRA:AlmaLinux-238526) * ipa-epn: drop_privileges method is mixing uid and gid [almalinux-10.2.z] (JIRA:AlmaLinux-238673) * ipa-migrate: require Replication Administrator privilege [almalinux-10.2.z] (JIRA:AlmaLinux-238676) * ipa-migrate tool is renaming host records & host info in automount information [almalinux-10.2.z] (JIRA:AlmaLinux-240768) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-ipaserver-4.13.4-1.el10_2.noarch.rpm 0fd7500513d74955796c1d0fee7ecba945a8e28ace17bbdab27b6aaa886ae8c1 ipa-client-samba-4.13.4-1.el10_2.s390x.rpm 1056359ee37307fba0a7cac5376ed4bf328415a582e3fea714fcba70ee361671 ipa-server-trust-ad-4.13.4-1.el10_2.s390x.rpm 2e7637cb24c9f1e70ad07f3a9ef780bf8f8fef0f2de7c4e02c8c3b27e34a7b1d ipa-client-encrypted-dns-4.13.4-1.el10_2.s390x.rpm 3b4ffcd155e848216870e4ce60c6886a99425e63747fc819f3115ccb9668f8ed ipa-selinux-4.13.4-1.el10_2.noarch.rpm 3bbaaa21c4182fda1a5241bb0f5fc945b4dd8f1295609aea9cabfc4dc827688a ipa-common-4.13.4-1.el10_2.noarch.rpm 4144c11a83aecac08226230567deedacef7facf17ce0a31efefe1a2ad9aaa0a1 python3-ipalib-4.13.4-1.el10_2.noarch.rpm 4becc4f5c6c2c8d32741a3600b8b75f350754d326439bba74ab74eec92cbbde3 python3-ipaclient-4.13.4-1.el10_2.noarch.rpm 75d3397f9faa033046ebf837c3173a3b93b02cb7b7be5d66ee746e74cea35086 ipa-selinux-nfast-4.13.4-1.el10_2.noarch.rpm 898e7d3623722553f2ba1cd2b4a473f852a3e0790749aa320403d269e7a0a24a ipa-client-common-4.13.4-1.el10_2.noarch.rpm 99ad0482c8eaf5ea6a943447eaac1ba10950f97cd551e3ce6c2793f1832e41a8 ipa-server-dns-4.13.4-1.el10_2.noarch.rpm b51948fbd1e5414a345dd9a8a33d2f5c4e174fa72168bdc2518a48180e3894e1 ipa-server-4.13.4-1.el10_2.s390x.rpm b83b09a44b46dc8dadb529f6fbec244878f4ecfbc4136d597995e2cc892efa13 ipa-server-encrypted-dns-4.13.4-1.el10_2.s390x.rpm c7af98970dfc6cb4436a85449d62f327e400ce72ce0f8210132ab4e234577707 ipa-client-4.13.4-1.el10_2.s390x.rpm cebb7ec7f765e3403cae00f6de3d9801803536451e1c0e951d4e999c487c0e0b ipa-selinux-luna-4.13.4-1.el10_2.noarch.rpm d6c79b60b49a1f8f4c6f9bdf660fa53d2910a7593dbace5e93e486cb87b288ea ipa-client-epn-4.13.4-1.el10_2.s390x.rpm dd44e61a8a0c49177ef6ca8ed07bdc9a566a8867db0d134a6e767bf137d2f86c ipa-server-common-4.13.4-1.el10_2.noarch.rpm e77c01557668023ac072b330d723c4dd1555495797742ca39c2e7fef063bc959 ALSA-2026:72427 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ruby4.0-4.0.6-37.el10_2.s390x.rpm 09978745070e0e8889dd13fb1c46c5c22bf06a99e03522abb26767eeb57ac4ba ruby4.0-rubygem-mysql2-0.5.7-37.el10_2.s390x.rpm 4d01cfdb98cb53414cf235e8b5151eb19192e93581cab6468ca46e1429eb0fa5 ruby4.0-rubygem-pg-1.6.3-37.el10_2.s390x.rpm 5f86bca5f7c1d204ee9605b2bc79cc4c91a88fdb5c571b990d9fcd6648fe9530 ruby4.0-devel-4.0.6-37.el10_2.s390x.rpm 9cfd76b7ad1f4700e25854c40a90137cfd38ba35cfa921fa0d092a4e9c6bd8b2 ALSA-2026:72624 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076) * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942) * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317) * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341) * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522) * kernel: perf: Reject exited events as group leaders (CVE-2026-74753) * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480) * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775) Bug Fix(es) and Enhancement(s): * KVM: s390: Limit adapter indicator access to mapped page [almalinux-10.2.z] (JIRA:AlmaLinux-188661) * crypto: xxhash64 should not be fips approved [almalinux-10.2.z] (JIRA:AlmaLinux-254943) * kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ? guest never executes. (10.2.z) (JIRA:AlmaLinux-260402) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.61.1.el10_2.s390x.rpm 19fe99c0485465e4f42c31aae7ad776011c1e25e2381c07ae8e13a191285eb6a kernel-debug-devel-6.12.0-211.61.1.el10_2.s390x.rpm 53785c226919155dc8819ccd34240dc8f544ef64c3d292f60bffe695317cf1de perf-6.12.0-211.61.1.el10_2.s390x.rpm 63574fbfbf52eaf384569b68a143629467f28c667589fe2538b85b11a362c78d kernel-doc-6.12.0-211.61.1.el10_2.noarch.rpm 6d745d7d315fc5f6d99298e2a1473d86795b33684aeb63850538eb9f248208c2 rtla-6.12.0-211.61.1.el10_2.s390x.rpm 786192ef87025e8ed1cc96b6da81380d0bd39dae03fe5977adeb8526be4e64cb rv-6.12.0-211.61.1.el10_2.s390x.rpm 890273b16974361ce0505cdb1280f41b2a36b2e74af9807f0ae1b1ccfb1561cb kernel-devel-matched-6.12.0-211.61.1.el10_2.s390x.rpm 9bc6c4b8545bfbcf8e75e6a6c1ca879346aa50d5171edb61135ac5b14e7e3da8 kernel-headers-6.12.0-211.61.1.el10_2.s390x.rpm a88a70ede9d01807420dd8947c70ab19856ba450c5a6a90df47b8022bf1e738d kernel-zfcpdump-devel-matched-6.12.0-211.61.1.el10_2.s390x.rpm aaa02d3231939912b7ccb47256e18d092154e0919ff4559d239fe6dc01546c96 kernel-zfcpdump-devel-6.12.0-211.61.1.el10_2.s390x.rpm c9c97f0a18d53e62da335882b60f9978f1f83add42eebed824d7f78c43349566 python3-perf-6.12.0-211.61.1.el10_2.s390x.rpm cd4f208fadd705701e5f1b5b5900a6dbf73d1f5c767f374b87e2b62d6186921b kernel-devel-6.12.0-211.61.1.el10_2.s390x.rpm fc0718c2e7b3c32736d1c4bfec2869fa0b1c2ec6c41e5aae95249ee73ea51504 ALSA-2026:72785 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rubygem-irb-1.13.1-15.el10_2.noarch.rpm 109ed4ad1eaa45bf5dd31e4d43f1ae7d8d990a2c4d7eb7d161005b447b9cfc31 rubygems-3.5.22-15.el10_2.noarch.rpm 11349eba9345d9f2cc94bf421e58373e1d5458cbb9114f92d6b98d8207922418 rubygem-rbs-3.4.0-15.el10_2.s390x.rpm 2460344a44be26bfad8574ea9ead9a783127190e65dc430d7c80c7630e906654 ruby-devel-3.3.12-15.el10_2.s390x.rpm 276b4ecf8f16b0bee03e742643964519ed4914b88531bcb7551a51323f7efabe rubygem-psych-5.1.2-15.el10_2.s390x.rpm 3dd6645e690a289ae6e0fa3d02e3f70a2e72fefe5e0ee6facea4ec6e007bba7f ruby-libs-3.3.12-15.el10_2.s390x.rpm 445d2a285fbc9687ead101b4565ee7dab2095130ec6350ed36df0aa8a61c120a rubygems-devel-3.5.22-15.el10_2.noarch.rpm 492612048da0e57f477983879982cb57b3eada4308202c6d3fee92d24838f1e5 rubygem-rake-13.1.0-15.el10_2.noarch.rpm 6c4b9241ff9efa450aa5d3329a216aa37da225de270e1a5fe3f5f832b872e5ad rubygem-json-2.7.2-15.el10_2.s390x.rpm 761f3a788a8fa8d2f8145e3254007e5349beb4b528310c9bf02122e3af6f80ff rubygem-power_assert-2.0.3-15.el10_2.noarch.rpm 854289d012a71949ba1daef7ada1a60911e03ba7ba8676153267c548b6ad62e4 rubygem-bigdecimal-3.1.5-15.el10_2.s390x.rpm 86123c30e018c553fbd00f669149bae97e9fbef16c333358028e0271162eea81 ruby-default-gems-3.3.12-15.el10_2.noarch.rpm 9155f150b9f91e2dafb16414991ca13c36df3f4aee6ca777ca785c0180a1f86e rubygem-minitest-5.20.0-15.el10_2.noarch.rpm 981707b75742760cc5c109ab99fa4285d4062bb296b498d5b21eb4ff7869c5fd rubygem-test-unit-3.6.1-15.el10_2.noarch.rpm 982aad6d4f946198793b11b68f74cc897cad5306f4398bac99c666a1c85bdf92 rubygem-typeprof-0.21.9-15.el10_2.noarch.rpm a685c24c2adbb428ee0cbfe323eb4e6a3c6c342892b6be21a0290944b16acf89 rubygem-io-console-0.7.1-15.el10_2.s390x.rpm b4b653e9319b96dec594cf579c81166f6b770aa43b51a66421071615d5677738 ruby-3.3.12-15.el10_2.s390x.rpm b713c3982b77938e684039354100229dd551a5f5b737694a562f7e0248da3cf7 rubygem-racc-1.7.3-15.el10_2.s390x.rpm c1be192927a2c920c1c1b3f4233db0c156441990b325ddb0d77c27a0ac4758b2 ruby-bundled-gems-3.3.12-15.el10_2.s390x.rpm c2abc63ac69943c817b889502a6924f1d063581e2ec83ad2b86d2aedb1db6d05 rubygem-rdoc-6.6.3.1-15.el10_2.noarch.rpm da102fb3c095a3ec1f34f5f5a2ac9fd136e78f9fb8ae0ed3b5f70b5e93856125 rubygem-rexml-3.4.4-15.el10_2.noarch.rpm e05b865f8e326502a6561acbfe24e18752a7487792d727bb1f7154f70d471abb rubygem-rss-0.3.1-15.el10_2.noarch.rpm f72093880d7151f2ac3049b0131eef30043c09b0a89c1ef075bae97585e288eb rubygem-bundler-2.5.22-15.el10_2.noarch.rpm ff78ada1e367ca1dff09e79265bf4cff6a89438532915087f337c77c7cd2923f ALSA-2026:73130 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) * thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639) * thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641) * thunderbird: One byte overflow read in mail parser (CVE-2026-84640) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031) * firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011) * firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028) * firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013) * firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012) * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014) * firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) * firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021) * firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008) * firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007) * firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029) * firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023) * thunderbird: Out-of-bounds read in IMAP response parser (CVE-2026-92240) * thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line (CVE-2026-92239) * thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers (CVE-2026-92238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default thunderbird-140.16.0-1.el10_2.alma.1.s390x.rpm 5b4fe5c1d53a5239a1ac4f4f9108705b380d3e4000cf26e65d68adee87f40beb ALSA-2026:73427 Copyright 2026 AlmaLinux OS 0 1 Important

