ALSA-2026:18134 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633) * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839) * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980) * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015) * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097) * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166) * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202) * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279) * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267) * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275) * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346) * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345) * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405) * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441) * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470) * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866) * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034) * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134) * kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210) * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257) * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320) * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040) * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111) * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210) * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.7.1.el10_2.x86_64.rpm 00c249ef56f725f5bc0c715786c60e1d4450fafd8298fae20f860781dd957236 rtla-6.12.0-211.7.1.el10_2.x86_64.rpm 23c1a4918a16e29c872c22ce626b772e19fade6d7a99dbf25c76b961ebfa9f06 kernel-doc-6.12.0-211.7.1.el10_2.noarch.rpm 78db96b63b180a526d27658a5f66bd367e0d516ce72b83b9aa8ec6f642d3b051 kernel-debug-devel-matched-6.12.0-211.7.1.el10_2.x86_64.rpm 89d0a5771601d2a944bd7ab993eeca787fa90434c2be0fefd564e445d2f47e6f perf-6.12.0-211.7.1.el10_2.x86_64.rpm aee6a113ac1b79fc108d0bb2e605bdf7cecb0bc345fe2bf36fae217aff323acf kernel-devel-matched-6.12.0-211.7.1.el10_2.x86_64.rpm bfef2f66e2a3c43eab464b8a7a88e5bb1e29cf71cc5b9bc85000d81f0595cc87 kernel-headers-6.12.0-211.7.1.el10_2.x86_64.rpm c87121c99170b0691980bcc67e10983a5b313f925ba02d17581579b6ec00b843 rv-6.12.0-211.7.1.el10_2.x86_64.rpm c906dd0538092bc645d256010a8a94252ac0c63c965e8bb6f9827f78b086e8b0 kernel-debug-devel-6.12.0-211.7.1.el10_2.x86_64.rpm cc099b6d02fe43771c72d9a39c2f29d95db9552daab3139c0df2bda2caa20299 python3-perf-6.12.0-211.7.1.el10_2.x86_64.rpm e2602013cdcbaf36c66c812eefbe6720d81305e1160fe2068e660dc3c14ad3fb ALSA-2026:18142 Copyright 2026 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * networkmanagr: NetworkManager File Access (CVE-2025-9615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default NetworkManager-ppp-1.56.0-1.el10.x86_64.rpm 3438308b6a9d5ab359c27f7a24fbd746f30cd77067ed89c0a315895c7ddc77a2 NetworkManager-config-connectivity-redhat-1.56.0-1.el10.noarch.rpm 3c3510b6b69347004ae5092b71485721e86928b812cdbbb21a7a13cf2a6cf1ec NetworkManager-ovs-1.56.0-1.el10.x86_64.rpm ca5a190a8c2045429296fe17e38b21e582a0c4f50bb9e7febd938562cc7bbca0 NetworkManager-cloud-setup-1.56.0-1.el10.x86_64.rpm d18dad6691a473b3b0ce4ffe407a8357f7d72bb57f03e48d2b50b66fcab2744c ALSA-2026:18143 Copyright 2026 AlmaLinux OS 0 1 Moderate

p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files. Security Fix(es): * p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters (CVE-2026-2100) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default p11-kit-server-0.26.2-1.el10.x86_64.rpm 94e98530ead1b3e830ba31c086539f45869a90eda72b2249b4a8acd342c2afef p11-kit-devel-0.26.2-1.el10.x86_64.rpm e163486a8a18542a024532bebaa7604bf45e6fd15f7e78f09114294478823dee ALSA-2026:18160 Copyright 2026 AlmaLinux OS 0 1 Moderate

libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966) * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964) * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965) * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967) * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libssh-devel-0.12.0-2.el10.x86_64.rpm c607b128073e57795ba7a576a747bb792f7ae6e9287cca7bc4488efeec45da7b ALSA-2026:18326 Copyright 2026 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Denial of service in XML parsing (CVE-2025-12748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libvirt-daemon-log-11.10.0-12.el10_2.alma.1.x86_64.rpm 07313288a8746419a0ff9118c4999185f8a87ac850e5ee56d506ef38d175900c libvirt-daemon-driver-nodedev-11.10.0-12.el10_2.alma.1.x86_64.rpm 0d21e4c8def275fb79001b1c2f569f3f935d0a4ae54649aafc0ec7a0898a1c1d libvirt-daemon-driver-storage-11.10.0-12.el10_2.alma.1.x86_64.rpm 194a5085c95ba600eb93f1f6b77d1a704c47bab3e403aec62732d935de4c055f libvirt-daemon-driver-secret-11.10.0-12.el10_2.alma.1.x86_64.rpm 1ba52d1515fc54f1b1a53efecb7b4d747cff2bbb72c0d9e9d6bd1e40687c71a4 libvirt-daemon-driver-storage-disk-11.10.0-12.el10_2.alma.1.x86_64.rpm 408a1857a55f8c0b28bfc023ccb7d324333157efe0ac5f7d6b25c50c2eacf0ff libvirt-client-qemu-11.10.0-12.el10_2.alma.1.x86_64.rpm 40f13ef7e99f2cdb0b415e61c0926025e4478bd90aba701ad6d63110f021bfd6 libvirt-daemon-driver-storage-rbd-11.10.0-12.el10_2.alma.1.x86_64.rpm 43d742fb43074593b66e3b5d90f96fe6e62f3854630e1f8e358cb45a0f62524f libvirt-daemon-driver-storage-scsi-11.10.0-12.el10_2.alma.1.x86_64.rpm 54b3eeb7c4e583eeee9caa4422d6932403145ffd3d9e485a481d29b1f14f3f2a libvirt-libs-11.10.0-12.el10_2.alma.1.x86_64.rpm 5832a6c4de9fc7d99a247813b2acc6d7d6f24d5aeca2168523e3582e7a6ad68b libvirt-daemon-driver-network-11.10.0-12.el10_2.alma.1.x86_64.rpm 5c878a55bec9d04f1d2b6eb8fb47f701ad640cbd23df17faf81c37d2edb66763 libvirt-ssh-proxy-11.10.0-12.el10_2.alma.1.x86_64.rpm 60e26a039c79bb9e97101b588e2c295c5e760c2d12435e522eaf5b1ead6d1c13 libvirt-daemon-config-nwfilter-11.10.0-12.el10_2.alma.1.x86_64.rpm 61faa084e1906472f7c8c03cfb3ff605c7fd720b37c236f57647a497b13fadb7 libvirt-daemon-common-11.10.0-12.el10_2.alma.1.x86_64.rpm 63b2e0f66705ad9c7884363b422e9c4bf20651f6cea843bacd922b74611f390d libvirt-daemon-proxy-11.10.0-12.el10_2.alma.1.x86_64.rpm 65017bcb0fc3abb8897c5c7f251f041d2c66ab1a5599f4cda571899e2a534326 libvirt-daemon-driver-storage-logical-11.10.0-12.el10_2.alma.1.x86_64.rpm 6549612c559b3aac11221dff6844e44681900a9f8c8f50773f48d2f98df7ea06 libvirt-daemon-driver-qemu-11.10.0-12.el10_2.alma.1.x86_64.rpm 689199bb5b1183f55af014e0c51b6db9375ce2954d644fffb303643eab481c09 libvirt-daemon-driver-storage-core-11.10.0-12.el10_2.alma.1.x86_64.rpm 80f7ead2181c43896e70ce44ed82b1b608a964147f15a038cd0750a21bb649d4 libvirt-daemon-kvm-11.10.0-12.el10_2.alma.1.x86_64.rpm 8b88f63610b6bdc6b4eaad16ea9d244a8be90b430ba978ae5add06bb3b9f0236 libvirt-daemon-driver-storage-iscsi-11.10.0-12.el10_2.alma.1.x86_64.rpm 8f11dcd7e3b752f398713233e4c951bcf9c65b7055f4da79e7748e808f9f62d8 libvirt-daemon-driver-storage-mpath-11.10.0-12.el10_2.alma.1.x86_64.rpm 99f6cdac997338fcdadd4e09d969efce0176214e107e650507d96844c8a987cc libvirt-client-11.10.0-12.el10_2.alma.1.x86_64.rpm 9c5f81b2e93180dcd350561d75f241aa7b31fb80cee44a105f00d73584c35cae libvirt-daemon-11.10.0-12.el10_2.alma.1.x86_64.rpm c1022224a201b92ecffaa6a4b644fcc07d425c832d12d48b7295fed876674724 libvirt-daemon-lock-11.10.0-12.el10_2.alma.1.x86_64.rpm c4a29683157a888a5a979f8ab976359b385121837f40e2ffed24a121ec7cf08b libvirt-daemon-driver-interface-11.10.0-12.el10_2.alma.1.x86_64.rpm d66585349e21f034fb385028070c94e8995b5b9c4baa46f507ed1382a29059f8 libvirt-nss-11.10.0-12.el10_2.alma.1.x86_64.rpm d9fb1da417920c9705f172120edae2cef5d5665bc4d09cd65b4d67efb0929ee9 libvirt-daemon-driver-nwfilter-11.10.0-12.el10_2.alma.1.x86_64.rpm dd06a554b468de7a40311c2f6ecd5d0a83e8cb1d42c055153f424a0b7f7d2bc9 libvirt-daemon-plugin-lockd-11.10.0-12.el10_2.alma.1.x86_64.rpm df3d9acf2763eb49b548c4bd9ee21555022c4a3a842e80a854ebe300c2e29c82 libvirt-daemon-config-network-11.10.0-12.el10_2.alma.1.x86_64.rpm ea8b0a0ac906f8acb5f0022558dde7a756c63d45c53c934b2950dba3bfb51132 libvirt-11.10.0-12.el10_2.alma.1.x86_64.rpm f23a9bdf72311432698de9b1c5f83d04be8d765f6976b78861bc8d91a73e2726 ALSA-2026:18421 Copyright 2026 AlmaLinux OS 0 1 Moderate

luksmeta security update

LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libluksmeta-10-1.el10.x86_64.rpm 0a1d73dd5d0e1144bb9f53fe1e7ccad42f0657a7e911b9164baaed5e76b87289 luksmeta-10-1.el10.x86_64.rpm c34991f0171ee8800e4ae2df4138968ccfeb6f8af51407ad02fe2c19f2ed5872 ALSA-2026:18465 Copyright 2026 AlmaLinux OS 0 1 Important

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: EDK2: Improper Input Validation allows arbitrary command execution (CVE-2025-2296) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default edk2-ovmf-20251114-5.el10_2.noarch.rpm 0440f37c3dfa7d8ed89074f19a592ec31ae69caf218c9c023a8e521cbedd1c05 ALSA-2026:18479 Copyright 2026 AlmaLinux OS 0 1 Important

qemu-kvm security update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694) * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696) * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692) * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699) * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695) * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default qemu-pr-helper-10.1.0-16.el10_2.alma.1.x86_64.rpm 019407cb3652942e54dcf50f6482c8df79876d1e4ef5138242294e94cc93a83f qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.alma.1.x86_64.rpm 08853c2463e96d9daef009ebb0ed3d641fc541c7214266b5d7409625afcd964c qemu-kvm-device-display-virtio-vga-10.1.0-16.el10_2.alma.1.x86_64.rpm 0d1d5d8e50aaa3ce6c7408f4b8869f0583fbf67659ccfb8715a4e3cb9ac61456 qemu-kvm-core-10.1.0-16.el10_2.alma.1.x86_64.rpm 125aaaef99bfeab8ec08b1f3e21c4eb6b65a6acb209f474c6ffcf0be2f7e5836 qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.alma.1.x86_64.rpm 1b81cdf5f300587129ffec89daf2dd673ce0e475f440ee5abb50f2800610e2c6 qemu-kvm-10.1.0-16.el10_2.alma.1.x86_64.rpm 2637aae0447c4e4f8f4197b6ff8a719a6a3e6cd5af196c3261cdf831d7068f2c qemu-img-10.1.0-16.el10_2.alma.1.x86_64.rpm 3607c03d618999bed5ff9839d53a67e09d62209ca58953536f691edb348b4163 qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.alma.1.x86_64.rpm 45a016929648b5f37b38d47da5ad2aaeafccefc173aaec86fce7cd4843f964ef qemu-kvm-ui-opengl-10.1.0-16.el10_2.alma.1.x86_64.rpm 544918e25b8280c527b878d5c78ed1251f7c6df68a7be3de54115f384cdee24c qemu-kvm-docs-10.1.0-16.el10_2.alma.1.x86_64.rpm 69268a26048e75b9aacc653782a915cc782dcf60e1168e39d82a0ede4ad1c6d8 qemu-kvm-block-curl-10.1.0-16.el10_2.alma.1.x86_64.rpm 6d5c0bead0b505adb2feaddbf521789a4e21dacb53a55f4be13c81414f89dc79 qemu-kvm-block-rbd-10.1.0-16.el10_2.alma.1.x86_64.rpm aaaaa67d0d0959db2062837b837c18c45d541523a66fee882d7f5fbd83fcf31b qemu-kvm-audio-pa-10.1.0-16.el10_2.alma.1.x86_64.rpm ab1169e7182ea9c590ec54a72885372c0d40d6af5b957d1213ea08ad90410529 qemu-kvm-common-10.1.0-16.el10_2.alma.1.x86_64.rpm c1fa996b6f2fc6019b2beb88e7e6bb78cfcce63193674f2bdc4bb3175b830069 qemu-guest-agent-10.1.0-16.el10_2.alma.1.x86_64.rpm c894655255fb8e3e391db8abf1b7bb2bed01c50c331d05fe625f4505b38903bf qemu-kvm-ui-egl-headless-10.1.0-16.el10_2.alma.1.x86_64.rpm d698d480a433a89fcbe4cf83b812c5886cead0d72ce5b2183be2e0cb279406ce qemu-kvm-tools-10.1.0-16.el10_2.alma.1.x86_64.rpm ed9d3e6c114aa069d9d38066dbbf3e3875b64018942dbc136b2b997f278b65fa qemu-kvm-device-usb-host-10.1.0-16.el10_2.alma.1.x86_64.rpm fd6c6875935d98c771dda60be1f87d2fb9cece2cd1bea63fd6ccd627ed103256 qemu-kvm-block-blkio-10.1.0-16.el10_2.alma.1.x86_64.rpm ffba073828bb140038d0be2d25e8ea5c17368841123e133550b230fd5260f4b0 ALSA-2026:18480 Copyright 2026 AlmaLinux OS 0 1 Important

linux-sgx security update

The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++. Security Fix(es): * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284) * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745) * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950) * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465) * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sgx-pccs-2.26-7.el10.x86_64.rpm 061406e4ebdae896c33cb24ce58c84305be8bdc927e07895efaccbccc8773c10 sgx-libs-2.26-7.el10.x86_64.rpm 3c0019d46d6d208b14fa1a899f2327c3933145a477d8ed32d147801168f12a52 sgx-pckid-tool-2.26-7.el10.x86_64.rpm 761fe8b7880d7a0af547d953f1c3a25db4457726b00830d39fbfcc79e498c539 sgx-mpa-2.26-7.el10.x86_64.rpm 799458814cf4fdf8a1cd3b6382b879e67cfe96399512dd7e3037f5e56db696dc sgx-pccs-admin-2.26-7.el10.x86_64.rpm b93c1fe22b4d05127fd74158ada58105609963eda5a2997c177bf425c6e80232 sgx-common-2.26-7.el10.x86_64.rpm bb83d06edeb75a24e1a304a330eef52aab0f0d3c0f9ba104535f5bfd0a1890c4 tdx-qgs-2.26-7.el10.x86_64.rpm e19a53bb9a7559a70a1bbf0c0b8266080ea12e02324ce995c1df264d0a91df3c ALSA-2026:18556 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: DNSBomb vulnerability (CVE-2024-33655) * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-unbound-1.24.2-7.el10.x86_64.rpm 00a57486f9906dfb43ce758200996ea9dc60e7a750809dd67d145d6b0ece216b unbound-1.24.2-7.el10.x86_64.rpm 020ef012c871596263a61b7f9c34d75653f070e652912c23bf2236a644c82c30 unbound-dracut-1.24.2-7.el10.x86_64.rpm 46e5662c790d5e5922e47b31bd1673c620a91fc7188b097434012c30294b7012 unbound-anchor-1.24.2-7.el10.x86_64.rpm 4ef01c97d514326b6fdf5e1924f9925ae8edd4d66b4ee1b50bd7c0fe2cb96e1c unbound-utils-1.24.2-7.el10.x86_64.rpm bf05a9c700945765e97e802cc4be73bdf7f666eb0d8038a7a7c7efb50a7aaf49 unbound-libs-1.24.2-7.el10.x86_64.rpm fe7ba640e0f9c9de0f6f5ee758564bdc97f115df0c107e7f6e000cda64d78d88 ALSA-2026:19009 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007) * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003) * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postgresql18-plperl-18.3-1.el10_2.x86_64.rpm 240d7786d198eaa6e419c3a862b6f34e5abc0bbfca03f78ce640037a0af6afcd postgresql18-upgrade-devel-18.3-1.el10_2.x86_64.rpm 370853b18de9d2a9e6db6c7a4c755faf9eccc6a66e1f8e376cbd892751520dab postgresql18-private-libs-18.3-1.el10_2.x86_64.rpm 510019abfe1a7b35bb5596a04e3602385b3ce95ae97d375961433671db234da5 postgresql18-18.3-1.el10_2.x86_64.rpm 59292720d92065b565fd34480338fd88c9a75e0cd98c3389321a58f624acf128 postgresql18-contrib-18.3-1.el10_2.x86_64.rpm 69afef75e9d40200542a42714bc72c9347c4fb950b7c772ee8d5200d43d9a26b postgresql18-private-devel-18.3-1.el10_2.x86_64.rpm 811eea74fa445fce6ce35efee85166a97dbb5e1a1e977f5fbca7446ae885690c postgresql18-plpython3-18.3-1.el10_2.x86_64.rpm 82437c661bbe1ce45f3847633526d6bfa78fa11b5c1d4786681b0a1d5a68ed08 postgresql18-docs-18.3-1.el10_2.x86_64.rpm aef0ca8fd56c9f54ca4cdc6cdd3c9eb437e7e6a1108cc69b41ae622b2e779ea1 postgresql18-static-18.3-1.el10_2.x86_64.rpm c309699d9267eeae9448180ee67d790b1c27df5dcbbcb479100256f90fcd82cd postgresql18-server-devel-18.3-1.el10_2.x86_64.rpm d7fae7f6ed9198789364b4fd9a77befc981852c5a2a85e35e8a810405fb3c252 postgresql18-upgrade-18.3-1.el10_2.x86_64.rpm e909783ef347b94c235b380c3e683a1c36d6710d39ce28c0c482bca198552d97 postgresql18-server-18.3-1.el10_2.x86_64.rpm f944a430dec703e3599c7cd911f41a3c5a511cfcdcaafe47c588336aa8605325 postgresql18-test-18.3-1.el10_2.x86_64.rpm ff72d3aede7142fc0cd5d564d191c812f9253a04094b4b395431710564470edb ALSA-2026:19010 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003) * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postgresql-pltcl-16.13-1.el10_2.x86_64.rpm 214e6614ed732101546586826916d14a65862c7e2eaa82af0210bb06396de703 postgresql-docs-16.13-1.el10_2.x86_64.rpm 22cb29b2e98cc5b165d7128d32e0d7caa40bc8df25f0589600dd19db30e6c2ec postgresql-contrib-16.13-1.el10_2.x86_64.rpm 436ab742b527c33727d4b9fce04cedc763b0e4ef8fad9f6734395a630f590c29 postgresql-plpython3-16.13-1.el10_2.x86_64.rpm 46e03cc72a4792b4272a2e592df3064cf7789a77f5c372f900c450ae0658c721 postgresql-upgrade-16.13-1.el10_2.x86_64.rpm 63842e1189221377406fe9d85130de2272e63176d417e98ae6fabc69f87f54b6 postgresql-private-libs-16.13-1.el10_2.x86_64.rpm 653c9382933888377365eba1d97981a181c318a50394fe04e8609492fb383641 postgresql-test-16.13-1.el10_2.x86_64.rpm 6cb048bd071dfc3fff1126b1e912b030f559e9b3c6af805346b54ae9f2420025 postgresql-plperl-16.13-1.el10_2.x86_64.rpm 70eddceaf52c2d6993e5e7f98d747adb3f3f6db532864645104ea1f09f132cf2 postgresql-static-16.13-1.el10_2.x86_64.rpm abe095fbc9e5b78d04056eb5c216f4bc5a7705a34fa17feea55bdd6f62f7d38d postgresql-private-devel-16.13-1.el10_2.x86_64.rpm b513d82f857892970b7b2c61fee7eb058161ad932d4663b3a6034e8029eefad5 postgresql-server-16.13-1.el10_2.x86_64.rpm bb2d285106c8a7221f87828dfa9110a4fa48d8e7177c1dae25b99a6aa78d3a03 postgresql-server-devel-16.13-1.el10_2.x86_64.rpm beae32951c406228fa99a461812e271c3af1a85de4be4120e12b80a780130877 postgresql-16.13-1.el10_2.x86_64.rpm ee6441f5f49bc6cb06667cd6e53f1b724206d699dd9f696ae2371379bdea6c7a postgresql-upgrade-devel-16.13-1.el10_2.x86_64.rpm ef1311081d4a59b1d70f3a92684ec4376549a8e0a4529e54247354e94e68b0d6 ALSA-2026:19013 Copyright 2026 AlmaLinux OS 0 1 Moderate

delve security update

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default delve-1.26.1-1.el10_2.x86_64.rpm fdd1f76cfb1db500a9b0a858bde68244fab9f21a06fee432c5cd59073928d1d3 ALSA-2026:19017 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default podman-docker-5.8.2-1.el10_2.alma.1.noarch.rpm 167be1b8d65574dac9045abe3e1e0b9208ed8e6c2c2c8b29b83d77c4173a468f podman-remote-5.8.2-1.el10_2.alma.1.x86_64.rpm 4e9ab108eadcb092cc949a6135909529f29e4aa3efbb284d36cec19acfe33dfa podman-5.8.2-1.el10_2.alma.1.x86_64.rpm 5f60e31511c2a9881ec7d094b998e29af0c86f4c7131db9f2535856ef3ed4b40 ALSA-2026:19019 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3.14-devel-3.14.4-2.el10_2.x86_64.rpm 96cfc783fb249cd33a9d10011db15d39d02a525042749ee867d31874146748db python3.14-3.14.4-2.el10_2.x86_64.rpm a419081d6eb80de49b5cdddb742e9658f2b0bb239871ec95035a9a334eae49d4 python3.14-libs-3.14.4-2.el10_2.x86_64.rpm b39c79a16c94e1572d13ad550390e8267f75bc8cfbfd82a5ed990d2e1e8fe182 python3.14-tkinter-3.14.4-2.el10_2.x86_64.rpm e56a3ff5b354152aded87036e4b7368cf6f57fa510139e68f5e348342de81b59 ALSA-2026:19020 Copyright 2026 AlmaLinux OS 0 1 Moderate

crun security update

crun is a OCI runtime Security Fix(es): * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default crun-krun-1.27-2.el10_2.x86_64.rpm 0f68485548ad60490166d6095233bc07f6576d232be65065f267ca42de77d422 crun-1.27-2.el10_2.x86_64.rpm 738f83807e3eb007fc5867fdd825dc06c307c1bb30ffbfbe09383cecf94f8b40 ALSA-2026:19022 Copyright 2026 AlmaLinux OS 0 1 Important

golang security update

The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default go-toolset-1.26.2-2.el10_2.alma.1.x86_64.rpm 2d9c76d3f400e0b41d1e4ede07350c95dcde53f5c01617b0a9ed1d5938cd626b golang-1.26.2-2.el10_2.alma.1.x86_64.rpm 4c4539f8f8d59c0a9b956e54459e9d1108d2a6d8a21ec3b9b21b4b86a174703d golang-tests-1.26.2-2.el10_2.alma.1.noarch.rpm 86ddbd7f00012fa580ea1c9edb33d9e5982eef71b38e0283ad2659fa61352095 golang-docs-1.26.2-2.el10_2.alma.1.noarch.rpm a7b9810b608f99d1d4e8dc8771e6e1493f6f39113e88f56ae83bd92548afe904 golang-race-1.26.2-2.el10_2.alma.1.x86_64.rpm d17377ec284e3ce76604023d4c8e3f39a68353d35eb1adf5b7853ee3c0d5c50f golang-src-1.26.2-2.el10_2.alma.1.noarch.rpm dbf8e7996f83be39afa1954de0ab45d661a96b356a3e406a1960cd6be572a7bb golang-bin-1.26.2-2.el10_2.alma.1.x86_64.rpm f5011855264dbc96a853bb65dbd751834cd91fea68ab46da517aeca25492af7d golang-misc-1.26.2-2.el10_2.alma.1.noarch.rpm ff930bc6ddd8d4469f1e7d1cab514142b71eff36da84ce419045251ce79e3e17 ALSA-2026:19024 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.x86_64.rpm 2f672bc3b8a2f8e1432df99c390144cdc4f675d1e470a86bb98d075bec7db876 gstreamer1-plugins-base-devel-1.26.7-2.el10_2.x86_64.rpm 51659d1333af2b6e8918cde863ce469e28f35d9c2502e45897ecee64a1c6332d gstreamer1-plugins-base-1.26.7-2.el10_2.x86_64.rpm 8dab4520c32b9b62a3f5f69d87d225f7ac5fd19fa6d63e30087eb6a1fca147a3 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.x86_64.rpm 957657a78fe6c2ec4627feaf8b9b60341ff008d4c593a36f1bf52afdf36eee10 gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.x86_64.rpm abc591f87981eb884ad4a7e3f8bd2a045b1b65c424b6997b62e69a0c8d79b4af gstreamer1-plugins-bad-free-1.26.7-2.el10_2.x86_64.rpm b189e3ef8c523c8b14721721ca61210c34570f1b21b5a529f6f1541f0f1e6152 gstreamer1-plugins-base-tools-1.26.7-2.el10_2.x86_64.rpm c1930b08fa8b00aa87df7d9383a55bb0b7da9b4e62d0a6fd437b346141cc56c1 gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.x86_64.rpm c5a052a420b71f51fc8bfd95051eebe031837c7f27e5d2902e6ba7ccd3e8e21d ALSA-2026:19031 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default skopeo-1.22.2-1.el10_2.x86_64.rpm 14df06458d2b470469c3ec314e1b2d4e040b85c0125514c6dbc9aee750153ee2 skopeo-tests-1.22.2-1.el10_2.x86_64.rpm b408ff83cb742c221395cd23e7e5003b19adf86d8f1d8e5e644bad2f671ba930 ALSA-2026:19032 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default buildah-tests-1.43.1-1.el10_2.x86_64.rpm 25f3126c617444344bdfdbced9605da3cc77363fb7d862315b28d69509e3840f buildah-1.43.1-1.el10_2.x86_64.rpm 3896046979f4d2edacd39a6a1e88764371abafe3766ffd7819927f3f26067e3e ALSA-2026:19034 Copyright 2026 AlmaLinux OS 0 1 Moderate