gdb security update

The GNU Debugger (GDB) allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion and printing their data. Security Fix(es): * gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF (CVE-2026-13732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gdb-doc-16.3-3.1.el10_2.noarch.rpm 39dce27fc5099ec9272403ef4efccf67f2543fb0057041caf17d6dd68cc06eb9 gdb-headless-16.3-3.1.el10_2.s390x.rpm 42712301679635f1ad13b55122c89410c6a7ac033cd93a94d7f668d2b9bedd59 gdb-minimal-16.3-3.1.el10_2.s390x.rpm 4917677d2af20bbca52f2263400110e1ceeba70bddb215cfb33b720c6ffba14e gdb-gdbserver-16.3-3.1.el10_2.s390x.rpm 7bf851a62635566c705f46c12e74c92332f190b70bf1abce28f9f285313dcd16 gdb-16.3-3.1.el10_2.s390x.rpm f46222d587afb14812debdc850b297f132e4e71021529735d1a7971c811ff803 ALSA-2026:73428 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs24-docs-24.21.0-1.el10_2.noarch.rpm 3c0582da0fa349b5c85a8671a5ccff46d1d89830e1e263672e2e93e4eb5161c5 nodejs24-24.21.0-1.el10_2.s390x.rpm 76bb2e46b4520fd16195e0f62a38a4ed6633fc832dac7b0c8b91e33a27b00179 nodejs24-npm-11.19.0-1.24.21.0.1.el10_2.noarch.rpm c33582aee585c85053bce7f5822e3f7bccd46c315de9ed48e5522daeeeec7080 nodejs24-libs-24.21.0-1.el10_2.s390x.rpm d3dde3cba6582ab3c227d69ee119c10d3a92cb3123ee13b7c95f10703dc67925 nodejs24-full-i18n-24.21.0-1.el10_2.s390x.rpm d6b93fe50cf7a82e17b8506cfeaf666e499bfc7980106addca5d87c688d25678 nodejs24-devel-24.21.0-1.el10_2.s390x.rpm e54f67d563bcd6043723d1f2180496383fd31e370c7cbd7e5bda526ed49dcd81 ALSA-2026:73429 Copyright 2026 AlmaLinux OS 0 1 Moderate

gawk security update

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs. Security Fix(es): * gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468) * gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service (CVE-2026-40553) * gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gawk-all-langpacks-5.3.0-6.el10_2.1.s390x.rpm 0c4ddf0cb2a9155adbe015e281de163345a4a5e66faea6029f829c086ccde3da ALSA-2026:73765 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561) * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default idm-pki-java-11.9.0-5.el10_2.alma.1.noarch.rpm 0cdf052ebc4a0c8e950bbeca80d0f2c7c6760d139c66043c04ced088658411e4 idm-pki-ca-11.9.0-5.el10_2.alma.1.noarch.rpm 222cd95d6a7904a983de39241895dd9acb151c45c8a7491e9550adc37bd65352 idm-pki-base-11.9.0-5.el10_2.alma.1.noarch.rpm 582d387b6396d8e4e698857b48390f3d102d7ac512738e3cc874874c5c912711 idm-pki-server-11.9.0-5.el10_2.alma.1.noarch.rpm b0f00e34f7b8789bf4cf070694a5cd3513616af2667ab61700b8c68820ad419c idm-pki-acme-11.9.0-5.el10_2.alma.1.noarch.rpm b5bef02548113c0fa533f73999506eb0f9f5ed8060cc5870f5a024cfe04b38f8 python3-idm-pki-11.9.0-5.el10_2.alma.1.noarch.rpm df55263895dce79bb1709226dd320f18f208f120a85e935cfa2ab9bc787fdda0 idm-pki-tools-11.9.0-5.el10_2.alma.1.s390x.rpm e0a8af5c27de6a7a9b3660c6f42a95647c691198c05005f5bde9400f8989f39c idm-pki-kra-11.9.0-5.el10_2.alma.1.noarch.rpm e5fda389acc85e9115f766d485557babdcf49b10683904f1114a8015fcfe0ae7 ALSA-2026:73954 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay (CVE-2026-60001) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssh-keysign-9.9p1-28.el10_2.alma.1.s390x.rpm 7f50dc1afd2abdbe46e8098f95a92fe0fcae49b537f3593649fbe5db4263e9f5 openssh-askpass-9.9p1-28.el10_2.alma.1.s390x.rpm dc1513732e12bf9f8b0112431af7fd4ca81f906cee0ab4f230332bad7ed206a3 ALSA-2026:73979 Copyright 2026 AlmaLinux OS 0 1 Critical

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.13.s390x.rpm bd7eaa63cd849da535d4f4fe1528556468731321b1925cf127ada3a814e2b96e libwinpr-3.10.3-12.el10_2.13.s390x.rpm d5db416fbb4cd3540dc3b955a00029b46a6539122438b16a553a53d4a6131fd6 freerdp-libs-3.10.3-12.el10_2.13.s390x.rpm e8f66af3504a892bd6caa36c202c6138349d210fcf997076ab5251fb19ed4e46 ALSA-2026:73998 Copyright 2026 AlmaLinux OS 0 1 Important

gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer. Security Fix(es): * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268) * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gvfs-fuse-1.54.4-4.el10_2.1.s390x.rpm 021802caf27c5ae148673a30c9350185a076c36eca10d02dbca12b7eb15dc72c gvfs-goa-1.54.4-4.el10_2.1.s390x.rpm 25c33ab30ad5982d706b18880ee60076ec6f35d37b70b97f087ac47df4918386 gvfs-1.54.4-4.el10_2.1.s390x.rpm 371b685ff73c813527157d935b5e8b65c2414ab438c6cd9ee6b07ffb372d4768 gvfs-client-1.54.4-4.el10_2.1.s390x.rpm 425c99e53945e85a0d5458f8889afe6bcf66fd5cac41886adcf406329503ffcf gvfs-smb-1.54.4-4.el10_2.1.s390x.rpm aad08f1ef49c8b640d1d5d54727c4acabdacd90af86afdc31614e4bfae7e06f1 ALSA-2026:74001 Copyright 2026 AlmaLinux OS 0 1 Important

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046) * expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.5.s390x.rpm 2cc341d23f8a1bd184352d268a97cdb55dfa820adeaa2c1756e318f1eb5658f4 ALSA-2026:74464 Copyright 2026 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ghostscript-10.02.1-16.el10_2.1.s390x.rpm 081ee0d19e63e79c1a47030d7991312afbd80ba7a6f33fa4228522a1e7445df0 ghostscript-doc-10.02.1-16.el10_2.1.noarch.rpm 617175f855bb442ae2b330cea4f12398f5b091a7d462994c072769221b20c59e libgs-10.02.1-16.el10_2.1.s390x.rpm 9f83208d199caacb89425454e73a8c91e2ce4ca489413ac76071c67282c9b422 ghostscript-tools-fonts-10.02.1-16.el10_2.1.noarch.rpm afeee0186e3b8fc2a1465593bc73b907e5983363ee869023e04bdc397fa74493 ghostscript-tools-printing-10.02.1-16.el10_2.1.noarch.rpm c49fc8445ae5065659355a423f7eff2b5067e08b45ae02b7062620618b3b5cb2 ALSA-2026:75570 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089) * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) * FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) * FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947) * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950) * FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960) * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default freerdp-libs-3.10.3-12.el10_2.14.s390x.rpm 5c145e975dc076e8f8c125f66d7e7e9222c2c5bbf4177e6ef604a16e2e5389a0 libwinpr-3.10.3-12.el10_2.14.s390x.rpm 66d077e36e82aba0190ad7bf44d992226022da5397aaa68cab62e3fe4cc0be49 freerdp-3.10.3-12.el10_2.14.s390x.rpm ee0a9980bec2413cfa3d48a98389376e0ebc8f6dfecd30d165d392e7321ec456 ALSA-2026:75576 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099) Bug Fix(es) and Enhancement(s): * gve: backport large queue depth patches [almalinux-10.2.z] (JIRA:AlmaLinux-219261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.62.1.el10_2.s390x.rpm 06e20cf827268e07c94aa98a4407715d50afd32b9ab9ac83bd3533edbceef396 kernel-zfcpdump-devel-6.12.0-211.62.1.el10_2.s390x.rpm 17a5791ae2f8a5f88b3cec2af9b8b3e8e69ae0523675c4840b36d088e70a07f8 kernel-headers-6.12.0-211.62.1.el10_2.s390x.rpm 329d11aa6cb1a27d6ba2d267fe8fdab86ee75fd422524febb1152716addc7a20 kernel-debug-devel-6.12.0-211.62.1.el10_2.s390x.rpm 35df7e3099fd983763921be63febf60c0266168bc94f85554e6dc2cb546cc4ef kernel-devel-6.12.0-211.62.1.el10_2.s390x.rpm 374576df9af6f0c7013e498943889f385bdf5850bb15533bbe94bd34906914e0 kernel-doc-6.12.0-211.62.1.el10_2.noarch.rpm 4651096af1f2c0d1dadca18c541eee91d0617eff4471a68b40d10def0058f9c3 perf-6.12.0-211.62.1.el10_2.s390x.rpm 7a24e532f7e160e9bfdae40c97bdfc1794901ad92cc514b8641e85a9e8b55941 python3-perf-6.12.0-211.62.1.el10_2.s390x.rpm 8d9b852f3f98bc2b187cc0b8e68b5c93ed8ee9223262806860b2b2d6c016c164 rtla-6.12.0-211.62.1.el10_2.s390x.rpm 97487f7bdcac5a4d689be5c562f1fe779cf8ec91e00986e0c5f3be5374315a41 kernel-devel-matched-6.12.0-211.62.1.el10_2.s390x.rpm de89afc61f82e1142ac6a161db855e4fc3afa00a8f744247a7f2f8560db7f619 kernel-zfcpdump-devel-matched-6.12.0-211.62.1.el10_2.s390x.rpm e56faa10de95287667b39e8c5ed164b22be708188fe7bd922efaa49d49201da1 rv-6.12.0-211.62.1.el10_2.s390x.rpm e70895776136763f76df35e2734a0ab139f132d66792c68e2409b5e29ff7febf ALSA-2026:75577 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736) * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default bind-9.18.33-15.el10_2.12.s390x.rpm 442437ed08b1fc4e222ad3b4941ac7c54cc8628545889a43124664dbc2c56c1f bind-chroot-9.18.33-15.el10_2.12.s390x.rpm 59c9d80c05cdc42798b795f929467b8ca0fdce4420f96ba54dd68835523fc3b3 bind-dnssec-utils-9.18.33-15.el10_2.12.s390x.rpm 9ec8bea062e800ac98983228ddc6590591fe8709947c6cdcb3d632b21fff7ff1 bind-license-9.18.33-15.el10_2.12.noarch.rpm cf3c504a9857ffd2222e1db77e1c60344ac788c5662696ad6ef92bbac52bdf0b bind-utils-9.18.33-15.el10_2.12.s390x.rpm e9629c858f6671b315c6412545ea3a0639f951f860a19c64459fea58fd6e48b3 bind-libs-9.18.33-15.el10_2.12.s390x.rpm ec63f7297e4f998bafe2acb1490b856ee2d80c2c294684c6d07defaa9e45dc1f ALSA-2026:75579 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-10.p2.el10_2.7.s390x.rpm 8d6988fe8c9a1c8b7d7445d47a241d1e1ea026f19640b0f1485cea20b7fc74ea ALSA-2026:75581 Copyright 2026 AlmaLinux OS 0 1 Important