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958) * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-tornado-6.5.5-1.el10_2.x86_64.rpm 286cda998fc032588262e4117c2e4504fade173da29106c96ccd74eefe18ff7d ALSA-2026:19042 Copyright 2026 AlmaLinux OS 0 1 Low

python-jwcrypto security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-jwcrypto-1.5.6-5.el10_2.noarch.rpm db89aecbcd378aa983e05761a6b2cbca01c3a05e38a708730a9029e277498a12 ALSA-2026:19043 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default corosynclib-3.1.10-1.el10_2.1.x86_64.rpm 58b62a363854ac452faada0b192f69eef204c88d0af1275104d00c82b7e791a5 ALSA-2026:19053 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default freeipmi-ipmidetectd-1.6.17-1.el10_2.x86_64.rpm 194fa009ba341b2be80a5a9db856b6d495b835b10ea66d566dfc6323ea32f415 freeipmi-1.6.17-1.el10_2.x86_64.rpm 1fe0f71039e8a256f6be6c80e04c2c924b57e77df1874cc6c8960f2ad5d622e8 freeipmi-ipmiseld-1.6.17-1.el10_2.x86_64.rpm 801aea8945583c33b2ec5ed6764d91c6c6093d57e36a4c1f565ca9bc75838460 freeipmi-bmc-watchdog-1.6.17-1.el10_2.x86_64.rpm e97e49495fb178e3c5e5258b92969677d6c91581371448a3a55708dc19522c65 ALSA-2026:19054 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm 032f9dfd26c60d1d72b363ff2061d11662e957528f62a47531f5bbf5f865b387 tomcat-10.1.49-1.el10_2.1.alma.1.noarch.rpm 30074a00cdb2fd116e1a86d0dd4fde4c0ee1ad6c1d76871cede1af36c10ad784 tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm 910908c4cbeb19192b15b52ff7bcb553a79de45a9fd931d50fa458956364dc8c tomcat-el-5.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm a4ea29cfcc7dc0b39309a55f0cb9f6825d1b6965da13f87f41af81d7293301e1 tomcat-lib-10.1.49-1.el10_2.1.alma.1.noarch.rpm bf8d00201d00c1d371bcb29fde0b79354efbec1bdd757baaebc03477a5d83d5c tomcat-docs-webapp-10.1.49-1.el10_2.1.alma.1.noarch.rpm cd1899698b4ef517e177bafdcbdb1e1542a1f0c867d8b7fefb87b3e46b4b54bf tomcat-admin-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm d5a2b5453e34039aa491637abe23194a845e0a52cb69be855ed09fbc360ed9f7 tomcat-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm fdbfa914a61bc11297a055cca8ba8bb8c9d37d90b771583e8b8b87d3a7a388c7 ALSA-2026:19061 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437) * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glibc-devel-2.39-121.el10_2.alma.1.x86_64.rpm 23920bd9da79447108eda8c3f29ac120f218403daf13404222d658fa0111eeb1 glibc-utils-2.39-121.el10_2.alma.1.x86_64.rpm 3520be7c4040a2b074aab5dad5d0af9c69cc98de23d8e79a203ba5c96b102c33 glibc-doc-2.39-121.el10_2.alma.1.noarch.rpm 8e5944044c77883ffcdf699a95b72c6bb5ec1b40fe769362ba84948c5c446f4b glibc-locale-source-2.39-121.el10_2.alma.1.x86_64.rpm f57b60462f5cf2cbddf8a92820f559c456d89fb5bff11e96d1fff60a54a296de ALSA-2026:19064 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) * cpython: Out-of-memory when loading Plist (CVE-2025-13837) * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282) * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-devel-3.12.13-2.el10_2.x86_64.rpm 1a7e22608ac7a0f520c10ac9641d22b50c494d380e84630ee13af03c19d31661 python-unversioned-command-3.12.13-2.el10_2.noarch.rpm e02dd9af1061d81e9eb4f3b2ab2cee1f8bcaa3917c0c834b9885fbcb4199da2e python3-tkinter-3.12.13-2.el10_2.x86_64.rpm ea31967685c55af2685b76aed6d8f63186709d9fd309a2c2799cd7a3f531873e ALSA-2026:19066 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssl-devel-3.5.5-2.el10_2.alma.1.x86_64.rpm b3b352d7984dd897ded2e210ecdaac4a2e4bde5fb81367a84e5adc78646f062a openssl-perl-3.5.5-2.el10_2.alma.1.x86_64.rpm fb1af0b4d391b0c87f7d4d97cae5d301e0bda6691e96552325ef1531c13a3662 ALSA-2026:19067 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Privilege escalation due to failure in privilege drop calls (CVE-2026-35535) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-4.p2.el10_2.x86_64.rpm 2f888765cd59b453a48ea721166cc80e1c0f1caa5a45bd4f17ff373af0b34b6a ALSA-2026:19068 Copyright 2026 AlmaLinux OS 0 1 Moderate

systemd security update

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default systemd-devel-257-23.el10_2.1.alma.1.x86_64.rpm 05e89297e3e630d704e3c39cea1d2b9560319ce71a86ebd238f51849216c0ee8 systemd-journal-remote-257-23.el10_2.1.alma.1.x86_64.rpm 16d884f462c3e5aa9e6b4c62a2cf2cc59988e96c2dd8eb2058787056488eae46 systemd-ukify-257-23.el10_2.1.alma.1.noarch.rpm b19a2e5d5ceb000880e9a0b2e332123c6cc5f6052003d8b27a6230bc528bca3a systemd-boot-unsigned-257-23.el10_2.1.alma.1.x86_64.rpm bae592b4124c378dff5d9a95638a24fd613d9a25e8730255502794ca1d9c2591 ALSA-2026:19069 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode (CVE-2026-35385) * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414) * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage (CVE-2026-35387) * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388) * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssh-keysign-9.9p1-23.el10_2.alma.1.x86_64.rpm 4a880d720190ca15e5e4f3e932e58c360e7bf319585d6ffe730ab640839a7ff6 openssh-askpass-9.9p1-23.el10_2.alma.1.x86_64.rpm b9ac604bea64327c679924f7ac326fac8d9df879b61f96a1c60d72d0e013c3c9 ALSA-2026:19073 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default vim-X11-9.1.083-9.el10_2.2.x86_64.rpm 4d687421ca6f05aea96701c400060ed0c178cdcadd8507d5564ead082afd9f2c xxd-9.1.083-9.el10_2.2.x86_64.rpm 4e4203c30d23229391460b8d138ce65a86729fab9a5d91e9107d8f60c8847a2b vim-enhanced-9.1.083-9.el10_2.2.x86_64.rpm 7bae5df13bba050eb1e1257782506c985cd42439f4db284073ccef15827ddde9 vim-common-9.1.083-9.el10_2.2.x86_64.rpm cd95cc9d18e60de2ac8954e67d2686ea395660154712fd539cb540b8d461dfa2 ALSA-2026:19074 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677) * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-perf-6.12.0-211.7.3.el10_2.x86_64.rpm 0ac797587a557f630ab490c93eee1f7ce2e1aec56f029aea06c326461c5b100d perf-6.12.0-211.7.3.el10_2.x86_64.rpm 191139077ac1bf1db360f16370078f1874674406aac5c0dee448fd27190794aa kernel-doc-6.12.0-211.7.3.el10_2.noarch.rpm 2a68239ba7e1ffded8f59859942aad0efdfdc10912c47834975a6dd22a799961 rtla-6.12.0-211.7.3.el10_2.x86_64.rpm 561727f230fb475bf2dbb8d6ebb11682085b6201d8484916de086b836a7fed33 kernel-debug-devel-matched-6.12.0-211.7.3.el10_2.x86_64.rpm 8b8d20f1eaeb36cbcf352fa867e45e6e3ab896d2b5c9bedc41cd6f46101b1984 kernel-headers-6.12.0-211.7.3.el10_2.x86_64.rpm 926eb82f2e8ce404ce3c5a8cb9e1c5691aa690c22ca13fa2820403abd7296c41 kernel-debug-devel-6.12.0-211.7.3.el10_2.x86_64.rpm 937f0b13e81173ad0230ca5358667e1f82750e314b4e21b762b0c1c3e470dd2b kernel-devel-6.12.0-211.7.3.el10_2.x86_64.rpm 96622442f0884219b0096631c3b982eed1843752ecc98bf35e1797895712c7f3 kernel-devel-matched-6.12.0-211.7.3.el10_2.x86_64.rpm a7ce6d44decd3ba91de695dbea6e579d99f6c984dd0ffd3ce2aaa0c6b14c9467 rv-6.12.0-211.7.3.el10_2.x86_64.rpm e444dd01fac7526decec93ea7f20ac752dedcb9e8b8370fc7f9db69b8a8bbd4e ALSA-2026:19125 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.x86_64.rpm c29aa5563aedb6371b31718c3023398e0da04c0fe226a40d37740d4b58dc72ca ALSA-2026:19126 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default yggdrasil-0.4.9-4.el10_2.x86_64.rpm bc54535ff17a4f1ce9e0152de2c7eb6d75ae436c6fc922f7b314e1efc965c823 ALSA-2026:19127 Copyright 2026 AlmaLinux OS 0 1 Important

gdk-pixbuf2 security update

The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. Security Fix(es): * gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gdk-pixbuf2-devel-2.42.12-4.el10_2.5.x86_64.rpm 6d46cc96c2a1a13b50dd29ae33201fee65beaf77dc4c1c80eb4fee2ecf0c7b89 gdk-pixbuf2-2.42.12-4.el10_2.5.x86_64.rpm 8faf4d4846d44d8590a0ae5c79a77a3d0eae8916f39a33e7f0c09f3f15002a8b gdk-pixbuf2-modules-2.42.12-4.el10_2.5.x86_64.rpm 907ab9e417d7d57f4d32ff6df4de7f485b4bfa5b82d3126edbbda8a14425cc73 ALSA-2026:19128 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-6.el10_2.x86_64.rpm 6d2acb944b80190afddecd088d3f82c3dfe519078946776a8db3cba8933b1b14 ALSA-2026:19130 Copyright 2026 AlmaLinux OS 0 1 Important

libcap security update

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities. Security Fix(es): * libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libcap-devel-2.69-7.el10_2.1.x86_64.rpm 0547999f208af95e59f024af2bba6860eb43072e6e3bbb99c13b3b8a7c4d72e8 ALSA-2026:19133 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default git-lfs-3.7.1-4.el10_2.x86_64.rpm ce94d6594cbfc1d2fce8cb89fea5f278c0221705f9759bdf78ac06efdff77407 ALSA-2026:19134 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default grafana-selinux-10.2.6-26.el10_2.x86_64.rpm 05b7c2c7debc56987ea4810bf0a635acb444d0fc160cf44c1f5ccc841c6c9e0c grafana-10.2.6-26.el10_2.x86_64.rpm 1494970d1e99faa361f5d5b8c991b15845b03b92b489403a0bb338ac7281b592 ALSA-2026:19135 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default opentelemetry-collector-0.144.0-2.el10_2.x86_64.rpm 28c150841225f1dce46474ad85da323c22b060a3641bd87ab82f902f2ff3e095 ALSA-2026:19136 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default grafana-pcp-5.3.0-5.el10_2.x86_64.rpm ef04b532f3c0efdc45bd37a02599b65bfdcc0842d2dabac2a08fd94c67609c45 ALSA-2026:19137 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default go-fdo-server-rendezvous-1.0.1-1.el10_2.noarch.rpm 2f723b54c36ddf004e4bea960e425128bf2d983f8a3113e157997f07bad4fa7a go-fdo-server-1.0.1-1.el10_2.x86_64.rpm 4e4fb74f429d74df1306269d2e2420e7c56b3e85e8ae93e0444ee4a7e5617934 go-fdo-server-owner-1.0.1-1.el10_2.noarch.rpm 4fdde5d0f325c9777d1a0493b93f5f958290c8b3b8c46095516d2e7e8ea2d03e go-fdo-server-manufacturer-1.0.1-1.el10_2.noarch.rpm 503719bae2e16f1ef8bfb6389d8210cb55c14a40a4f7f7f00e40c82bfd1f8095 ALSA-2026:19139 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fix(es): * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default go-fdo-client-1.0.0-3.el10_2.x86_64.rpm d560a2e6b331eda4286e82d45bba304b719b7970b551a7392d8361fb2773da6d ALSA-2026:19141 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default PackageKit-glib-1.2.8-8.el10_2.x86_64.rpm 9410cb402d71aa8225233362d3be16c92a377fcb89a4d5e2133eb273516c90fb PackageKit-gstreamer-plugin-1.2.8-8.el10_2.x86_64.rpm d1988ae31f13acab71799cc25662488fbef0cedf1616446247b824ef3288e2b9 PackageKit-command-not-found-1.2.8-8.el10_2.x86_64.rpm e90089024171aa84617fe4330196b142c1a837501e6ef35e1f886a4acd82dade PackageKit-gtk3-module-1.2.8-8.el10_2.x86_64.rpm edabd805ef5a5bcd8d611d9db50689367ea9daf6f62e6244fab293e1d90021b5 PackageKit-1.2.8-8.el10_2.x86_64.rpm f8b4164943f6c44db1977eb7da1163a223797ff5e6c5d93a70977f2a5a54cd36 ALSA-2026:19143 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271) * libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libsoup3-devel-3.6.5-3.el10_2.11.x86_64.rpm 3eac197ea71f50a431f9d006cd3c3c7f3a17cf39b27ecd63a6f1bd19912eac46 libsoup3-3.6.5-3.el10_2.11.x86_64.rpm b7634121742c3f218f724ae568a845757fe715cb5acd1b194b2e1da355c15af9 ALSA-2026:19145 Copyright 2026 AlmaLinux OS 0 1 Important

krb5 security update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). Security Fix(es): * krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356) * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default krb5-devel-1.21.3-10.el10_2.x86_64.rpm ad22f25fc84a3696d7b10b42b928b37d7cd86161e4e28079e5fa20bae12a3e48 ALSA-2026:19146 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openexr-libs-3.1.10-8.el10_2.2.x86_64.rpm 3f47c59df821417a1e55bf9c19965e868f7275f6830b81d0dd20127e8a6f9160 openexr-3.1.10-8.el10_2.2.x86_64.rpm 8b0e93cde29770a5dbface4f8711e607d9946a8b599425df15b637ddbbcb5f53 ALSA-2026:19148 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glib2-devel-2.80.4-12.el10_2.13.x86_64.rpm 2ad258f5b9473f4a290f97ff23bc5e8ce37a75431b92fc6619e2724b0034ba96 glib2-tests-2.80.4-12.el10_2.13.x86_64.rpm 3494f9ab3615e77930e9be8c0b062caa477a32b42f933e8b859eca069cd36e7d ALSA-2026:19149 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dovecot-mysql-2.3.21-19.el10_2.x86_64.rpm 9cc4f475bec6141a8019b2677d0f56e29f67daace9d24190de3b05d3c841fa92 dovecot-pigeonhole-2.3.21-19.el10_2.x86_64.rpm a5e4de560b44dfce218ba307862f96ae70f46cea4bb46e8f3f0cfdc5577a7e45 dovecot-2.3.21-19.el10_2.x86_64.rpm d124991608546945f628b861555da467f0a2aa9b090a9082b76f1b542b7eb487 dovecot-pgsql-2.3.21-19.el10_2.x86_64.rpm deec3c7c1cbcfcc3992e5f4615f18e78d43a31bb729c8241ea9d8b444b9479ab ALSA-2026:19150 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libtiff-4.6.0-8.el10_2.1.x86_64.rpm 5d469c5afe4c676a72d019ae15dea2ed137134916910ea16f1f36e9a86ce3587 libtiff-devel-4.6.0-8.el10_2.1.x86_64.rpm e253d8e9afc51f587f90dc591f2aef077e3a2e8d8d3f8a2d02ba6e8fe97b8c5d ALSA-2026:19152 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rsync-rrsync-3.4.1-6.el10_2.noarch.rpm 6ce73c87a6758941f9efbd47f3a5dd2a2ea31d8602fe86d9b50d137c2939e69a rsync-daemon-3.4.1-6.el10_2.noarch.rpm 9f76d6a1f61310d5e7fb2cad97fccf750d8a2777db08a53fec77160350cf917f ALSA-2026:19153 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323) * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320) * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322) * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default thunderbird-140.10.1-1.el10_2.alma.1.x86_64.rpm 83ce7a155936d4eca0a89c96ee01a8a60a4988f2acf4bd063c561c34ba81665b ALSA-2026:19154 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default giflib-5.2.1-24.el10_2.x86_64.rpm 75d4b7762abb03ead78c2cc0ea18620f29eb19a6625519610a781bff3721cd8f ALSA-2026:19157 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323) * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320) * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322) * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default firefox-140.10.1-1.el10_2.x86_64.rpm 94f3749f671f521421481372e361390d6e0121e162780d3ea2bb50ddecb185cc ALSA-2026:19158 Copyright 2026 AlmaLinux OS 0 1 Important

dnsmasq security update

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dnsmasq-utils-2.90-7.el10_2.x86_64.rpm 733dbe00db109745abce1fa55f5389f4a59b10c0ba6770b4c75423926f274ed2 dnsmasq-2.90-7.el10_2.x86_64.rpm 9dbfedf67bf7ffe5f3ddbfceac450734e61bcfccbeef8bb5d6b11272275f8d31 ALSA-2026:19159 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nginx-mod-mail-1.26.3-6.el10_2.3.x86_64.rpm 0f6860591b566cc94b3ec5dff79ff0744d8c7c8a25ee4d645e2e49cb78e75a3d nginx-mod-http-image-filter-1.26.3-6.el10_2.3.x86_64.rpm 2dd703c5f301e797b8915fc72bb4cd792840bae317a80f63bef52030bdccdfcf nginx-core-1.26.3-6.el10_2.3.x86_64.rpm 300eb6e84d90e76cd26041ae3e3dee83f7d735b3e30d9dd2719dc8b71ad04fef nginx-all-modules-1.26.3-6.el10_2.3.noarch.rpm 3f0c16ba9b852a8917cd5d6999e2c127f547446efc3c0f2cf3c5eefc43e389c4 nginx-mod-stream-1.26.3-6.el10_2.3.x86_64.rpm 4897b357b35b3b1497fce5cd01d3020f45e7cbf8bb3df2399332c76ff8650140 nginx-1.26.3-6.el10_2.3.x86_64.rpm 7bd438bd307d99a8bfcfbcab324f672b1a2097782ffffc62208b1b9f16a20127 nginx-filesystem-1.26.3-6.el10_2.3.noarch.rpm 8890f406349040013ca50201c62964d631bbd50b288c439c5ab1bfd5bafc9330 nginx-mod-http-perl-1.26.3-6.el10_2.3.x86_64.rpm 8c6ccb50d90e017fb6c8e15ba103e8ff9e5d8baf3ac8201297b51246e75e9a3f nginx-mod-http-xslt-filter-1.26.3-6.el10_2.3.x86_64.rpm a10d24d420e8b83a2a4b2865250d6df6e79abb51a572000b40c10b4005bef82a ALSA-2026:19160 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Other issue in the WebRTC component (CVE-2026-8094) * firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092) * firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default firefox-140.10.2-1.el10_2.x86_64.rpm 95275af175e5b4eeaff079107605f2bf7d1d6ee9dea2094126953baa2cb5d7d0 ALSA-2026:19560 Copyright 2026 AlmaLinux OS 0 1 Important

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libsndfile-utils-1.2.2-6.el10_2.1.x86_64.rpm 2b28c1eb585e12ff7af87cf528adbc9af44d709c338ddf5805787cd3e31610dd libsndfile-1.2.2-6.el10_2.1.x86_64.rpm fa12754c51bf06eac550fbe5ac1a335448839c75f4bc4eb86a276f904dde370a ALSA-2026:19569 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-headers-6.12.0-211.16.1.el10_2.x86_64.rpm 1cffce23405cfc59731c027c536dfe667dbd5536b1ab4f5bc384066785e87055 python3-perf-6.12.0-211.16.1.el10_2.x86_64.rpm 5044939e24abcee8776faa6dbe080a8999c23d5a39682d84edee3656888c8386 rv-6.12.0-211.16.1.el10_2.x86_64.rpm 64c76a2115e5cc2766a6b2d542617f385807f45f1783668a0a20d3c4bf104f1a kernel-doc-6.12.0-211.16.1.el10_2.noarch.rpm a30d005f590aa010563453b7942bdd2cfa63cee5945427cf1bda74dd421aed6b perf-6.12.0-211.16.1.el10_2.x86_64.rpm be175ae3124b9dfc94b7898105c811d654a00a24e6a53d156cc839b6e501e680 kernel-debug-devel-matched-6.12.0-211.16.1.el10_2.x86_64.rpm cc7e7e49ea48111c4c48c4632d76f45f6972580389461c31cbaa487bfd97b7ad kernel-debug-devel-6.12.0-211.16.1.el10_2.x86_64.rpm d036bb5d6c0fe98cab057a99e3a03f39cd0921c97701539b51bcfe86a6db2cf5 kernel-devel-6.12.0-211.16.1.el10_2.x86_64.rpm d5b0f9ebc2dd4e282f3cb5cf9469ba8f24e323f241488ea2613d98cedbe89e4f kernel-devel-matched-6.12.0-211.16.1.el10_2.x86_64.rpm ebc2475f5f944cc4a581bf950481fee53493dca82e6447fb2a77525cb6879d66 rtla-6.12.0-211.16.1.el10_2.x86_64.rpm f4bb9d8d576d087002b35e7fb1664d1f5f3561701e91674c57fc5247c5dba0ab ALSA-2026:20594 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glibc-devel-2.39-124.el10_2.alma.1.x86_64.rpm 233dbb230a9bee4102903df8b741cd006dd7088907579d700d1c9324bb3e8bea glibc-locale-source-2.39-124.el10_2.alma.1.x86_64.rpm 40783a9a37504001415947d2758edf9c2b269ef423a3370e0760d8d45bc758a2 glibc-utils-2.39-124.el10_2.alma.1.x86_64.rpm 6a78e76a00a637aab55ba3cdf6090b86b1078a3c9ff5aae99e3b81364c12ef8e glibc-doc-2.39-124.el10_2.alma.1.noarch.rpm c589ecc76ade948f7fc3324ba9ed3bd004cb7f413e99688e10998fd997695708 ALSA-2026:20600 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405) * wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVE-2026-5656) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default wireshark-cli-4.4.2-10.el10_2.x86_64.rpm 127b297019eab447bd2a4eabce7a4daccd97ae7a0d3e289d5dce27218884bcca wireshark-4.4.2-10.el10_2.x86_64.rpm 280ffa3d9c2438339718a91a2f52e265b33af132f7e099c7d440dc28e67194e8 ALSA-2026:20606 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ruby4.0-4.0.3-34.el10_2.x86_64.rpm 5dfc9420bf129a7360045e7311d5d5894fe8048692c68094eaedd7a48292a159 ruby4.0-rubygem-mysql2-0.5.7-34.el10_2.x86_64.rpm 6ba090e1344a07de7a1020980f5954d4eb369e2f76979f22d91d7c9f1493e76c ruby4.0-rubygem-pg-1.6.3-34.el10_2.x86_64.rpm 91196d5689b51e27522e96f59dc022f84c67583951e5afab27d63033ac5d7c24 ruby4.0-devel-4.0.3-34.el10_2.x86_64.rpm fb7962b02c51276b445d1373cc1cd0894c3a399b2c95202c193c4252e88d1e32 ALSA-2026:20613 Copyright 2026 AlmaLinux OS 0 1 Important

gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009) * gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845) * gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010) * gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833) * gnutls: Fix intersecting empty name constraints (CVE-2026-42011) * gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gnutls-utils-3.8.10-4.el10_2.x86_64.rpm 06769362fc2633a09d4f8240f7c784ff3417dafb0ea3cc7e6eb3b88c0e6a14bc gnutls-c++-3.8.10-4.el10_2.x86_64.rpm 6efeb1299ed24bbf94f3a2ceca630eeb488fedacee9ab994c5dd5586ba4e8188 gnutls-dane-3.8.10-4.el10_2.x86_64.rpm 70e0709d06a1aedd9cfa4deeaa00f897f0d981f9eeeda4f94b05d3861f512d42 gnutls-fips-3.8.10-4.el10_2.x86_64.rpm 97cc90bf3a2dee3e15a8d077fcc1b5afa23c7ee5861d8e552f141bf0b3fd81e8 gnutls-devel-3.8.10-4.el10_2.x86_64.rpm df7458ad8419d2e6846d296a2cb4d829a3666697cdfc80305a0c7ed774ff16cf ALSA-2026:20693 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236) * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mysql8.4-8.4.9-1.el10_2.alma.1.x86_64.rpm 02025d4dda7536494fdf8f075d64c8cdf063cf78b5fc0651e751e422bccfd394 mysql8.4-common-8.4.9-1.el10_2.alma.1.noarch.rpm 0d7ccc94e1089ffb6b3fbcd721eec0fed9e1f3494a20fd6d6458a4b6df88a845 mysql8.4-errmsg-8.4.9-1.el10_2.alma.1.noarch.rpm 1be911010c4913a85c01b874457f48ba4933cb9701ec3fe5760128223f810f45 mysql8.4-server-8.4.9-1.el10_2.alma.1.x86_64.rpm 56754d6f774d38000071d28999b8f59a84b68711e527887ef9543c752c27d366 mysql8.4-libs-8.4.9-1.el10_2.alma.1.x86_64.rpm 8cbff422a640f21b93c9ced9b8e7573f53e0fc09108e19135e19036fe04cfe52 ALSA-2026:21286 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-apphost-pack-8.0-8.0.27-1.el10_2.x86_64.rpm 28a47238213578c9246611dc38dd10ebbd21588f6910154766ecd0f5d32d1028 aspnetcore-runtime-dbg-8.0-8.0.27-1.el10_2.x86_64.rpm 42e162af24604895f70a89c5fb76da147946186a7d1deba5bb5fe5f9a9e855ab dotnet-templates-8.0-8.0.127-1.el10_2.x86_64.rpm 72e7209c1c1f192573785e4648b39233e486c22a0772b2ae0439cb7952ea58ba dotnet-sdk-8.0-8.0.127-1.el10_2.x86_64.rpm 79fdd6537dc4b2018c063c0d48b0799cd219511cd19c13a0269cf2adb4fced4d dotnet-sdk-dbg-8.0-8.0.127-1.el10_2.x86_64.rpm 8959f81ed4672d401fda0620b925f057c6d6693f732bf5552872a7fa3437c2bc dotnet-runtime-8.0-8.0.27-1.el10_2.x86_64.rpm a7d04c93f73c3f3f031608991479b15b9267a03d5ab16498d75beca4de4c7ba0 aspnetcore-targeting-pack-8.0-8.0.27-1.el10_2.x86_64.rpm ad8a6b30bc7dee784a6441062ec36690c8d00db0bb626cadbfe408836256397d dotnet-targeting-pack-8.0-8.0.27-1.el10_2.x86_64.rpm ad9ccc9918b763b10e7b58896754fd993708bee096b6da633b7034b2d621e54c dotnet-runtime-dbg-8.0-8.0.27-1.el10_2.x86_64.rpm add6d568c8d5729db9d04301581e286fb8bb56191d767822f480a519ae5c1abd aspnetcore-runtime-8.0-8.0.27-1.el10_2.x86_64.rpm f8c2eb826ad0d76b32966a1d05041a1efce7c156e3164048a553f401eb6e630c dotnet-hostfxr-8.0-8.0.27-1.el10_2.x86_64.rpm fc5309d5d11e0e985f3b9846d5272a908bf18de6c6fd39c1d60ecd9a35dccae4 ALSA-2026:21380 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default firefox-140.11.0-1.el10_2.x86_64.rpm 0b380eed69d054c22a6380859c53ca98c0bb2b8b647549eae0dcb08b061e579a ALSA-2026:21433 Copyright 2026 AlmaLinux OS 0 1 Important

httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mod_session-2.4.63-13.el10_2.1.x86_64.rpm 120860ade7b76f46ace15e1eeb986321e2a46817639186e50eb873191f75be57 httpd-devel-2.4.63-13.el10_2.1.x86_64.rpm 150db8fb127f5cf5220e1772e46aad0d1f9da6b82de35f058551372ce475f2bb httpd-core-2.4.63-13.el10_2.1.x86_64.rpm 24b6219f280d132ead33cd72817118ccb718fa117d81eec5aa870329478394c9 mod_ssl-2.4.63-13.el10_2.1.x86_64.rpm 5f339d1c35bd2a0bd6c2f541dd9d6fb125aec4b8c1ea929ee9714490b63e2c98 mod_ldap-2.4.63-13.el10_2.1.x86_64.rpm 75ef1e1d559de5181005a673c97ac20e3bd03d01ba82614ba9a5910ee3a4a44c httpd-tools-2.4.63-13.el10_2.1.x86_64.rpm 834c2d11f99fca536a267ed1fdeff9c959fe36b8a9c43312a913470290a3eaa7 httpd-2.4.63-13.el10_2.1.x86_64.rpm 8a619b7ae8f396862ce0cb03d8475586fb8f711cb5b43275aec8012c93218bfb mod_proxy_html-2.4.63-13.el10_2.1.x86_64.rpm 91032254f4ff3674293cc553b7be162dce727ff9ca865a4dcfa4f4ff13cd55ff mod_lua-2.4.63-13.el10_2.1.x86_64.rpm ca537fcd6e9ab70a31f5cf0c775bcee0a536164432e075ce73bd4d3ab5aa29dc httpd-filesystem-2.4.63-13.el10_2.1.noarch.rpm e031b93501860443509180fc94ca9fd2f55bb1e5c48013833c3648cf8b45ea9f httpd-manual-2.4.63-13.el10_2.1.noarch.rpm e3cfbdbc5fcf4512653e1a0be2d6396861efc9b9c15498e4543c0fcbc556c07a ALSA-2026:21557 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375) * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392) * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006) * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020) * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051) * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023) * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110) * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190) * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205) * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.18.1.el10_2.x86_64.rpm 08caf980bc4857e1c7641a40f56b730826e5f590192ec241b95346ab0faac527 python3-perf-6.12.0-211.18.1.el10_2.x86_64.rpm 26867a80d66a188b52dde8805a82f6d83daa698e8c18d4cd065db8991e6aa863 kernel-devel-matched-6.12.0-211.18.1.el10_2.x86_64.rpm 5e14c41b3aa5dc4f50f48ccd8e4d9dc90224bc8f3135ce692d4cf9d25931763d rtla-6.12.0-211.18.1.el10_2.x86_64.rpm 641a5604e601fe456a7637591703aac6288b171a3d258660a22f32e295c71cc3 kernel-debug-devel-matched-6.12.0-211.18.1.el10_2.x86_64.rpm 854278fe146a1c1182457ad64183e27b37d5569bfa1fdb85579d988d55b3da2c perf-6.12.0-211.18.1.el10_2.x86_64.rpm a33491dbb0a480beb220468c299e92346b3cb589bcdd187e083cb64a3d158d36 kernel-debug-devel-6.12.0-211.18.1.el10_2.x86_64.rpm c4760e16e10934278ae931e762a9fb9a353253cf1e8b1fa527ed7f3bad6b604a kernel-doc-6.12.0-211.18.1.el10_2.noarch.rpm d65ef7f528d990c65a6b7fb8ffc6e3ded25ceee509be5fa08d627d0c203045e9 kernel-headers-6.12.0-211.18.1.el10_2.x86_64.rpm d676112d2d9e847f60597be4341bb1bbb1f4bc13166f02a2df5a640663f754d7 rv-6.12.0-211.18.1.el10_2.x86_64.rpm f6f25b43dcd660d561f45dcd6018ca96e3508aec1b1365ca9e21b74dcc50649d ALSA-2026:21676 Copyright 2026 AlmaLinux OS 0 1 Important

cockpit security update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default cockpit-packagekit-356.2-1.el10_2.noarch.rpm 29bea62d6da80ffe7185c0a5c07130c9f8bdd8cf3db5e6956ab11f4675ba353b cockpit-storaged-356.2-1.el10_2.noarch.rpm db2a2a221c93a54b55c9d8c46acdea7e845e9d978c1572d583e9113742dd59f2 ALSA-2026:21754 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default aspnetcore-runtime-9.0-9.0.16-1.el10_2.x86_64.rpm 0da5677aed7317cf4e692b99f87039833a7a54cf4eb80b6354b725de4f7a13c3 aspnetcore-runtime-dbg-9.0-9.0.16-1.el10_2.x86_64.rpm 145c5d9f71d622c8523e409f4ad5b9936e7cc78e4359a7daf7d1e6362143ce77 dotnet-runtime-9.0-9.0.16-1.el10_2.x86_64.rpm 348272494beb45bfe84fca89f2729b130b949395d8361d5080da4dbeb1d2c256 dotnet-targeting-pack-9.0-9.0.16-1.el10_2.x86_64.rpm 3f8dc5c0d4e97334af9cbf7e1be1b0857f9676df0cfa41bcfeef2a87bca2c60a dotnet-runtime-dbg-9.0-9.0.16-1.el10_2.x86_64.rpm 4218319dc85d8b57ecd98032c60971af5aafc4ae3f41b752fd38b8df67e93a8d netstandard-targeting-pack-2.1-9.0.117-1.el10_2.x86_64.rpm 6206d6f4e709db63e62bfd2658cba6f892cbed48dd1edff54d52d9deb6e8e9e6 dotnet-sdk-aot-9.0-9.0.117-1.el10_2.x86_64.rpm 7397b25e901cf63f99a8aef53efe360231ae9bda87a653f748977e17f7e9dcc1 dotnet-sdk-9.0-9.0.117-1.el10_2.x86_64.rpm 96118df3fe3da3125e4b63f109700e215bfd8637318880605ce578e92dd382ba dotnet-templates-9.0-9.0.117-1.el10_2.x86_64.rpm a6e5433e9bdac3d9679e2d2b030b4e7e20401c861daf4dc2c14e31a2e982888a aspnetcore-targeting-pack-9.0-9.0.16-1.el10_2.x86_64.rpm bea4602049b68a802aa26776ad61d3040cc97149e6760cc38dcf53c03c749a8e dotnet-apphost-pack-9.0-9.0.16-1.el10_2.x86_64.rpm c63f0c2d887f16fa398a214f7311ca7d0b48f0952aa4971bf161798e4e37778c dotnet-sdk-dbg-9.0-9.0.117-1.el10_2.x86_64.rpm cc58a24647d9c88c2b57636b38e1aaa18b4effdae8b4b0f4beeb2fd24b46e8b3 dotnet-hostfxr-9.0-9.0.16-1.el10_2.x86_64.rpm d09bb8e99423f37a375eff7f436a4911f5244ba1cca3bd3e9b06f2f7269f1b44 ALSA-2026:21757 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default flatpak-session-helper-1.16.0-9.el10_2.1.x86_64.rpm 009148cf7dace481fa7986da224b17ffa99787d388741a02f62ce50926b009ac flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm 22949ff4b832a5fbaf79d354cfc73af59a6746d662dcf4d0c294b24dcd69a9c7 flatpak-libs-1.16.0-9.el10_2.1.x86_64.rpm 89994cf375fae9ddab6a1a576062a3e0e12e51c53596300a73438b2fef47c918 flatpak-1.16.0-9.el10_2.1.x86_64.rpm 96149e48e94da829daf167ad7f76f85ae02b6597b3d8e40d010448666736677e ALSA-2026:22141 Copyright 2026 AlmaLinux OS 0 1 Moderate

go-fdo-client and go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default go-fdo-server-owner-1.0.1-2.el10_2.noarch.rpm 2f5a8bd1401f47c152f97edd4dcc2bcfe5b02e9edea564cd3f27e4152facb328 go-fdo-server-1.0.1-2.el10_2.x86_64.rpm 73b78eef599d81f91dea670f7b606c5c9618ad7e7a3c80e6f1b14d3029d947f6 go-fdo-server-rendezvous-1.0.1-2.el10_2.noarch.rpm 843e6a44fb5ab7ca974b5dc823978d86e2f4d3d2a91a9aef3292f97beafc75f3 go-fdo-server-manufacturer-1.0.1-2.el10_2.noarch.rpm b1739b5cbc00a312407f39f5c8b72d26a9a88f099f93f00e1d68db826a024bb9 go-fdo-client-1.0.0-4.el10_2.x86_64.rpm eb85f88e2245831b5126c14026a4723b60a5946ce769982315d1febf52203fe9 ALSA-2026:22145 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-runtime-10.0-10.0.8-1.el10_2.x86_64.rpm 0bb27b7886456a46c6aeeb1c1ca3832128ef226a5ea29eb259ebc324e83bf429 dotnet-host-10.0.8-1.el10_2.x86_64.rpm 10e767b104f59a4875d125b810eda2e69eec1f32b180a65833d01b837e3b9f62 dotnet-targeting-pack-10.0-10.0.8-1.el10_2.x86_64.rpm 29af4038cbaeb3e9d20aed112507f756ef520422a79c1e7df1d71d537264c2e7 dotnet-templates-10.0-10.0.108-1.el10_2.x86_64.rpm 3d9435dbb5958169719599e9242f11544bbe999b898aa2704c986d095583f475 dotnet-sdk-dbg-10.0-10.0.108-1.el10_2.x86_64.rpm 4bacffa257a1ad892cb9d1f1979665005ee34dcadabf248840a0f0f6c131e80f dotnet-sdk-aot-10.0-10.0.108-1.el10_2.x86_64.rpm 6a6e67648e28c12406eaedcd379111df5cac205db0f4df69c222495337e5e85b aspnetcore-runtime-10.0-10.0.8-1.el10_2.x86_64.rpm 7cc9d92edd03f67d5ada22bb4c5501e56561589a436cabe65584f3256dbaf30d dotnet-apphost-pack-10.0-10.0.8-1.el10_2.x86_64.rpm a958834cf717d29e4a6106bbb0ae2609b9b5ac51eeb9bcbdd380d3300bd8e179 dotnet-sdk-10.0-10.0.108-1.el10_2.x86_64.rpm acd1f70ad88c634d55a25316cb8028b7d3e65c46589d967ba6a3774d43577878 aspnetcore-targeting-pack-10.0-10.0.8-1.el10_2.x86_64.rpm bd986c125f591131afe84314d8c0ce722c79a4ee4962c40ae35fd1e403b55d95 aspnetcore-runtime-dbg-10.0-10.0.8-1.el10_2.x86_64.rpm c719ee1ad4ea4f8ac007915be31cdf56d75385b9cb11968d0f991e1469a4a398 dotnet-runtime-dbg-10.0-10.0.8-1.el10_2.x86_64.rpm da48bcad0bd6507586f36c49efa7e8437a1259c226ec338ae3f2005ef646507f dotnet-hostfxr-10.0-10.0.8-1.el10_2.x86_64.rpm dfcae1d3c08ea278fbae00761c6d5417d257998c2479af014647d7ce07571e99 ALSA-2026:22314 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssl-perl-3.5.5-3.el10_2.alma.1.x86_64.rpm 30723d71d0f9295957e1f627634aa4de75a9c7e167c3ffc9490084f62d5180dc openssl-devel-3.5.5-3.el10_2.alma.1.x86_64.rpm 824db290b02f56e9c6d021d0fc5d51cf7c6d90e7df7f0488efb5958c49f8412b ALSA-2026:22325 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default thunderbird-140.11.0-1.el10_2.alma.1.x86_64.rpm 8126f3b01e2322cae3f003bc16ae39de3634f4772f47af7d44d2bcc924c0b748 ALSA-2026:22528 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_http2 security update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.x86_64.rpm 0fc8e0c70d9a7e43eae5b53c0e1e55cd429d4a8dc373d34df05bc9188ac59bbe ALSA-2026:22529 Copyright 2026 AlmaLinux OS 0 1 Moderate