mod_auth_openidc security update

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mod_auth_openidc-2.4.16.11-1.el10_2.1.s390x.rpm 754f969fd2bf048d0e46042f7964c92d458bc1a3c8c0c3e66c400539c828bd2c ALSA-2026:75583 Copyright 2026 AlmaLinux OS 0 1 Important

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622) * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917) Bug Fix(es) and Enhancement(s): * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-10.2.z] (JIRA:AlmaLinux-186019) * virsh dumpxml missing one SCSI disk when VMware VM has 64 disks per controller [almalinux-10.2.z] (JIRA:AlmaLinux-191267) * libvirt-guests does not work together with virtlockd on shutdown [almalinux-10.2.z] (JIRA:AlmaLinux-224982) * Expose guest-get-devices in libvirt-api [almalinux-10.2.z] (JIRA:AlmaLinux-243305) * allow hyperv pvpanic "device" to process Windows crash dump [almalinux-10.2.z] (JIRA:AlmaLinux-242547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libvirt-daemon-driver-storage-core-11.10.0-12.9.el10_2.alma.1.s390x.rpm 06d8d2132a06f8dfc7835fe0eba20c8ca1ad28b04c6dd4e88e4f383532fc9b94 libvirt-11.10.0-12.9.el10_2.alma.1.s390x.rpm 129e58e97449befa4233451a19f589efda5e94a31e414f174460c86e0b71e72b libvirt-daemon-driver-storage-scsi-11.10.0-12.9.el10_2.alma.1.s390x.rpm 1c9c26d8aabc372193fe79df31116bd0cbbd7c295bedd164e9194b33fb74238c libvirt-client-qemu-11.10.0-12.9.el10_2.alma.1.s390x.rpm 1f3bb047fc2cad2dc761390bf1310fbf81dd1f0c5f15015f4835eb16f262f5ab libvirt-daemon-kvm-11.10.0-12.9.el10_2.alma.1.s390x.rpm 23ae92bab1556e3725579d5328836392e1459e45c5ff288b4fa5bc69412aa2fa libvirt-client-11.10.0-12.9.el10_2.alma.1.s390x.rpm 2458d400454197b2e57771e0b246ff3d52d002d479f7f0ead309a62e9de3a192 libvirt-daemon-driver-qemu-11.10.0-12.9.el10_2.alma.1.s390x.rpm 2592c5e4d2590f28a4c6679d2aa77c5e92f593cb114c9db21b04ea03e0caa543 libvirt-daemon-11.10.0-12.9.el10_2.alma.1.s390x.rpm 2948087d4ea08a510b6a89d6145bc424c4e81480968f37efff1236a9ab82204e libvirt-daemon-driver-storage-iscsi-11.10.0-12.9.el10_2.alma.1.s390x.rpm 3111145595e255822c743beb70f9258313d57ec8d7d38e7d715ce12efa00a025 libvirt-daemon-proxy-11.10.0-12.9.el10_2.alma.1.s390x.rpm 3808c11228620fc5525087d75faad90c316ca8a80bc98f962ab53623df5e1a26 libvirt-daemon-driver-storage-mpath-11.10.0-12.9.el10_2.alma.1.s390x.rpm 3bc546e9a902c124ac20ffb32dfe917fc6f1ab92dd94f954e2597f36214fe8c6 libvirt-daemon-log-11.10.0-12.9.el10_2.alma.1.s390x.rpm 52a1a7d441c5035a228378ebadb4badfcce4b2f04760da841afec20bbdbe3a2c libvirt-daemon-config-network-11.10.0-12.9.el10_2.alma.1.s390x.rpm 5582bfd57391fb62434dc9de3f4992d3f6b0049533b4f9cf16556862709d4a80 libvirt-daemon-common-11.10.0-12.9.el10_2.alma.1.s390x.rpm 56b878fe13463998cb6b87d73f841821ab0f1938289ab8327b2412b6a6534c67 libvirt-daemon-driver-secret-11.10.0-12.9.el10_2.alma.1.s390x.rpm 616bf0bcc9b9167a74baafc54fff5d48149c0ca598564d2b7a1b7ed2a0b8763e libvirt-daemon-plugin-lockd-11.10.0-12.9.el10_2.alma.1.s390x.rpm 78a9b9174cdea0998b56520789ed92cfcc1e911835313074238d1a4d477e17ee libvirt-daemon-driver-interface-11.10.0-12.9.el10_2.alma.1.s390x.rpm 7b5a22467760843da9c003f2de935aad784087a3ad2cea5221377a7cfddc1a46 libvirt-daemon-lock-11.10.0-12.9.el10_2.alma.1.s390x.rpm 8cefca89f8512210cf659426d12eef3034df0b0ba77d97cf0a61462f48468e23 libvirt-libs-11.10.0-12.9.el10_2.alma.1.s390x.rpm 944045b73a81fe66f254f2af56aa8115b1f0e46ef8cf17779d07451cd9167d8c libvirt-daemon-driver-storage-rbd-11.10.0-12.9.el10_2.alma.1.s390x.rpm 9dc4c9ed9f82ff9ddc38d6c26dd30cf7aecdc41de25fe61dbb779c48da2a40a0 libvirt-daemon-driver-storage-11.10.0-12.9.el10_2.alma.1.s390x.rpm a88eaaca9d3bed5415b60693f2413ebc8822e3670b47e151babe5307b3212e11 libvirt-daemon-driver-nwfilter-11.10.0-12.9.el10_2.alma.1.s390x.rpm b73624007e87b46745499b9762ea5660c5783d76259f691085a4a3829ace6700 libvirt-daemon-driver-storage-logical-11.10.0-12.9.el10_2.alma.1.s390x.rpm b9761f35d43bac1c7b09ae97f29c01a8919c69fb2fda963c18a1110cb3c2e81a libvirt-daemon-driver-storage-disk-11.10.0-12.9.el10_2.alma.1.s390x.rpm bc90bcd2525e8707616ea4d8079457f97d764d9ce818f06e04bbe8ff73b5f84c libvirt-ssh-proxy-11.10.0-12.9.el10_2.alma.1.s390x.rpm c5d1eca48ff6db38900df4797c0c43430ad930858792e1ba686ae44bcaccce2a libvirt-daemon-driver-nodedev-11.10.0-12.9.el10_2.alma.1.s390x.rpm d8736b199ed60ab2ba7d37bbf3e56b1fcbaf640a3001dac890d7f0f2a9962625 libvirt-daemon-config-nwfilter-11.10.0-12.9.el10_2.alma.1.s390x.rpm e6324be720ae87e85ae4d5e42f61158897e3afcf4a484c2b17c8a7d46cef2cd6 libvirt-nss-11.10.0-12.9.el10_2.alma.1.s390x.rpm eb624b830f631c0edee4d41f322fc9c78da44c5461cdedcaf9480e3d3c7456be libvirt-daemon-driver-network-11.10.0-12.9.el10_2.alma.1.s390x.rpm f6e2e7083df741700f234093be8abc28180144273471899e786b9a1c54a8515a ALSA-2026:75769 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-73073) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default xxd-9.1.083-9.el10_2.22.s390x.rpm 3d873864fff17492e2afefb963d8ae8774fe0715f2cc75e3be8f5c789892b481 vim-common-9.1.083-9.el10_2.22.s390x.rpm a2bd9d072f9632743bc1660b40fa19e747a4bff80ec81d19413332ef4cd828f6 vim-X11-9.1.083-9.el10_2.22.s390x.rpm cbc9681cdd3835920179641dcfa03c08b720ea135727d698264e1b34475a3681 vim-enhanced-9.1.083-9.el10_2.22.s390x.rpm eee7e61b589e0784484a5293498741903cefbb26d3671be482091cdc91b8f837 ALSA-2026:75864 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default nodejs-22.23.2-3.el10_2.s390x.rpm 1d9ece426ed501ff50c752df319885a89d5e3af6c6fb19f632ecf510bf0981fc nodejs-docs-22.23.2-3.el10_2.noarch.rpm 214fba9be3d9a6ef94f9450d61364b06af4c6aa7e8bf11fcc46229596bed6a07 nodejs-libs-22.23.2-3.el10_2.s390x.rpm 597d1fb2fa9ef7b7023ecf10a6b75165ed7436d8328cf04c0a3b9c50c4a831e9 nodejs-npm-10.9.8-1.22.23.2.3.el10_2.s390x.rpm 5c3c8848f68f588ec1bfb321756ea06c5442b5a36ebd65746d6aec6375774a82 nodejs-full-i18n-22.23.2-3.el10_2.s390x.rpm 6b70ba7f827639b1d1aa5e514e1ac40b36ab807fd3ba7fbca8db3b8f5494e715 nodejs-devel-22.23.2-3.el10_2.s390x.rpm e0dc5237da26b2b3dabf2e47b8d02dde81f3aed453a232d46960a9ddd04c739c ALSA-2026:76735 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sqv security update