libexif security update

The libexif packages provide a library for extracting extra information from image files. Security Fix(es): * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libexif-0.6.24-9.el10_2.1.x86_64.rpm bafb41c91c362c01aa3f2f1a88d26710ae9894038393fa438000d4d1f82f573a ALSA-2026:22649 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) * php: denial of service via DOMNode::C14N() (CVE-2026-7263) * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default php8.4-soap-8.4.21-1.el10_2.x86_64.rpm 0080d75a593d9c2ed75b1879782a067ef2454fd1ffa5dabf01db8686a1c44e8d php8.4-snmp-8.4.21-1.el10_2.x86_64.rpm 04d8f4f9ccdbbd99da9f7a024c5b73184e495b1ee28c71b6420d466696e7e0db php8.4-gd-8.4.21-1.el10_2.x86_64.rpm 0dcf9a05fd64b73df51f4ef4eccf55524b24c51bfb8ffeb82c9e368e7df16bb9 php8.4-xml-8.4.21-1.el10_2.x86_64.rpm 0f9cfde5670b9ac0409926dfeecadaf7f7e5637e24cca025542a5e8d05a35d50 php8.4-enchant-8.4.21-1.el10_2.x86_64.rpm 2024abf6c6015f9cec68562b9ce9a75e57dcddc777d27c4430b47643457aecd0 php8.4-fpm-8.4.21-1.el10_2.x86_64.rpm 3c9eeb47070f8a01986b6ba0c1ee0c8c2b3ae2a0f794084cbc0ad211d11d833a php8.4-devel-8.4.21-1.el10_2.x86_64.rpm 43c115ece6fc2bcc555cb69c056d95c48910be569ab67ea64a9ae5c8a3be9e17 php8.4-ffi-8.4.21-1.el10_2.x86_64.rpm 49a423558aecb64a6d9342b23fb752d5016fbbd45a745ea54a69a0f00161dfd4 php8.4-ldap-8.4.21-1.el10_2.x86_64.rpm 52b000a07ac1d706b6e69437997dfa69bc5dd159e9a32050c7cc02dd6b07dcdb php8.4-8.4.21-1.el10_2.x86_64.rpm 5412ef0311fa8d8a67704263d0d77499d8e5626b615f7a600256c36de99afccd php8.4-cli-8.4.21-1.el10_2.x86_64.rpm 551cc66d4c85cdadef212b4d9a6fbe0a6ab9bdc4fdbf3538dec7b1d24e67e35e php8.4-mbstring-8.4.21-1.el10_2.x86_64.rpm 55e1ed5eb9e163a87654cf570d5544b49def514353fd7710b6f952c167293ef0 php8.4-pdo-8.4.21-1.el10_2.x86_64.rpm 56c615b9e751177f12afc099dddf72eb2dbdc660f75eb56128714f70a656c7c2 php8.4-embedded-8.4.21-1.el10_2.x86_64.rpm 5cb6d41f1d0fecb2b775980cb0fd793f18cc40740877b769095fead17217b10a php8.4-opcache-8.4.21-1.el10_2.x86_64.rpm 7f1ded9a64d67b4df648c6af8abe5e16f0f599a716c1b45ad6638857555de1ce php8.4-process-8.4.21-1.el10_2.x86_64.rpm 9634857c67ddf2acec26bc019615137da97b2c288ee71965f4c19c8a210f83fb php8.4-dba-8.4.21-1.el10_2.x86_64.rpm 9cca3c228dca2c9571997b3cde4c22a21fc7d46d85ee7fcd655c41a4ef14cdfc php8.4-odbc-8.4.21-1.el10_2.x86_64.rpm b1baee338c91835525d8f26925f03c12c6418c5901652f30d5235f588dc29fcd php8.4-gmp-8.4.21-1.el10_2.x86_64.rpm c9765c1678be559cbd5d9d3d0d4d2018f4d28b1d083501f54b17d3bffaff17d2 php8.4-bcmath-8.4.21-1.el10_2.x86_64.rpm caf50773dc71bf70ce11563983d207fa68be01c882f903c22ad755c28225209e php8.4-dbg-8.4.21-1.el10_2.x86_64.rpm d26976197bc7135adb62036ca7a717817e125bbb5785f629138713c0470a1e88 php8.4-mysqlnd-8.4.21-1.el10_2.x86_64.rpm d56043ee7cd88eb8eba7a0d676a2000199d7ffc7b81da4ea793d3e24492eacb8 php8.4-intl-8.4.21-1.el10_2.x86_64.rpm ed83de6485d3a90256f18a106d45573c82666b879e19784d6ced52009cb4e61c php8.4-common-8.4.21-1.el10_2.x86_64.rpm f2d9db2b23121f586d30ed88ca11edb0ab2ff8c17c299e1c78618737c9d527f5 php8.4-pgsql-8.4.21-1.el10_2.x86_64.rpm f46da6b85a0671457230f5d6bc5e598542635760c330b34ea9d6aa822a9eaba7 ALSA-2026:22711 Copyright 2026 AlmaLinux OS 0 1 Moderate

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default xxd-9.1.083-9.el10_2.3.x86_64.rpm 04fb1a400acf29da0fff8ea38584b999ea80d0d7a62efdd7d9898958a9cc905f vim-X11-9.1.083-9.el10_2.3.x86_64.rpm 5e7bbafac49f75321c84a0b404cd61c8ddb15b9b32ecf6137b7c91e78758fe64 vim-enhanced-9.1.083-9.el10_2.3.x86_64.rpm 989a0e01a86edfacb098d37463d4d61d9f430b26066db5856bc306dc2931f1aa vim-common-9.1.083-9.el10_2.3.x86_64.rpm a3e3a39da4f3a440e44cdb482a81fa40f0a9efcb4d5cb005c20d068126f93051 ALSA-2026:22715 Copyright 2026 AlmaLinux OS 0 1 Important

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.1.x86_64.rpm e1111821c9444a5474b5de9855e2329ea517889410237bb53540f88a0fa8f930 ALSA-2026:22963 Copyright 2026 AlmaLinux OS 0 1 Critical

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012) * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170) * samba: Remote Code Execution in SAMR (CVE-2026-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default samba-gpupdate-4.23.5-109.el10_2.noarch.rpm 02ab33c4186fb468d4de6cffac56cd285836279fe4e2d03245fef1dcf26dd611 samba-winbind-krb5-locator-4.23.5-109.el10_2.x86_64.rpm 19d3b3bc02a6ff5ab83f018983609cb0f89e616bf5760b5d96696d38966d4df0 samba-winbind-clients-4.23.5-109.el10_2.x86_64.rpm 3cec8378e7fe3f5096cb191a321b813f1e18925e2f5294b90c4f9acf4fa9a6d3 samba-winexe-4.23.5-109.el10_2.x86_64.rpm 80d3a56709dadb80fb0813861704e70927e91a0f3e88b7cc82c4ec4825327ac3 samba-krb5-printing-4.23.5-109.el10_2.x86_64.rpm 8613872b29e5957a0756d531012359247ac1d759721a16013cfdbdf1fd98900d samba-client-4.23.5-109.el10_2.x86_64.rpm 86fbda1a745879eb13994af7de29c65b032882082cb6563d5254d47f68756e4b samba-vfs-iouring-4.23.5-109.el10_2.x86_64.rpm f04c596a994d1f2ed695eaa1cf74ad26da78388bc76b9c10f34e74b511e12a68 ALSA-2026:23102 Copyright 2026 AlmaLinux OS 0 1 Important

delve security update

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default delve-1.26.1-2.el10_2.x86_64.rpm dd7eddffc1dce8f7da2f915095526a42dbcc884ad14d75b142476bd1715c6687 ALSA-2026:23231 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959) * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default unbound-dracut-1.24.2-7.el10_2.1.x86_64.rpm 1f2b7a0ec44cbed0ba29f3ff4c829d3a740482b208d6aa15738105b3a26d68cb unbound-1.24.2-7.el10_2.1.x86_64.rpm 39607ee5f58c1002d2b5973b3440a501eaa5206af5a58285b4f92ec82d6900c4 unbound-utils-1.24.2-7.el10_2.1.x86_64.rpm 493df831a520b0dbfc33c88b3f651f24536edceb6c2e2433ee0076ba51bb4e8f unbound-anchor-1.24.2-7.el10_2.1.x86_64.rpm 4c8837f858f185a685107a2d23cf1f7866f3c890642875e5d018b996ff8a718f python3-unbound-1.24.2-7.el10_2.1.x86_64.rpm 7a128194e2c1a158e566d6a179fd766133d46fe09194c4333c70558ed3c43faa unbound-libs-1.24.2-7.el10_2.1.x86_64.rpm a4e30ebdb6e40b3d0538f0bfec0cec51df9b2c4dc67a8b2d2684620454c42116 ALSA-2026:23329 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rv-6.12.0-211.20.1.el10_2.x86_64.rpm 11196ac54094cf27105e151cc45148fa7fee6ca7dd45f9c77e7972fd5e75c386 kernel-debug-devel-matched-6.12.0-211.20.1.el10_2.x86_64.rpm 284ac60f4eb90a6205a5baf0f3dfb726889d84db56c0da1c7edd204c7d5d58c3 kernel-devel-6.12.0-211.20.1.el10_2.x86_64.rpm 4ffc0c9af6ac3b171a92d553a742cdcf5e9ee5e1003b923668f1fbf1d612b02a python3-perf-6.12.0-211.20.1.el10_2.x86_64.rpm 581c667d50c3185b4aeafee05d3af4d8ff71c079c22037b8ae2db7c48e9ba331 perf-6.12.0-211.20.1.el10_2.x86_64.rpm 6a497c550a25ec799174818358a000299a5d9f8386756b2ae55e1c7b969dc32b kernel-headers-6.12.0-211.20.1.el10_2.x86_64.rpm 6c8d7fe4f97921bd69aee5fff8d740c3a2ed5ef0eff4bf245ee2785f9d944aad kernel-devel-matched-6.12.0-211.20.1.el10_2.x86_64.rpm 79b84495712c81dedc46a5c4381fe8bb0f1784fc27bcdd6373a99f9132a0af95 kernel-debug-devel-6.12.0-211.20.1.el10_2.x86_64.rpm 8060b40c816f8cd98ed4cd141caebc5a3d0ddbcf8f7141c8fd2a9e4717ae899e rtla-6.12.0-211.20.1.el10_2.x86_64.rpm 860188de54609c6ccf35f007f84e7478ed0306461b2d41d6363a9f8ece38f0d1 kernel-doc-6.12.0-211.20.1.el10_2.noarch.rpm a836026e76d4d01a4cd956f4ff3470e96d192b18c9b27f6d4d5b5e46c6aa8694 ALSA-2026:23388 Copyright 2026 AlmaLinux OS 0 1 Important