A simple OpenPGP signature verification program. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default sequoia-sqv-1.3.0.2-1.el10_2.s390x.rpm 3f15ab5422cfdda8fcdf4f1f341562f2e134a2b8f83c61caf1586eeabaf4a9fb ALSA-2026:76737 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sq security, bug fix, and enhancement update

Command-line frontends for Sequoia. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) Bug Fix(es) and Enhancement(s): * Unbundle capnproto from sequoia-sq [almalinux-10.2.z] (JIRA:AlmaLinux-177547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default sequoia-sq-1.4.0.1-2.el10_2.s390x.rpm b279fc5e220c4abae14e508af6118b098ca8188735de2ac8c119c3291f6eec0e ALSA-2026:76738 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860) * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270) * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357) * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992) * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994) * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078) * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132) * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557) * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255) * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516) * kernel: packet: use consistent hard_header_len in non-ring send paths () * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582) * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775) * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921) * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972) * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227) * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) Bug Fix(es) and Enhancement(s): * wifi card breaks using FIPS (JIRA:AlmaLinux-257457) * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-perf-6.12.0-211.63.1.el10_2.s390x.rpm 00dc0fd96d9bae1b24a68c1a79387a552b8c231a0ff4709bf84d946ea50e93f6 kernel-devel-6.12.0-211.63.1.el10_2.s390x.rpm 27dde184d4abb8b22a6ae75c48def8634e7130c0a291f3004fa09cf7a56c0a09 kernel-debug-devel-6.12.0-211.63.1.el10_2.s390x.rpm 431f75dd2dab9c58b9033e792d4509428e35b74e7608e6aa4ef71037c7fa5d5e kernel-doc-6.12.0-211.63.1.el10_2.noarch.rpm 4e40163bf75706368e25c8afc3979c308c7fb0ca59fb79c24d6c10fe3130f8f9 kernel-devel-matched-6.12.0-211.63.1.el10_2.s390x.rpm 63893507cf5ac308ff2bbb8212acd1a95591c12be313f39d79a336118acee921 rv-6.12.0-211.63.1.el10_2.s390x.rpm 726054bf3bc85cc570d5f7fc84898c8ee4b353040896fe3dc6482154117d8cc7 kernel-zfcpdump-devel-matched-6.12.0-211.63.1.el10_2.s390x.rpm 92b9d9f39ca19abe431d27f5b0078569f30e9285b4ed3f0b6eff35844a5e53ba kernel-zfcpdump-devel-6.12.0-211.63.1.el10_2.s390x.rpm 94ecfa70340b2a2f8d5ace04257fedc24db43ebe5cc7eaeccbddddd3fcb6673f kernel-headers-6.12.0-211.63.1.el10_2.s390x.rpm ae3976608d72f72390b172bac3bc59c44a82d9ef518bea579062b2e5fd014db8 kernel-debug-devel-matched-6.12.0-211.63.1.el10_2.s390x.rpm b96108a2c636338bd45da25dfbf65e7597f72a0c0cfa970bdf04f3cb216f8ac3 rtla-6.12.0-211.63.1.el10_2.s390x.rpm bc4aa045668be93cfeb20842f60c0a4839ee132286de680b3249f516b943febd perf-6.12.0-211.63.1.el10_2.s390x.rpm d28fb022f7b15bd4a1a5f03a92bb11825118229c6c9dec645aa030569fe76d28 ALSA-2026:76743 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests (CVE-2026-84445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default opentelemetry-collector-0.158.0-1.el10_2.s390x.rpm e8bbc3557ee6395a37c6d29a658e46b1df55b748fd0ba24daa6e8b29db01454b ALSA-2026:76762 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.7.s390x.rpm d2933c68a4e77617bdb250d8b23fb930613ea0420d24ea1d3718eba50bfb8dca ALSA-2026:76781 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368) * glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791) * glibc: Buffer Overflow in strfmon right-justification padding (CVE-2026-19499) * glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542) Bug Fix(es) and Enhancement(s): * The iconv utility no longer returns exit status 1 after a successful //TRANSLIT transliteration * A counter overflow in __wcsmbs_clone_conv that occurred when setlocale was called has been fixed * A fcntl.h header conflict when compiling on AlmaLinux 10 has been resolved * Minor documentation improvements have been picked up from upstream For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glibc-utils-2.39-142.el10_2.alma.1.s390x.rpm 1aeb10a2226b2cb3c7fdd31b521a830cc34c81ac4656800e55e1cd8b3c8bd3bf glibc-devel-2.39-142.el10_2.alma.1.s390x.rpm 32e8132ccea77fb4efe582807835a8b9207713523d80e0f2c2a447680492bf56 glibc-locale-source-2.39-142.el10_2.alma.1.s390x.rpm 5a1d8949358a495cf857d121bb3e76461165aeb346459f1860352246d625c5d2 glibc-doc-2.39-142.el10_2.alma.1.noarch.rpm 9ff671a257df14b19f73a58d114b8b73bcc77d16d5944e412b42babfd68bffd5 ALSA-2026:76918 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssl-perl-3.5.8-2.el10_2.alma.1.s390x.rpm 68203f72f4f3666d60056884126a4520e0363b3d7d1c338eff6c25ae929c2e97 openssl-devel-3.5.8-2.el10_2.alma.1.s390x.rpm ac60eaacec698e1d022c7372d6f90222018352788745459b73e1ff6b6ac5bb8f ALSA-2026:77018 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3.14-3.14.8-1.el10_2.s390x.rpm 3f75384cbd9237c6d70e28d28099719c9b549427d23f7bfb8440102a04f62039 python3.14-tkinter-3.14.8-1.el10_2.s390x.rpm 698aaf279fd7ec9ebf5071058cb5ed14dec31429e71c967f04455f9c7bfbb22e python3.14-libs-3.14.8-1.el10_2.s390x.rpm 7c9943071c04c0be0c444a76818d924f9a5cf3c11a7c7b916c85a95fc2f88ca1 python3.14-devel-3.14.8-1.el10_2.s390x.rpm d2f6627f38cb24837ea8819edd4f649a5bc569fc48e1f31678ac92df7838f94b ALSA-2026:77020 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-tkinter-3.12.15-1.el10_2.s390x.rpm 1c7d9341ebcd93d4da0707223bfae539eb4b412a23ba5ff3bbf713be523b104b python-unversioned-command-3.12.15-1.el10_2.noarch.rpm 8c7ff57dbefad31a537c80cf34212f88d1136e20c2922150444565e58eb8d223 python3-devel-3.12.15-1.el10_2.s390x.rpm d2a81fe08c0a2e307e3eca10428af5a37f47685feb8715d658b2ddf096870ab9 ALSA-2026:77534 Copyright 2026 AlmaLinux OS 0 1 Moderate

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation (CVE-2026-87853) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default sssd-idp-2.12.0-3.el10_2.2.s390x.rpm 3e643d07cea6784ff51b87e933bc09babd3818787ae4caa75c900f0c9d8c88f2 ALSA-2026:77648 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default idm-pki-base-11.9.0-6.el10_2.alma.1.noarch.rpm 08cad358e01aeaea12f186ece0391cb7e0364ef41ceeff79643cc2483d3f898a idm-pki-ca-11.9.0-6.el10_2.alma.1.noarch.rpm 29d3862dababdb52efd6b9b8d0372dc5651d36ee8ddf03be663bce826f8057f7 idm-pki-acme-11.9.0-6.el10_2.alma.1.noarch.rpm 7f0b192b8db647fca321e71a6b228288db085e67440a44ed2a3b091c5afc2756 idm-pki-kra-11.9.0-6.el10_2.alma.1.noarch.rpm 980108ca4a2ba723015accc088c6d78c8156b9f1376730f10dcb357a939fa7b6 idm-pki-tools-11.9.0-6.el10_2.alma.1.s390x.rpm c4c46530783dd2071adfb4586097c7ae6f939828edcc6ac9b1d9a1b6e968ae73 python3-idm-pki-11.9.0-6.el10_2.alma.1.noarch.rpm d22e7c708f2b9d42c11a0567e3ec0d29b0d6c46728b35bb961574ffc6c76b8d2 idm-pki-java-11.9.0-6.el10_2.alma.1.noarch.rpm e127ae2fe0297a6c06dbbd9e5f26fe945b6221de37834b8e268f77e123acb422 idm-pki-server-11.9.0-6.el10_2.alma.1.noarch.rpm e3e12ed856ec63faff76d4dccd1667fa768ec21c075cca9878222449ea115cbc ALSA-2026:77690 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103) * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360) * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365) * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398) * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970) * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035) * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115) * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744) * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690) * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669) * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530) * kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (CVE-2026-89676) * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663) * kernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675) Bug Fix(es) and Enhancement(s): * mlxbf_bootctl: driver update to Linux v6.16 [Nvidia 10.2.z FEAT] (JIRA:AlmaLinux-212709) * [GNR-D] missing interfaces tspll_cfg [almalinux-10.2] (JIRA:AlmaLinux-273805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rtla-6.12.0-211.64.1.el10_2.s390x.rpm 009de1bb5110c8494adc79220b921e871fbaad1d7c9d405eb23054f3c4b67b9b kernel-debug-devel-6.12.0-211.64.1.el10_2.s390x.rpm 00ccf5581dbe193e9af79a539fbcdc64c1df8f72f5877c4fd2d079e1dbf7ecac kernel-devel-6.12.0-211.64.1.el10_2.s390x.rpm 0d164d78c772ae4bdb4b7ef93ea0a857c5285b621fbba0952ef5b4a1f4a3912f kernel-headers-6.12.0-211.64.1.el10_2.s390x.rpm 2d7aa1d7ad32fd7a92f87df29402169bc0818b39fc27902d5aca89cca98513ed python3-perf-6.12.0-211.64.1.el10_2.s390x.rpm 32c7bb39960290ca31cfdc312763cd2e996a1d1583f5dd86a42154468390768d kernel-zfcpdump-devel-matched-6.12.0-211.64.1.el10_2.s390x.rpm 3e71a31ea9e29e2cdde07bf26ceabab6dc9462ff5678d75a71f56a4022ac3bb6 perf-6.12.0-211.64.1.el10_2.s390x.rpm 43369d4621ab4d8aa2d73b9a070e58d0d1cd7cde75475843acc7f9e0d34fc5f9 rv-6.12.0-211.64.1.el10_2.s390x.rpm 580c41ec2815fdc13dbc149bf453099293069ab3df94d0d62a791321e330f322 kernel-doc-6.12.0-211.64.1.el10_2.noarch.rpm acf673cac34caad11b9a79021df322d42655a2b4d8c23977bfc8bd93706609ff kernel-debug-devel-matched-6.12.0-211.64.1.el10_2.s390x.rpm b16e3ac632528682c752d8d676d633be543d6ef959cb90a45ae6014ee8b0ffa0 kernel-zfcpdump-devel-6.12.0-211.64.1.el10_2.s390x.rpm b38577e7d17b8f02ac2181a9f593a3dd68aa5f8582983584b6b424992f99d7b3 kernel-devel-matched-6.12.0-211.64.1.el10_2.s390x.rpm c52a7765ca9ec1d7d5c52e39ecabf631a6b0aaf817f2dab7a32f10147c70cf35 ALSA-2026:79122 Copyright 2026 AlmaLinux OS 0 1 Important

cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default cjose-0.6.2.2-7.el10_2.1.s390x.rpm 088c4fc5ebedcd129e06937b1c173f3c4c9ce6f09e0c61d72c35646dec663188 ALSA-2026:79371 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dovecot-pgsql-2.3.21-19.el10_2.8.s390x.rpm 03ecd2269af163c906ac0d6b6aeca379b36f82ce1a9cea0bcd3c1635a1231669 dovecot-pigeonhole-2.3.21-19.el10_2.8.s390x.rpm 3a642ce7897a27eef503dfe6822bd7f01aa0d3ee555d463c3c1e74bb54b97f70 dovecot-2.3.21-19.el10_2.8.s390x.rpm 5a19db770673181e0e4dc560c2c5a528508ddd8d409ad8c98f3885513f44341c dovecot-mysql-2.3.21-19.el10_2.8.s390x.rpm d95b5887172f656cf1c2ec1d6b3beadce6f1aca5eb9a82d10460f61b015f36fe ALSA-2026:80495 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es): * flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default flatpak-builder-1.4.4-1.el10_2.1.s390x.rpm 72026f236d609b884f079c03a4a9225372aaf90bea72cddd02dd95da0164940b ALSA-2026:80498 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275) * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default flatpak-selinux-1.16.0-9.el10_2.4.noarch.rpm 172e1711504e739522ae1206e914d28afb7a6412e2819c17a2f06a084ed5aec3 flatpak-1.16.0-9.el10_2.4.s390x.rpm 6f7b1e68f747db676fac5b332a99becb98f12faea2cc9c84a5bd011801d2f1b5 flatpak-session-helper-1.16.0-9.el10_2.4.s390x.rpm 7b777114ada0e0d1fddf85474b360fc8def42f204339eb067652add62b407d5b flatpak-libs-1.16.0-9.el10_2.4.s390x.rpm c53e8819ec20361ef454a0d25ed40ec9c892c1e85c8487da1bb390025e1d68f0 ALSA-2026:80512 Copyright 2026 AlmaLinux OS 0 1 Moderate

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253) * curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545) * curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429) * curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168) * libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.7.s390x.rpm cda5ebc112b48c8cbf83bdd7401f5dad4af6e768c95bab359b680731d6bfe19a ALSA-2026:80605 Copyright 2026 AlmaLinux OS 0 1 Critical

cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default cjose-0.6.2.2-7.el10_2.2.s390x.rpm aed38dbfe56c465d8f1ae0435f0bbff3e6c8acfadeaef3f4ef5c77c88ceea829 ALSA-2026:81406 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332) * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385) * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508) * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507) * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123) * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521) * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970) Bug Fix(es) and Enhancement(s): * net/tls backports for 10.2 (JIRA:AlmaLinux-275027) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default rv-6.12.0-211.65.1.el10_2.s390x.rpm 0348b535cce50db07d3df4c53c75526d66f5517ee37dd81eea73fbf2b0fa3797 python3-perf-6.12.0-211.65.1.el10_2.s390x.rpm 0bd08fc881bbcf1bb311919fbc0b7ec41ae8448fdd2ca4729e5e00a0454f35e9 kernel-zfcpdump-devel-6.12.0-211.65.1.el10_2.s390x.rpm 24d90ee1083fcaa5c9715deac90bf2e6330185a506d882029503115d44a1da1c kernel-zfcpdump-devel-matched-6.12.0-211.65.1.el10_2.s390x.rpm 3d0f6a7be8f05b65751d29ca6165ab3d436a5725a861252ab1192eef046d2d69 kernel-devel-matched-6.12.0-211.65.1.el10_2.s390x.rpm 4a9549a595b010463a7b9cab3b029af22aefdee4aa10e0d5add750d1a06efdad kernel-debug-devel-6.12.0-211.65.1.el10_2.s390x.rpm 4c3b9cc805bab2f82d63dec63944736d872cc31db7a5382063d33e4f4231b7c4 kernel-debug-devel-matched-6.12.0-211.65.1.el10_2.s390x.rpm 5967dd01976aec56cde48f254b654e970535664edadec54bd2edfd7ef9d3f746 rtla-6.12.0-211.65.1.el10_2.s390x.rpm 6742856274f1653297fa98e91337971cbc25a489a6c14069478275bfdbe654be kernel-headers-6.12.0-211.65.1.el10_2.s390x.rpm 908aebaa0b807d2ea7e9ac42bc4390a12e7829f4d98329077c8580f2d027ba00 kernel-devel-6.12.0-211.65.1.el10_2.s390x.rpm a814244cd9656dec344f5683897661bc8adb5e36240769b061c1da93c0e93283 kernel-doc-6.12.0-211.65.1.el10_2.noarch.rpm b35f6a677826f22ce14c1a40eace7076869d953b08049e8332f8de56535432ee perf-6.12.0-211.65.1.el10_2.s390x.rpm f6243b5196cf70c7ce0e5a6d719378636fb26c41963e08771204929d9522a3aa ALSA-2026:81518 Copyright 2026 AlmaLinux OS 0 1 Important

gd security update

GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats. Security Fix(es): * libgd: buffer overflow when processing specially crafted GIF file (CVE-2026-9672) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default gd-2.3.3-20.el10_2.1.s390x.rpm a6c16dd8b3927ff3c04eb4f1ba2bbe169a778b10324eca218afcec5b639f66df gd-devel-2.3.3-20.el10_2.1.s390x.rpm fca28faf3296c4243f8109014a3b594700de409c1b194a34d23aab1a40ff4a21 ALSA-2026:81522 Copyright 2026 AlmaLinux OS 0 1 Important

pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback (CVE-2026-89156) * pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157) * pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching (CVE-2026-89160) * PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default pcre2-devel-10.44-1.5.el10_2.s390x.rpm 7766f1173951442255a5f9010f9095af5c87cb9e2dd55f5482ed6da893dd38c4 pcre2-utf16-10.44-1.5.el10_2.s390x.rpm 9a7f539ff0633f233090134392d71de6b3458a43c02e7a7e52e0fab68b977fa7 pcre2-utf32-10.44-1.5.el10_2.s390x.rpm 9e35b7d100fccba1bf8ff8eae1e7a9dcbb632371cf70dabb169eb77636d4b48b ALSA-2026:82041 Copyright 2026 AlmaLinux OS 0 1 Important

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient (CVE-2026-103262) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3-tornado-6.5.10-1.el10_2.1.s390x.rpm 1d684adaefe3d57631183fe35a7b335902448ecd0160505299087418e2ba1b50 ALSA-2026:82280 Copyright 2026 AlmaLinux OS 0 1 Moderate

tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine. Security Fix(es): * tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default tftp-5.2-50.el10_2.s390x.rpm 4a7d3eb6c141fd35c502ffb1bbf186a6761e009a21756ef1d119a0fd7c15bf65 tftp-server-5.2-50.el10_2.s390x.rpm c090bb714d55c7b3b1299820a1a3e1821aa2398d7336bb81dd9ecdc408a2474f ALSA-2026:82883 Copyright 2026 AlmaLinux OS 0 1 Important

hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023) * hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098) * hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097) * hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100) * hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104) * hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105) * HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102) Bug Fix(es) and Enhancement(s): * [IMAGE-MODE] missing /var/lib/hp on image-mode [almalinux-10] (JIRA:AlmaLinux-266547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default hplip-common-3.26.6-1.el10_2.3.s390x.rpm 55be738803778a41c6dd38abeeb7d1711107a50e1e9e7af4a994ed4a1296ab65 hplip-libs-3.26.6-1.el10_2.3.s390x.rpm 7a5ed35b9f0f801bbe061ee6755bad76292d8d4ed27ff481801b08b0da80278a libsane-hpaio-3.26.6-1.el10_2.3.s390x.rpm 82ab34ce84c129a4900a893f25664931cdce316c0870c5c724a8e1500cdca9d5 hplip-3.26.6-1.el10_2.3.s390x.rpm cba2fc84409bce003a043e4e1b4f96ffcc229af7c158d32735cd826cddc22128 ALSA-2026:83207 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859) * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319) * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030) * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974) * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162) * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262) * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574) * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641) * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985) * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526) * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689) * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036) * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894) * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207) * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228) Bug Fix(es) and Enhancement(s): * cannot use VFs of i40e/ice NIC in bond device (JIRA:AlmaLinux-143410) * ionic: commit backported to 9.8 missing in 10.2 (JIRA:AlmaLinux-165657) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.66.1.el10_2.s390x.rpm 00f48c785fb88d3258cdd0fe6b10007a0533a0eb6eb6a0e99281bb42cb2974aa kernel-zfcpdump-devel-6.12.0-211.66.1.el10_2.s390x.rpm 125ddf2885138ad68d6acb95d7f491dd6cf37025d0357b94525f1391f3eaabe4 perf-6.12.0-211.66.1.el10_2.s390x.rpm 12a19d7484b979ba52ef1d568448a50f30e97aae766ce00af33872e4fa29979f kernel-headers-6.12.0-211.66.1.el10_2.s390x.rpm 48698c81412e4ba67827f07eefb3cbba6e34c3bb5ed306c7fb670760718e1d75 kernel-doc-6.12.0-211.66.1.el10_2.noarch.rpm 6f301a5976e15068aa2b07d6ae8075aff2544160af41ef58a535c64c538e8b53 kernel-debug-devel-matched-6.12.0-211.66.1.el10_2.s390x.rpm 8af6b17295abd866d321907597e678fcbc311d57e768c737c656b39f3e78432a python3-perf-6.12.0-211.66.1.el10_2.s390x.rpm b538af6e392df43e3988a85fb8987e4fdaaabf4ad5edacf116f1b3ac56daf8d0 kernel-zfcpdump-devel-matched-6.12.0-211.66.1.el10_2.s390x.rpm b5aa52ee36a0590c31087ea14635dd5730bbded149c2dd801704dcd66dcbe9be kernel-devel-6.12.0-211.66.1.el10_2.s390x.rpm b61b725663ef40134c8791c0a7173f6c1ee1261e55bfc1aff8ca0b1bb4fa1cd1 kernel-devel-matched-6.12.0-211.66.1.el10_2.s390x.rpm d147746759ab9083c9cebd3e03d2bd5b2051e8b1a6dc0b09397d31215db06d0e rv-6.12.0-211.66.1.el10_2.s390x.rpm d9f70c6b895ba8c1a8812f66c5dec7ca59b4e18ba559d4454157a6ffa62d8a0c rtla-6.12.0-211.66.1.el10_2.s390x.rpm f33df54bc73729e6fd44492458db449f8829a06c577daa93ccaf8d5560284e24 ALSA-2026:83551 Copyright 2026 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258) * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default ghostscript-10.02.1-16.el10_2.3.s390x.rpm 29ac079bc054d6f1dbc23806081be022629518dfd59c3194951ec972dcdcfb5d ghostscript-tools-fonts-10.02.1-16.el10_2.3.noarch.rpm 2f11201ed712d8c66100867af2653f448d74381381908688fdc39f52910b7722 ghostscript-doc-10.02.1-16.el10_2.3.noarch.rpm 31dd0cac798502cb49a1a9259e5c0dcebf08e0e8ea0f2a893da972d2c6ca75d3 ghostscript-tools-printing-10.02.1-16.el10_2.3.noarch.rpm 6dad220e750d8b49fbcb9d4ba86f2c36b7071dd78d13d0856dff27d76ac4cf46 libgs-10.02.1-16.el10_2.3.s390x.rpm d4df842a1718ce887ad3bd6f7a5d080d14ff0c9d74b20f4c64631e09184ea270 ALSA-2026:83618 Copyright 2026 AlmaLinux OS 0 1 Important

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding (CVE-2026-102555) * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556) * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557) * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558) * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559) * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth (CVE-2026-102560) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default libsoup3-3.6.5-3.el10_2.20.s390x.rpm bfea31dae66e6e4f59cbd3ac1dfe83773969422cc40fd088d3d1d581668d0c41 libsoup3-devel-3.6.5-3.el10_2.20.s390x.rpm e9b50ebb405a339ac221aabe30a9e993544d452f352513a462548ae8646a565b ALSA-2026:84578 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default python3.14-urllib3-2.6.3-2.el10_2.6.noarch.rpm f85520901dd8eaee108473d77b0f023b36fd8cbd327d8e82e253a0e60f981482 ALSA-2026:84587 Copyright 2026 AlmaLinux OS 0 1 Moderate

perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default perl-URI-5.27-3.el10_2.1.noarch.rpm 611eb7e29299e3e8f52bb171d6d8f6443251979af86b7d673d597c26e07700b3 ALSA-2026:84591 Copyright 2026 AlmaLinux OS 0 1 Important

emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219) * emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992) * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default emacs-nw-29.4-14.el10_2.3.s390x.rpm 004d0bbd5bb3289558885c747a395ba5a3f4464ca57967cfa656816aa57797ec emacs-29.4-14.el10_2.3.s390x.rpm 0bfb856e05c0855f1eccaf8c65d016a9be5b8fcc33bc6d55b88ccbd885a8413a emacs-lucid-29.4-14.el10_2.3.s390x.rpm 638366bb5f6a8a8a5a9d90e00a937bde51e47ebed7a6bee63733a42703b093c7 emacs-common-29.4-14.el10_2.3.s390x.rpm 667c2ec116c9d429f6d87fbe0c14a6530cabfd090c264bf6d0c8abd70065813f ALSA-2026:84721 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886) * wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880) * wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919) * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76879) * wireshark: Wireshark: Denial of Service via X.509IF protocol dissector crash (CVE-2026-76928) * wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927) * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-95389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default wireshark-4.4.2-10.el10_2.8.s390x.rpm 28c17867a7b42bcf2a0168fd64bee97ce09732d61e6529d4c4d311db00ab9413 wireshark-cli-4.4.2-10.el10_2.8.s390x.rpm a4be7ba72e21ab3d4ea853d9820b4c7d7830388ea59f3781cd2d88ca77c93566 ALSA-2026:84753 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117) * glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489) * glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374) * glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default glibc-devel-2.39-145.el10_2.alma.1.s390x.rpm 891bb97162136ec5130800917c7e091c5cf0f57c844387ea94da3f43a4a48ae0 glibc-doc-2.39-145.el10_2.alma.1.noarch.rpm c1c6d8b798e7e9695a6bc003ad236d37961e0f8401f3349a7e892ca0785f46f8 glibc-utils-2.39-145.el10_2.alma.1.s390x.rpm ea4da19e77323f9580f9a82f0b914d3db1fcead7900ed75fe81456bd3f937147 glibc-locale-source-2.39-145.el10_2.alma.1.s390x.rpm edf25c0e1678a1735e6f35ab02a4548f0113fc0d768223665c5240aa78c3bc0f ALSA-2026:84795 Copyright 2026 AlmaLinux OS 0 1 Important

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default librabbitmq-tools-0.14.0-3.el10_2.1.s390x.rpm 04403d2a7ad37f866d7580f2fe71a766c98b62c26ce953a08e2db7e04aac4b0d librabbitmq-0.14.0-3.el10_2.1.s390x.rpm afdf65bd5d271e0666805dfa3f68bfd2435fa90bf1c46843d531eee83abac837 ALSA-2026:84796 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) * OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) * OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) * OpenEXR: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) * OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openexr-libs-3.1.10-8.el10_2.5.s390x.rpm 7637e53ae7661a24a825657953038939c981932104d42166bb83efb2b29d77ed openexr-3.1.10-8.el10_2.5.s390x.rpm ba4e9f9668b58ec7b71368b3cd5684e4cc6148c3b3e377e6ce635cc204aef635 ALSA-2026:84799 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb11.8 security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default mariadb11.8-client-utils-11.8.8-2.el10_2.alma.2.noarch.rpm 12129a48fbf0bf75af7db9ec51b44577a01a5f68033e0afc2926050dfbd4b09a mariadb11.8-embedded-devel-11.8.8-2.el10_2.alma.2.s390x.rpm 19e23adac4daba75b680c0300ad5200901410010d297f39ff32ae4f4dba00a0c mariadb11.8-embedded-11.8.8-2.el10_2.alma.2.s390x.rpm 3837cca08bd86dd51fa3a82a6968a5bf5b70437814c93d18ac13cd3f6d901fc2 mariadb11.8-11.8.8-2.el10_2.alma.2.s390x.rpm 41c120a5bfdf8b7b75478ad3f2915e434878417d3744b338338025f25cab26ae mariadb11.8-gssapi-server-11.8.8-2.el10_2.alma.2.s390x.rpm 4cbde1e9d8bb94015bf2406f0196a626c5e787feadd0cdf453b24b6433ec10f3 mariadb11.8-server-11.8.8-2.el10_2.alma.2.s390x.rpm 5cf950c64cae557853771c0b2f22da21192305ca6a87634c9eb83ed5c196db72 mariadb11.8-test-11.8.8-2.el10_2.alma.2.s390x.rpm 65a2bb400b8e9ab1f8152144987a76774e82d344a94122b5655c79698a9e5686 mariadb11.8-errmsg-11.8.8-2.el10_2.alma.2.noarch.rpm 8d642bace1bba11ccca8ea2c8a11a03bd79c79e1f8e1bb0d1c61760ee1505e1b mariadb11.8-devel-11.8.8-2.el10_2.alma.2.s390x.rpm afa5ecd568d1fc78f84c5b1758cd2e7a49a5d2fe758ac9cee8394626f51fae91 mariadb11.8-pam-11.8.8-2.el10_2.alma.2.s390x.rpm b3f0c6971b0c70b904d7ebc23ec2853659697582225585bf7674dd85cc73e06e mariadb11.8-oqgraph-engine-11.8.8-2.el10_2.alma.2.s390x.rpm e8e8d6a1b76f04e352f0dea8fff3f452e4f6749793720fd3ddea9eaea72c18c6 mariadb11.8-server-utils-11.8.8-2.el10_2.alma.2.noarch.rpm eab081636282b63c450ea09a5a2d58ccd71c89eeef2705c6dc97af3c8ebe9c55 mariadb11.8-server-galera-11.8.8-2.el10_2.alma.2.s390x.rpm f06817fa17d86c57131438706e98237cbf783d65ebb0afee1a228276770c21c2 mariadb11.8-backup-11.8.8-2.el10_2.alma.2.s390x.rpm f397fea510feca8f4509eac67a4412cd352638ed0e1175d7b3be2a8b869db665 mariadb11.8-common-11.8.8-2.el10_2.alma.2.noarch.rpm fad75cb8cb6a19b23db136f4f44c4038fddc3718e190afa3a73c8f04192d30ba ALSA-2026:85191 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.4.s390x.rpm beddb2d1f184e13324584c3f01b31111ac8292c1335a0245480bc560902d82e9 ALSA-2026:85276 Copyright 2026 AlmaLinux OS 0 1 Moderate