php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default php-dbg-8.3.31-1.el10_2.x86_64.rpm 00d8d0e2460409294998879220617317f17e961869ee0dc4ec2b1bf2e2150639 php-intl-8.3.31-1.el10_2.x86_64.rpm 1157cc092195febb4c0e9ff2be2a54c46c7f81017594f5d6027638cec9df05f9 php-embedded-8.3.31-1.el10_2.x86_64.rpm 13b1ce13bf2a0b300eb225d56806c87d95b4000fbe3c307707d142f880e44335 php-odbc-8.3.31-1.el10_2.x86_64.rpm 17a9f365fc696479e1838baebf9d2d4f619e990d26a9ff66b9bb3473d6a2c0c5 php-opcache-8.3.31-1.el10_2.x86_64.rpm 1da0fda4d1c135bf730ddfd70fa04dcdcc9d784d097a695b4d3f82bb83bfcd1d php-gd-8.3.31-1.el10_2.x86_64.rpm 1f79196e05e753b81307ca2033da63b3c7dcaa9c60cff4b6c770e1645094cf22 php-pgsql-8.3.31-1.el10_2.x86_64.rpm 25374f8bddb3640985f314f77aa93648774d95eb26b892815c39404076afba67 php-mbstring-8.3.31-1.el10_2.x86_64.rpm 37191858048dafef3a55a9185b8243083bbe94f486c59b60b19f47ad31e635e9 php-process-8.3.31-1.el10_2.x86_64.rpm 4f2e170bb0a8734584b09fa6dca083870932a7595d030176795062510d50974e php-devel-8.3.31-1.el10_2.x86_64.rpm 6e819a7e2d7d8237d3c24104e2ed0f6924d2e5efb9dab0cef27f107a99d6885e php-pdo-8.3.31-1.el10_2.x86_64.rpm 7193c3264036813b40588a81e9f449dff3568bf0606ddbe7af2b89d1d86687bb php-gmp-8.3.31-1.el10_2.x86_64.rpm 72513eb4aa5727c254e42c47e71a784c31e84e8e8fefb8dd0a1b3aee4b93d8a9 php-snmp-8.3.31-1.el10_2.x86_64.rpm 75ad39f3c8848dde0e1c8868a98b1aa7afe6534dbca7e110ca9c10b4802b53ca php-bcmath-8.3.31-1.el10_2.x86_64.rpm 7862a5edd88540fe43cd248c55322fef0a42267ff253020023b68e20ce422fc9 php-cli-8.3.31-1.el10_2.x86_64.rpm a253aed9eb0cb05a0a5b0136fc3ff18f3cdb243e278da1713235bf7010aae873 php-fpm-8.3.31-1.el10_2.x86_64.rpm b1cc5efbb9f3faeba5e6a31e2f974c4ad442ba50b5001d86f2a9377711b2262a php-mysqlnd-8.3.31-1.el10_2.x86_64.rpm b2c99d90b702bc95134c894f862db3987707ecd4ec44d65e1e3affa849fc879e php-ldap-8.3.31-1.el10_2.x86_64.rpm b35a6286d4ac3cefe6b49f0ed18704136eb037c211ac272c07f80f669ad9cfe5 php-xml-8.3.31-1.el10_2.x86_64.rpm b6aa3af58f40a1a26e02538908fd5c5688f79b387950d1a32b5646fd321c2bc7 php-dba-8.3.31-1.el10_2.x86_64.rpm b929b2a71a7c988c6be07ace0db2f4025d0d870ee12739f1451c14c8fa7bdb17 php-ffi-8.3.31-1.el10_2.x86_64.rpm bf7676af7177f7af68a726c4883904fc7e132fe258bbe8540befa28f91b09216 php-8.3.31-1.el10_2.x86_64.rpm d8f6f707ee2aaeadefc19947a5ea8412356dc0d8752ad38e0eb0c22bab2545f3 php-enchant-8.3.31-1.el10_2.x86_64.rpm d99f388948f7b3de56acd9552d0e4d2352a00aa118b31e871a719ebbdf9b4c24 php-common-8.3.31-1.el10_2.x86_64.rpm f4e2a283149a68ecfea1e7875c8f780fef6aa17499eaa6882208f2b19b4484f5 php-soap-8.3.31-1.el10_2.x86_64.rpm f761e6c9c6cc0e281801885c4facee43e9478643eaa2a800a71053fdf0f5953f ALSA-2026:24338 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default bind-chroot-9.18.33-15.el10_2.2.x86_64.rpm 1d9e83dd40920ab55903cbe1ed4d4521de60cf0917572532eeb9412493a7d18b bind-license-9.18.33-15.el10_2.2.noarch.rpm 25696570fcae21d95d2b7b7d02efd735482defa1142c62286c36eabb4f6c2997 bind-utils-9.18.33-15.el10_2.2.x86_64.rpm 350cbb289ef6b1987092c1b7bb149ef237d34eac73bfeb70ad7dbdeac66f6144 bind-9.18.33-15.el10_2.2.x86_64.rpm 64c163c667c38dbb4861d9fe8e13ab95d5ec27bcb22a42fb5bb22b39c58a67b0 bind-dnssec-utils-9.18.33-15.el10_2.2.x86_64.rpm 797a7a4f7cb0f63683c6e1f16fb3f3205b39d4c4783830325e33c440931de3dd bind-libs-9.18.33-15.el10_2.2.x86_64.rpm e9ae8f5ab2911b09066f02bee4c1a1ed3efe41f826e71a9808621c3e23446308 ALSA-2026:24347 Copyright 2026 AlmaLinux OS 0 1 Important

frr security update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * frr: denial of service via crafted FlowSpec component (CVE-2026-37457) * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default frr-10.4.4-1.el10_2.x86_64.rpm 542f005238edd18c9a8ac8a2937b0f88923df4371a986540ae12d968ce75a492 frr-selinux-10.4.4-1.el10_2.noarch.rpm e52027fd1714316b10d57ad6d1986270e9103048cce6f181fddac53f9ff01c8c ALSA-2026:24348 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postgresql-jdbc-42.7.2-1.el10_2.2.noarch.rpm 12ad5a0377cc543161f693dbedf80444ce6430610d3c37c638d24895a91baf32 ALSA-2026:24470 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default podman-remote-5.8.2-3.el10_2.alma.1.x86_64.rpm c622af3ce60d56cf1ebff3e4da500e647d58a1a2584842e0efd9c9e67a3b41e0 podman-5.8.2-3.el10_2.alma.1.x86_64.rpm cfd2d33fb540aba5bbfb9cafbcec0cd2811ea009e9f0ee256fb1405e8ee0577d podman-docker-5.8.2-3.el10_2.alma.1.noarch.rpm e205f2f26c5534f264de80514cb994d72b05f6a8fdd0b52239e7998ed355f6cd ALSA-2026:24758 Copyright 2026 AlmaLinux OS 0 1 Important

libyang security update

Libyang is YANG data modeling language parser and toolkit written (and providing API) in C. Security Fix(es): * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libyang-2.1.148-4.el10_2.x86_64.rpm 1cb4b2a11bc5492c4b6a20cf18177b8318c34d519701421c0626fa5a3b60fc1c ALSA-2026:24985 Copyright 2026 AlmaLinux OS 0 1 Important

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default poppler-24.02.0-7.el10_2.2.x86_64.rpm 15556a51e99e9d6f47c1253f2e6bf706d7a3248cb4c13d01d78dba8290e4c7f2 poppler-qt6-24.02.0-7.el10_2.2.x86_64.rpm 5a2660a45002ca3193ba8012cec5d650361f2ab15f7a06452dd34dd640857a45 poppler-utils-24.02.0-7.el10_2.2.x86_64.rpm 98c4031be31b07878a8f81db54b9d5635b4764cab16b25ddf7f97b1b0eddad4f poppler-glib-24.02.0-7.el10_2.2.x86_64.rpm be822a419c258076ceea80e73996f7b8e3595cddf79c44dfde35a0044fccb3d9 poppler-cpp-24.02.0-7.el10_2.2.x86_64.rpm f7193c7670ec36294622d06a6080698812bb7cb8e97e10c0bda360a4f3a71dbc ALSA-2026:25111 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_2.x86_64.rpm 4309b02e2f8a785f984ac8b731fb0d6d4eb2ac9f6b34f720bb99d611d2d47d0b aspnetcore-targeting-pack-8.0-8.0.28-1.el10_2.x86_64.rpm 77154edce60b582ff7f4d56da3ef7edf93082ac3daa30a61b761a442c8c4b4f8 dotnet-runtime-8.0-8.0.28-1.el10_2.x86_64.rpm 8d08b82ac109f3b2b7b8bedd3016cbbee32ebb32e4dc0cbc232c4c5fdce209e5 dotnet-sdk-8.0-8.0.128-1.el10_2.x86_64.rpm 9c9ef598f5d0bcfcfc706925601efd9d56adbb51c5c2d5f3eb9ce24f9a83c877 dotnet-apphost-pack-8.0-8.0.28-1.el10_2.x86_64.rpm b67650bddd80e04021ada32ca901d6b187980859a9dd6a93bbe9cc79ccaee0d0 aspnetcore-runtime-8.0-8.0.28-1.el10_2.x86_64.rpm c6745f766e3c0eb04aa351b98974881c9ac09a01fc9a437276035f6dd4e06173 dotnet-sdk-dbg-8.0-8.0.128-1.el10_2.x86_64.rpm d731c77301c83a16f0560455198b81c59ca33bc9e1b6be7acb122a270e1f4ba6 dotnet-runtime-dbg-8.0-8.0.28-1.el10_2.x86_64.rpm e89df542f442277e099710a193c276b99d1e94d9db3826ccc7b6edd60386f2cb dotnet-targeting-pack-8.0-8.0.28-1.el10_2.x86_64.rpm f621da1d12661b6293d7629f382bbaa309a43094722188add2f45f7f42cd89cf dotnet-templates-8.0-8.0.128-1.el10_2.x86_64.rpm faeb5d4f916debee1486f8af9c5a772d8fc6ca7d940d313a16fec6655562ed01 dotnet-hostfxr-8.0-8.0.28-1.el10_2.x86_64.rpm ffa06fadaccc85080f3281d4d3fa16101712586f47515b6260f3893045df763b ALSA-2026:25112 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default aspnetcore-runtime-dbg-9.0-9.0.17-1.el10_2.x86_64.rpm 0334c81eb124d0db0eb427ce4873305c4143e94b5fa6f44afd52f054a42e642e dotnet-runtime-9.0-9.0.17-1.el10_2.x86_64.rpm 0f2d4b3a55ab1c5cb59aad8321404e599ad43cbb361e92455118d9b3551ffb45 dotnet-templates-9.0-9.0.118-1.el10_2.x86_64.rpm 2a366b30f70cf7d8905f04c0725620f7c51d9ce8612ecd3aa5f2f71d72eebbe0 dotnet-sdk-9.0-9.0.118-1.el10_2.x86_64.rpm 655c5944fd1d067311875edb81a6f9cf5e522b8a5dd37ee9ce0a305b295afe25 dotnet-targeting-pack-9.0-9.0.17-1.el10_2.x86_64.rpm 6e2470826e4289930336b63c15d05df3f4a4e2d28793a0c221a5a8118f100c33 aspnetcore-runtime-9.0-9.0.17-1.el10_2.x86_64.rpm 70eda91274f8f46af5b38ca0b18235d1d1083e24dd0ebd588fd33e41aeb2d94e dotnet-hostfxr-9.0-9.0.17-1.el10_2.x86_64.rpm 868c53022bcc8c383ed74b6dfa94b137289a1db5eb567af81e1f7bed9879a1a2 netstandard-targeting-pack-2.1-9.0.118-1.el10_2.x86_64.rpm 995edca15dd800a4e7c876c2597f0cd3fcd33b38723d064d782c9ec1342ffb3e aspnetcore-targeting-pack-9.0-9.0.17-1.el10_2.x86_64.rpm a8ed2fa14de30d27b6c584ef1998d839690bf7a7e0d070abdf54c43a261a73ad dotnet-sdk-aot-9.0-9.0.118-1.el10_2.x86_64.rpm aa118772e1312c02c6b8fbb50bd997b7845d1472d396969edbe6f677ce30ea1f dotnet-apphost-pack-9.0-9.0.17-1.el10_2.x86_64.rpm c8c62cc22e7b6af41c0bff5c4579c169d75085ef3693a41d19481f5bf4035e6b dotnet-sdk-dbg-9.0-9.0.118-1.el10_2.x86_64.rpm cb315fd4315b62b70903f7ef9d0c8028c8078edc058b836ef08e0cbb42278688 dotnet-runtime-dbg-9.0-9.0.17-1.el10_2.x86_64.rpm d5fff9e13840caef977f4292062f13fc9f1e4fee921140769554af9ee61f7328 ALSA-2026:25115 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-host-10.0.9-1.el10_2.x86_64.rpm 033de8a7c3c691f1d05a978a806888160790ef6235a2ab087eb14850cf1a3c88 aspnetcore-runtime-dbg-10.0-10.0.9-1.el10_2.x86_64.rpm 0e889592948d51882116ecb689d98764a8226b71b35e55f95beaefd68f5f45da dotnet-runtime-dbg-10.0-10.0.9-1.el10_2.x86_64.rpm 0eb607077e250fe29d3cf85e6e3d22150182f3d951350910dc231430fe018c3d aspnetcore-runtime-10.0-10.0.9-1.el10_2.x86_64.rpm 41f52876b05e07b7970d9d6ab72e2fa4fc00b73a43126d969e8c036f0c454031 dotnet-sdk-aot-10.0-10.0.109-1.el10_2.x86_64.rpm 4717318670060c2f8131b9500e8345ef3b51b6e85fbdb2784a604d17b8e86a4a dotnet-apphost-pack-10.0-10.0.9-1.el10_2.x86_64.rpm 47f499d27e81167892427547fb2e31b807eb13b2720287cc3a00e99a1efdd363 dotnet-sdk-10.0-10.0.109-1.el10_2.x86_64.rpm 4a47c6d3d25eb0e1cd63e11aef0eaf53198ff28c78085a26c7fedf095f430363 dotnet-hostfxr-10.0-10.0.9-1.el10_2.x86_64.rpm 926f0797b57e7b4f88dd7bdd64f5e96990c91e195e01ff33afcd04eb2571f424 dotnet-sdk-dbg-10.0-10.0.109-1.el10_2.x86_64.rpm bc6274a8bca16e28bf2e457220a8a61bbb62f51f442951366bb6c6436a24359c aspnetcore-targeting-pack-10.0-10.0.9-1.el10_2.x86_64.rpm d7122798a88dd58bc17f7071c97c3685f442834b0ee653d24ab30fee687a7431 dotnet-targeting-pack-10.0-10.0.9-1.el10_2.x86_64.rpm d99617e92030bd40bde22bd7f423366e66b15221d9421f7d024962ef08737b14 dotnet-templates-10.0-10.0.109-1.el10_2.x86_64.rpm f69c5a93dbff29b96b4ee2461352533e681c6d1ed75725c9de108887830d5831 dotnet-runtime-10.0-10.0.9-1.el10_2.x86_64.rpm fcc1bed016fbe0568602b7c156085b1d8430c73fb89c0ba64430b460fb7f15c0 ALSA-2026:25191 Copyright 2026 AlmaLinux OS 0 1 Critical