hostapd security update

hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd. Security Fix(es): * hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default hostapd-2.11-3.el10_2.s390x.rpm d717786a5315295dad35df5092b19fcbc98dfc6abb0d974989a4c3bf1c62ea5d ALSA-2026:85321 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801) * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162) * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117) * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300) * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: signal: Prevent exec() race (CVE-2026-98256) * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) Bug Fix(es) and Enhancement(s): * [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded (JIRA:AlmaLinux-181987) * [IBM 10.3 FEAT] zcrypt driver overwrite function - kernel part [almalinux-10.2.z] (JIRA:AlmaLinux-245336) * Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:AlmaLinux-256678) * RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:AlmaLinux-257228) * Fix pending kernel issues for L1VH GA - Kernel (JIRA:AlmaLinux-267038) * Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [almalinux-10.2.z] (JIRA:AlmaLinux-280590) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default kernel-devel-6.12.0-211.67.1.el10_2.s390x.rpm 47435537b07f1dd68c4ae13e3b10c32e925a4f0804deafcf5d2b015dda00ee25 rtla-6.12.0-211.67.1.el10_2.s390x.rpm 47b6a946cbe87b577025a0fd5b4e9bec60e9c25beaf48a0de0440df0b989cec6 kernel-zfcpdump-devel-6.12.0-211.67.1.el10_2.s390x.rpm 5ef834cc882487cbaa24ec5fab04106a693a02f8c5798a5b68166a299b27d9e0 perf-6.12.0-211.67.1.el10_2.s390x.rpm 6bfaec96a229166f930237f90695185261b6c6b82dffc21566f216d30e3d4056 kernel-devel-matched-6.12.0-211.67.1.el10_2.s390x.rpm 71cab006f6de6e8bb411959b7e16dd867b51fa93ae42b9396f9f3eefdeca2b60 rv-6.12.0-211.67.1.el10_2.s390x.rpm 82690812cdc3c52856f1c5459ba10e1ff53671fef3c48760f7715a6152f13243 kernel-doc-6.12.0-211.67.1.el10_2.noarch.rpm 9caff7cead81e13e3372f4e55e542a9d645c00d414b73c690cfe3a97d7add266 kernel-debug-devel-6.12.0-211.67.1.el10_2.s390x.rpm b10e5184d44da6fb5074d94a9a5ba60971a86d988ab4614d358a2243019bda52 kernel-zfcpdump-devel-matched-6.12.0-211.67.1.el10_2.s390x.rpm b44d5ec45a881a30f0b0805828ebd24a7ebac6a8e5516fb09cc5bb1928945868 kernel-headers-6.12.0-211.67.1.el10_2.s390x.rpm c0ceab671ef019ac619829225a530099457a7196a2a308edd477c9d4832335e4 python3-perf-6.12.0-211.67.1.el10_2.s390x.rpm c2b823d5507b7db369641ef90726292e408453a5c32967cd40494f430c058ad3 kernel-debug-devel-matched-6.12.0-211.67.1.el10_2.s390x.rpm d5834baea6cf630c499ecd0c63fbdf26669ed803ec389549482a99410d582db3 ALSA-2026:85847 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997) * openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998) * openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default openssh-askpass-9.9p1-29.el10_2.alma.1.s390x.rpm 5921195e4b38893d551af64ea63fc068bfeeb30fee5836bc62465c22e9a18e0c openssh-keysign-9.9p1-29.el10_2.alma.1.s390x.rpm c2c6a5c4b30d4e1e6dbfb0433c37d4dc817b0847618a5669155fc2ce2a49ae74 ALSA-2026:85848 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sq security update

Command-line frontends for Sequoia. Security Fix(es): * hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657) * rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default sequoia-sq-1.4.0.1-4.el10_2.s390x.rpm 4d127e4b7332e8d060deb64e792ac5d384dcee49752472417855f06e1622a78c ALSA-2026:85959 Copyright 2026 AlmaLinux OS 0 1 Moderate

fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client. Security Fix(es): * fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default fetchmail-6.4.38-3.el10_2.1.s390x.rpm fb703bf6dcffdb2981c5cdbc3097895401300ed2cd07b4f655d36c56b5b20d5d ALSA-2026:86093 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default golang-docs-1.26.10-1.el10_2.alma.1.noarch.rpm 2d79e769efee24206777297d81950a59cd8f92825199a4b095bd00a11b65fe72 golang-src-1.26.10-1.el10_2.alma.1.noarch.rpm 43d81a2ae0e8050075f42624aeeb87c9923f73d9eff287c06c6f5161f582dddc golang-bin-1.26.10-1.el10_2.alma.1.s390x.rpm 69a54b47d1798d33d6e0d508ff8d87bc9daf5bfe8424ba68d9b9c180cf8acf84 golang-tests-1.26.10-1.el10_2.alma.1.noarch.rpm 8564845c95e3ad9ae431701bfc86844c9f231174349f09fa3bf96764c9e304bb go-toolset-1.26.10-1.el10_2.alma.1.s390x.rpm 993e01850ffa4fded9cee9e51ce94a2ccf3849105c60e942dd813e3528e08c00 golang-misc-1.26.10-1.el10_2.alma.1.noarch.rpm 9cca556f68ec191e90e65a5ff40a7482d60e4866fea7a72fa75649b2f73a01f7 golang-race-1.26.10-1.el10_2.alma.1.s390x.rpm b4f38843bc8ad5d9d32c7afb232931ac0f1b47cd31b60b84d1675754e317c518 golang-1.26.10-1.el10_2.alma.1.s390x.rpm fb2bce0b26bc5132d037a1c4f25046afa661acef4ffc8222c9ec18a8ebb62c58 ALSA-2026:86168 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-10.2.z] (JIRA:AlmaLinux-277794) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-targeting-pack-8.0-8.0.32-1.el10_2.s390x.rpm 2dc1b3a469cd13767099db6217d22b54cb627441f2198e6451b557466ef93ea5 aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2.s390x.rpm 3428dc7c36f2cdfd451790e414ea191486ae9a1ed1904d52936f89c4965160da aspnetcore-runtime-8.0-8.0.32-1.el10_2.s390x.rpm 380d0604dc261df322c05e1a5d9645c8f080e0fabfaf8809cfe61ca42d11f30b dotnet-runtime-dbg-8.0-8.0.32-1.el10_2.s390x.rpm 5808f21e11bfb58ab354b015232ff141e6dbe9130adbd19e7f5abae5b237bfa3 dotnet-sdk-8.0-8.0.132-1.el10_2.s390x.rpm 5a6bb10ebe3d621939d53a3720f2e00fc9a532104d76112ec96224feddbd8ffa dotnet-runtime-8.0-8.0.32-1.el10_2.s390x.rpm 5e0edd8234302b0af2c1219eefb4eccf7376fdf9acf2117c019b3c20c0185e37 dotnet-sdk-dbg-8.0-8.0.132-1.el10_2.s390x.rpm 6e6af54468923d8754bad816bd1e5b5531a042cc0576c55f69874e98b5d86a81 aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2.s390x.rpm ab48de8f2d0382c41749e859a1c2dea3094877e32d6d1cd56c3e0c7d45ea5741 dotnet-hostfxr-8.0-8.0.32-1.el10_2.s390x.rpm c55e16f8de86dfe11f8f1457357571697e8477be99f0ad13f3cce836b54e17d0 dotnet-templates-8.0-8.0.132-1.el10_2.s390x.rpm e51e8649eabae0d1900a90599d018b3edc6100f092cd17628d9dc6d3eace56f0 dotnet-apphost-pack-8.0-8.0.32-1.el10_2.s390x.rpm f6a64b8e08432908afac5fc97dc8d6636a53fe4ed62c465ffc7e92acc9f4cede ALSA-2026:86172 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-10.2.z] (JIRA:AlmaLinux-277801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-sdk-9.0-9.0.122-1.el10_2.s390x.rpm 0a4a4c1187e5a706514710c843a29ca4363f80354f9401a0c139cd254f7fb97f dotnet-targeting-pack-9.0-9.0.21-1.el10_2.s390x.rpm 25adeab25cee516f7a802c49a34c4a1645b50fd4fbc7c18d9a6d09962d7dbfcc aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2.s390x.rpm 2c06433865e2c5f4ba260fabf3a624e22928ead316b52ed364fdecfb14f150a9 aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2.s390x.rpm 38415481fa02d08f45de33cad566468660436aaa15cdda9d798d8b4a6c98a2e7 dotnet-apphost-pack-9.0-9.0.21-1.el10_2.s390x.rpm 5993eb045bd37d1246293fadaa0479dee9a649e13f5f54f39d2a5a40198c4431 aspnetcore-runtime-9.0-9.0.21-1.el10_2.s390x.rpm 7da77bd17da2a1691554852447ad3b9ed001ba16f1d790cb8dcc479db4389a5b dotnet-sdk-dbg-9.0-9.0.122-1.el10_2.s390x.rpm 83abba31260b1f82b387455a6b3bc908f32a89ada377d8fa04d72036548f64e0 netstandard-targeting-pack-2.1-9.0.122-1.el10_2.s390x.rpm ce93d21bd723d0ef7a9eddccadb6dc1251132eecd3f4c31ac2f2bd68d351f3e7 dotnet-runtime-9.0-9.0.21-1.el10_2.s390x.rpm d2714250a843ae6100da82c65a65ad7b975fab6429f5ebb8962ba6b0af9beddb dotnet-runtime-dbg-9.0-9.0.21-1.el10_2.s390x.rpm d2baf83bca194fffce24184614edbe91e477c0e5cd97bd7314430814088fd219 dotnet-templates-9.0-9.0.122-1.el10_2.s390x.rpm e601de67d6a89153d1f7d77015249a5dadc7db24a6f2c2c509b8d7c946bbdc61 dotnet-hostfxr-9.0-9.0.21-1.el10_2.s390x.rpm fc8ee5f10e663ffe682324da1f742f49d37e17b427163ab919b9bc724ac5a9c0 ALSA-2026:86195 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-10.2.z] (JIRA:AlmaLinux-277809) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default dotnet-apphost-pack-10.0-10.0.13-1.el10_2.s390x.rpm 097ab821acb671d281848db993659160cde315932dd52b1bc96e67ef396880c7 dotnet-sdk-dbg-10.0-10.0.113-1.el10_2.s390x.rpm 25206ed68cd2a4f0be134082f336bf814802adb1d6d4e047d50692fb6afae6a4 aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2.s390x.rpm 46e7f421364f2f7ed3df889781a25f8b8036c00709000c217453b43df40c4e9a dotnet-targeting-pack-10.0-10.0.13-1.el10_2.s390x.rpm 4a3bfd3bb8ee9595ac8ff1d0dabe953acdafb2cf836f2ed3e0720ef1a32d88be aspnetcore-runtime-10.0-10.0.13-1.el10_2.s390x.rpm 4bacd1fd49ddbdef8a7fa694b8846c73b9a7f5d45f1f552a4bcb76cfa18cac42 dotnet-runtime-dbg-10.0-10.0.13-1.el10_2.s390x.rpm 58ecaa70dccde3be6f9332233065bd70b7d296eed2af4f599c1f506a73fc29df dotnet-sdk-10.0-10.0.113-1.el10_2.s390x.rpm a578bcddcbd1e5f222bd3e86796d660c8c101848bead7a90b8d1c9fc6421a8b2 aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2.s390x.rpm b16c8800c4a6f3fbefde86076a3282b4af37757ea027a8188d510099d546457f dotnet-templates-10.0-10.0.113-1.el10_2.s390x.rpm c84770be66082cf14a5dcb8089aafc24626851f9ea9f6868f158f994aff526ea dotnet-hostfxr-10.0-10.0.13-1.el10_2.s390x.rpm d984635f899cbd41238d6567f9afec6c4dfef241e43a5fdfe7ff7585fddc707e dotnet-runtime-10.0-10.0.13-1.el10_2.s390x.rpm d9c216ba3c484ed3fd691da4579fd73bd70d0b43bb8b256f89f66e3d86d06078 dotnet-host-10.0.13-1.el10_2.s390x.rpm e66a87d902ef00db6d87025e3668367ce9d26114c0817bc7464c0ce6de642eda ALSA-2026:86841 Copyright 2026 AlmaLinux OS 0 1 Important

librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default librsvg2-tools-2.57.1-9.el10_2.10.s390x.rpm 3a75ab757b5ce15aea38b501d9272f4ee91247b88e81e580b028fe3ec1a8a4c1 librsvg2-devel-2.57.1-9.el10_2.10.s390x.rpm a8652585e8a868f5b905c9b350e6dba8f3405e02a20b22e00fa58f7ccccc8c8f rsvg-pixbuf-loader-2.57.1-9.el10_2.10.s390x.rpm c1af6bcbc4f2b878f44412154d074e65279918fccaf10db400e1931f62f569b2 librsvg2-2.57.1-9.el10_2.10.s390x.rpm ee7af161ad31a188c8f0125da099efcc9724dd58efca5f21e0b22b6d884dd470 ALSA-2026:86971 Copyright 2026 AlmaLinux OS 0 1 Moderate

cockpit-machines security update

Cockpit component for managing libvirt virtual machines. Security Fix(es): * cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768) * cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747) * cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default cockpit-machines-348.1-1.el10_2.noarch.rpm f07522ae8bce2750b2d0a9b32d8b9b159a43988af1d1d59a1c3ed9655cf017a5 ALSA-2026:87070 Copyright 2026 AlmaLinux OS 0 1 Important

php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default php-cli-8.3.36-1.el10_2.s390x.rpm 1059b9691a1d67e233b9630cce65be927d188cbd05651775360b7d630a26dd0e php-intl-8.3.36-1.el10_2.s390x.rpm 11fabb06d91c5f4fb00d96e804eb8d2a93c0ce42ee0545da3d47dc30e6bc10c1 php-enchant-8.3.36-1.el10_2.s390x.rpm 16640f3c7b692f8835904d8b2ac4bdfa5fc4f88378fe0a60118b75dad4df5f09 php-pgsql-8.3.36-1.el10_2.s390x.rpm 2906fda00a53ea1de56652f13e92932400ec8afc3e885ed6135e508c5e67a72e php-mbstring-8.3.36-1.el10_2.s390x.rpm 390b9a5394ae8dbff37ae10982d081d996fc1e5ab70fefe932df3ad59509537e php-soap-8.3.36-1.el10_2.s390x.rpm 3951aacd51fe15bae2c5428968b2f871a63ce91ef0ee326290abccb035a10d56 php-8.3.36-1.el10_2.s390x.rpm 52e4470bfb5cc43e2ed44ba4700435559a451ea1aea658535fa7651158c9a5a1 php-embedded-8.3.36-1.el10_2.s390x.rpm 541ba5afea9141f8c2a6a6621c89761704773980dfd50b69a3f0a0ef798d754e php-dbg-8.3.36-1.el10_2.s390x.rpm 57b63eab59e8b1ed4d0eed8281e0ee375792cf51f283423bdbd4f06373e3745f php-odbc-8.3.36-1.el10_2.s390x.rpm 818c08839e685e315fec33ad6082d96a4f1f3db366fa60204150e463885c7ae7 php-pdo-8.3.36-1.el10_2.s390x.rpm 8d07603b531a73ba6bec52036a48cdeac9b7d5d0fea909bdabeaf33c0c0cbf43 php-process-8.3.36-1.el10_2.s390x.rpm 9f0a9160192f33bcdf871e4cd4e57e892e95b1248e1b9a8078c0bc8e4637dffc php-gmp-8.3.36-1.el10_2.s390x.rpm ad6acfc601a0fbdffda7153c412c20ceda648cae79ca3f2c9a72b19620fa6360 php-xml-8.3.36-1.el10_2.s390x.rpm b342c6e717142a36510b7a5bbd7fc3fb42d516036f2af9f50f8591b1da616bbf php-ffi-8.3.36-1.el10_2.s390x.rpm b4fd91221f006fdd45448ba2e9f2d4171359405f59b22acea4e23fc78808674f php-dba-8.3.36-1.el10_2.s390x.rpm bb18a6220ba6b578b8244b8ff9759c29829e151bc444ff53c348288aefd620d9 php-mysqlnd-8.3.36-1.el10_2.s390x.rpm bd29e1348b35e9da68f857b0a8acd5e2aa161afd3063ee8654cb559c5bda1500 php-common-8.3.36-1.el10_2.s390x.rpm bde5f319f70f2ec87fce263900186277f107b0a04778a6e3bd5d09b529fc35c3 php-snmp-8.3.36-1.el10_2.s390x.rpm bfa5fefbda7c8f7e9f64f6b0fd6feada629eebd1732e4762cf334e11eb08d5dd php-opcache-8.3.36-1.el10_2.s390x.rpm c43fa1f90b28c11ca8173becd277e48bcb3eefd8c7c2177920958869604acaba php-fpm-8.3.36-1.el10_2.s390x.rpm d247480a7b406883c0d3c039dff501ad7db964d91de3efa90d20e3000f49751e php-bcmath-8.3.36-1.el10_2.s390x.rpm dbd5b77b1473fa98cf330798afd37cfa6d2f4b5d18428ebfbc14129eeda06b09 php-gd-8.3.36-1.el10_2.s390x.rpm e880d86e8fd33d6665707dc2865b94b9ef2449a0bb708a6cbe84787e5550c6f1 php-ldap-8.3.36-1.el10_2.s390x.rpm ebfca012eb8899ab955b257e9e553dd168fdc4acbcea27307003be6bb585e429 php-devel-8.3.36-1.el10_2.s390x.rpm fc6b475cdc64971adbfcc47579652bff70b5c71796012931d5b584434d95cad1 ALSA-2026:87071 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default php8.4-pdo-8.4.27-1.el10_2.s390x.rpm 014643eb2ac200c31e390c77b1fb6a7e47c2a0300462163dad11033dce8b4e20 php8.4-mysqlnd-8.4.27-1.el10_2.s390x.rpm 0bd103562c783516a48009818e247622216f71c546b81cf729b01c479e16e9d7 php8.4-8.4.27-1.el10_2.s390x.rpm 0da6069fb9410c71f83247ad8b82877e2d9284b5c8c1e617f2197be933f27351 php8.4-dbg-8.4.27-1.el10_2.s390x.rpm 0eba97999b86f7408a3ed96a7b4be10b26fc13639379ea7f237748b3c93e0f8c php8.4-process-8.4.27-1.el10_2.s390x.rpm 107dca5e5ff2259ab67e1410880632e835a47d893341bd4876248168783bdc24 php8.4-ffi-8.4.27-1.el10_2.s390x.rpm 14d7026085c2e750f7dcaaf831843d30f7e3fa71ab056ed4c242290733a950ac php8.4-ldap-8.4.27-1.el10_2.s390x.rpm 2148e11ff437e7dce80abc6f7efda59b9560b0c873f8b528c1556425ea1d9920 php8.4-gd-8.4.27-1.el10_2.s390x.rpm 33ada97975dfbeb65d371218c1b685fa3ee7e57196a7a148f79108aa9e8016d0 php8.4-soap-8.4.27-1.el10_2.s390x.rpm 3def56567136f327b52ce2ed685652130b9414143a11b17fa774c830f18b24b9 php8.4-mbstring-8.4.27-1.el10_2.s390x.rpm 43e7f04161095d845065a260ebaf2d2de748c00117b4513a80cbd1955dec4e8f php8.4-pgsql-8.4.27-1.el10_2.s390x.rpm 4a54dc388247fb2ec679d9e1ae88953bd878456642ed533a9f5b513058dd65eb php8.4-odbc-8.4.27-1.el10_2.s390x.rpm 6e2a02533c4313c2b277665be31a0ddd98cabf1124e56868fd3f6269c5cd5df0 php8.4-opcache-8.4.27-1.el10_2.s390x.rpm 77375f814abb6f5e24050383b6f06f15b26d20588840f2f3b895096790f088c3 php8.4-common-8.4.27-1.el10_2.s390x.rpm 8149dcaf4b86634887dbfb052139a7561c7335d5c0b90ece242a62cd3f41dca9 php8.4-gmp-8.4.27-1.el10_2.s390x.rpm 884226111b26a9cd2923c7057fc5ad00d540819b7b7131e1124f64e500c61ae7 php8.4-embedded-8.4.27-1.el10_2.s390x.rpm 8c558b70efc9782dab6ddb8d977738e98690babcfc2e6c43175beb677b216d8c php8.4-dba-8.4.27-1.el10_2.s390x.rpm 9e4155b3c7327313d5c6d0140bdad55e45b6a05eda50f05b7242840464ab3e1a php8.4-bcmath-8.4.27-1.el10_2.s390x.rpm ab16f4fad6824663249297c955ca6136949b2d6c532783472d28b171e8a98f5f php8.4-enchant-8.4.27-1.el10_2.s390x.rpm ae731dfebde73311d3329f903898d7f0e406ee4b47b8f629753a6a1e109285e7 php8.4-devel-8.4.27-1.el10_2.s390x.rpm af245e97272b63060a32de4ea041c09e3e3862cd732bb546eb628c813cb0bcb6 php8.4-intl-8.4.27-1.el10_2.s390x.rpm bb0c31c92d43dcb32c1f5a0ceadfe6bc7b06d86c77f0f200c33cc4cd2a4a2c01 php8.4-snmp-8.4.27-1.el10_2.s390x.rpm d680f86b025d2ec7c0bdf685d10c7d46a491f92ab348859754aba9655260854f php8.4-fpm-8.4.27-1.el10_2.s390x.rpm e3cf7b8347216eecc6f5bef52683130a1461a345a6daef42b8dcc49652302c50 php8.4-cli-8.4.27-1.el10_2.s390x.rpm ea44eb7e9fa191e08e54b6e8458a5855f9af3a4d79e499e8f7f127b2a9a8ffa8 ALSA-2026:88207 Copyright 2026 AlmaLinux OS 0 1 Important

iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3: Denial of Service via UDP receive worker infinite loop (CVE-2026-102253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-s390x-appstream-rpms__10_0_default iperf3-3.17.1-6.el10_2.2.s390x.rpm ad577f99c3b010fefb604198784f3168e57adebfe1b80d0268f7f673a56d229c