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rv-6.12.0-211.22.1.el10_2.x86_64.rpm 12e1a0d70146fe2636b1f16c5544d8242965816482f0ccac9113e4dd6fdb5d88 python3-perf-6.12.0-211.22.1.el10_2.x86_64.rpm 18d6caa56849033bab094f1d8b9f21d654e430dceb145d0e47705bff37b7eea6 kernel-devel-matched-6.12.0-211.22.1.el10_2.x86_64.rpm 1b72010cb0720cf99301c5ceba984712ed4ae4d92f7153e496a4eb18504272ec kernel-doc-6.12.0-211.22.1.el10_2.noarch.rpm 1cb3d93030aca010c6182c61bd262ffa6d526fb1b80f5cac5d3a4e0ddfd0923a perf-6.12.0-211.22.1.el10_2.x86_64.rpm 3faf2ea5a3f5ebb90ed8fcf157b2885f1c51f23168e986370d8a3885e78badef kernel-devel-6.12.0-211.22.1.el10_2.x86_64.rpm 6604776013d2e83ef4ab10404285c6374974f148f7d7a5225bc0597056bef986 kernel-debug-devel-6.12.0-211.22.1.el10_2.x86_64.rpm 726e8c3d784ab729551f4f2c0d7f85ae5f92cef5183b29a16f3f98a6eeb69123 rtla-6.12.0-211.22.1.el10_2.x86_64.rpm 8b0d6987c68dd130302d01003584b4772a680f2d1fd099d608ea5a4cb89cec2f kernel-debug-devel-matched-6.12.0-211.22.1.el10_2.x86_64.rpm ae97c73684d9f5ea18148c438cbf44c41f5be49f0fbb9dd34891e0ea53654436 kernel-headers-6.12.0-211.22.1.el10_2.x86_64.rpm c27765ad07f6bd366f0e9c1ce6a7b6bdc4775e7b2ade1dbc1bedf8179b5c0717 ALSA-2026:25216 Copyright 2026 AlmaLinux OS 0 1 Important

valkey security update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479) * redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631) * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default valkey-devel-8.0.9-1.el10_2.x86_64.rpm c777c492c3d86da0c8899867867923fdb18294b7fe98c2c7f09bd55b722b55e6 valkey-8.0.9-1.el10_2.x86_64.rpm ff30a603915c2a829644cd47e3fead01361754b9ac23118993530b13c48dad74 ALSA-2026:25225 Copyright 2026 AlmaLinux OS 0 1 Important

mod_http2 security update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.1.x86_64.rpm fc323779c4f868a79000bf89f45bd40e8a5cf6b653f11b1bc34eb5efb35fe702 ALSA-2026:25237 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383) * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076) * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180) * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181) * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182) * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183) * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764) * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766) * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767) * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768) * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769) * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770) * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445) * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446) * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssl-devel-3.5.5-4.el10_2.alma.1.x86_64.rpm 2fb8fb641d39efc22ce2216b79db1cfed658f1ffd8ce9a6cf287b0948b3b627a openssl-perl-3.5.5-4.el10_2.alma.1.x86_64.rpm 8c92b3df8b14139ef0165abc4ade9876ba377d5696861efac1cb08f400c9e912 ALSA-2026:25341 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat9 update

Certificate revocation bypass due to improper OCSP response validation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default tomcat9-9.0.117-1.el10_2.alma.1.noarch.rpm 05aa3bf0312387311b2ebee667eac72d7e7edec61d6304c2887bb89dce956ef9 tomcat9-lib-9.0.117-1.el10_2.alma.1.noarch.rpm 112016e28c5036aafd2dc2c8c1106032281ee655ecf0ed4660e6a407a2be6530 tomcat9-servlet-4.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm 20c189635df0064ff555758bfe0c95f21fb6875882b9d0af0d6a358047d9cf2b tomcat9-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm 4c2a31f2ac55f524c85ddedcf6348fb52bf25e3a8c51aa42bd636a679bc061ba tomcat9-docs-webapp-9.0.117-1.el10_2.alma.1.noarch.rpm 69e8e77be4f060182be8e233a029cdac2dc6d78e5dede107e51f129760e53834 tomcat9-jsp-2.3-api-9.0.117-1.el10_2.alma.1.noarch.rpm 8f03c1fb22b9b899ba5241ba26943941828f4092d11c3bf45acdfe457b177f1b tomcat9-admin-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm cc3072eda709f80d8c5d5b108fe2a57d3bcc068e817a6dad877191d45431c79c tomcat9-el-3.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm e88ff8acc2245391a6ac44a4bfd50bed1fb73d897208fbb93ff98452651fb8d6 ALSA-2026:25902 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default fence-agents-scsi-4.16.0-21.el10_2.2.noarch.rpm 09ff1477d7c24e095b83789574d84696975330f2d0de542d54792c26e7974c16 fence-agents-lpar-4.16.0-21.el10_2.2.noarch.rpm 12c9076e50ad52eac0fa9c9653ce73fa79643aee1f969bc507af2d7ff138569a fence-agents-azure-arm-4.16.0-21.el10_2.2.x86_64.rpm 18955830b15c3599319bde4dbd5b18d1df6284dc73123b7d0984a558bbcac7ba fence-agents-apc-snmp-4.16.0-21.el10_2.2.noarch.rpm 298e8d7a3cc1d82a186ff6a6892e4568c0979e88cd2baebaf8d23a9e24fea0a9 fence-agents-aliyun-4.16.0-21.el10_2.2.x86_64.rpm 3d61ec1dbeadbacf8f9025cd5e043edcc59c500514dc268010b2e475d7b3c718 fence-agents-eaton-snmp-4.16.0-21.el10_2.2.noarch.rpm 3e29269bd4baea6327c3f106e567ba79252914196c7d9d6de1691b9b887f5016 fence-agents-ifmib-4.16.0-21.el10_2.2.noarch.rpm 3eae36839b0c37587393fedd0a94d391c7c1b32d4e0038aeb872ce77dcbeac65 fence-agents-drac5-4.16.0-21.el10_2.2.noarch.rpm 3fd2c64de218b8f14a264b6d4c513527490c25f44ac7974c6ef31fb84798dd4c fence-agents-common-4.16.0-21.el10_2.2.x86_64.rpm 4c2df15c9a1fa2de7ddf2df5dcba466a21622a1e4b0b74ba60b862fdcc573acc fence-virtd-4.16.0-21.el10_2.2.x86_64.rpm 4cd8632b92f3b9693fcf0c8151b24d9bf6ec0bfcbff7a80d3dce71bf5f44284e fence-agents-eps-4.16.0-21.el10_2.2.noarch.rpm 50471bc1d7292ee0054f58620f7119f9f2224ef4260b8a953fba66633ec4adc0 fence-agents-rhevm-4.16.0-21.el10_2.2.noarch.rpm 526fcda8f27eca140ad19bc1b50f05fde1e332027a94e23cb2595e6544c91903 fence-agents-kdump-4.16.0-21.el10_2.2.x86_64.rpm 53f86370463bc8b36197160483a2fcd5738d09c199e2c9239d6c014d5bc36563 fence-virtd-tcp-4.16.0-21.el10_2.2.x86_64.rpm 5ba63b6cef978f83f63b89130bec578df897e8d95b9e4dc1b10d12bcf3071ec7 fence-agents-cisco-ucs-4.16.0-21.el10_2.2.noarch.rpm 5f0c4629ad31c1b9bd98c26300a2555a858e7da9be98323d3705bb2a17d23d33 fence-agents-apc-4.16.0-21.el10_2.2.noarch.rpm 600b0a86968f0aaae3296c8da0b70e18f2cc7836e9b007c314dafa38da84a8be fence-agents-gce-4.16.0-21.el10_2.2.x86_64.rpm 6133cafc6d5d1b02fd286f344b8df96bcf594f4dc61ce5fe1bc239c75d3c8d52 fence-agents-ibmblade-4.16.0-21.el10_2.2.noarch.rpm 614315d7378c63e0844826317ca53254844a3938c32f3665bf1df10dacb31d62 fence-agents-ilo-mp-4.16.0-21.el10_2.2.noarch.rpm 6731b497ac7785ff2dfa81e440a312e85ac8e725199bb261a3290e15f4a3d6d5 fence-agents-openstack-4.16.0-21.el10_2.2.x86_64.rpm 689a6b4aeb196d8a5176a630726f0e32892a2fb41949371f2c4f630658355ca6 fence-agents-ibm-powervs-4.16.0-21.el10_2.2.noarch.rpm 6ce383af0646539baeb184e2641a29ae6df028240286e91f57c016285057771a ha-cloud-support-4.16.0-21.el10_2.2.x86_64.rpm 707faccf8d69749d149985b8aa2a8a2154dbdccfa286a0338780d858f877dbf4 fence-virt-4.16.0-21.el10_2.2.x86_64.rpm 71ab954e20301040009d1430b3005a44a57d2643ca6a210b08570b27485f38f6 fence-agents-aws-4.16.0-21.el10_2.2.x86_64.rpm 7f27003773c845fd36312b517c9dd7a6c6e3fa1ca6bbc541076e79770032dfeb fence-agents-ipdu-4.16.0-21.el10_2.2.noarch.rpm 8368915fb9a5f0e382da7f974a5e4bad3c7a34142bd9ce52c57c100697a5e366 fence-virtd-multicast-4.16.0-21.el10_2.2.x86_64.rpm 8dae0f10a2ef69c1861c888f1347a16971651632b8413fd0d650d9e383e2e168 fence-agents-ilo-ssh-4.16.0-21.el10_2.2.noarch.rpm 90c5f69dbd53eaddbb46b7de1584000376afcb442f82782208b63a07ddfc9bdf fence-agents-nutanix-ahv-4.16.0-21.el10_2.2.noarch.rpm 970f4b76795e517102ff1e870b5e2a7be172ef477fd8821eb3e190b99f0af539 fence-agents-hpblade-4.16.0-21.el10_2.2.noarch.rpm a12bb2e9542b76485ce1221906f35e37ff7d6a8f2a241d21f6547347683b5a4a fence-agents-vmware-rest-4.16.0-21.el10_2.2.noarch.rpm a236afaca18d09d042be0d498c52c254bca90aa39d7048b9c3d72fbe2a966a76 fence-agents-intelmodular-4.16.0-21.el10_2.2.noarch.rpm a2bd565e1af480ce00436ca7608818bf704d05480762acfa13b190ec1005bfcf fence-virtd-cpg-4.16.0-21.el10_2.2.x86_64.rpm ab09859e6b851cbf3e0fc87d0afbf7a9e14c8b2bfb9e577ada8dac5011dc0887 fence-agents-ilo-moonshot-4.16.0-21.el10_2.2.noarch.rpm ab44451f3d94da168a7e3b360f7b9aedaa9e42107bdc97e68befbf4d4ee759d3 fence-agents-mpath-4.16.0-21.el10_2.2.noarch.rpm b2ccee8dd645e52151c781abd778eb861ab3d54b5f99a252ce703f56bd144800 fence-agents-redfish-4.16.0-21.el10_2.2.x86_64.rpm ba51c751bbdd7e681c8d2b683fe35e872545237df120b1592af6b7b6f22e9689 fence-agents-emerson-4.16.0-21.el10_2.2.noarch.rpm bab15153adfef696f0496913ac9161a048bd71b538b1691aa0bf3c8d8ada5590 fence-agents-brocade-4.16.0-21.el10_2.2.noarch.rpm bb0c8a0011dacba56e4874d5634add35a6f754e354513e4b6cd736bfa70e0cf8 fence-agents-heuristics-ping-4.16.0-21.el10_2.2.noarch.rpm bce9f617920cf266311a3e70eabdf9efc748e71a34550fc398f1d09a1f866c3c fence-virtd-serial-4.16.0-21.el10_2.2.x86_64.rpm bfda3c358342f82956bc86fa81b056f8fd31f773ab2c1bcb6c35bee047e79e86 fence-agents-amt-ws-4.16.0-21.el10_2.2.noarch.rpm c1311ad03e9d6aaecf221246f0a33f34e04186c91c4f94936a73ce91f0b8db62 fence-agents-sbd-4.16.0-21.el10_2.2.noarch.rpm cf3c3cd8d2407a4b215021e252553d437c3251f3f621c8600b1df2d2bf4c1be4 fence-agents-rsb-4.16.0-21.el10_2.2.noarch.rpm d1087cec15bbee8464f580cd85448b7b671ec9b6b50e7f414c01cebf25a27af6 fence-agents-wti-4.16.0-21.el10_2.2.noarch.rpm d4442641c3bdb9695e3303315183f9df36ea59d0979749e0fa73a2dc062a307c fence-agents-virsh-4.16.0-21.el10_2.2.noarch.rpm d4ea6c9d27d6b72c2ec4588d5b86ece102a2e5b5189970f0da144bdea249084d fence-agents-ilo2-4.16.0-21.el10_2.2.noarch.rpm db55586c824957f510c58c45bb2f1e13b97c5a8e23cec28841a2fde724ad0cd5 fence-virtd-libvirt-4.16.0-21.el10_2.2.x86_64.rpm dcf8f3949105d430f2c023a499e82a0bbd8dbd440fdf964958929f9a75ae3b84 fence-agents-ipmilan-4.16.0-21.el10_2.2.noarch.rpm e115cb7a9584a1268df698f1c2808d858f01ae1dcaa9502ab776538cc16b7458 fence-agents-rsa-4.16.0-21.el10_2.2.noarch.rpm e50d48d8913ec8dddde456634ae7d0fe1110e61c50c0b31dc281bfc30173a4bb fence-agents-vmware-soap-4.16.0-21.el10_2.2.noarch.rpm e5953455691ce0520db86e36d4a0520df1aa88bd8345553743a6c5d9eab94360 fence-agents-all-4.16.0-21.el10_2.2.x86_64.rpm f15dc829805f4a0e210dcb7aaad30a7c3796fdba936b385e2652e6eda8f2a2c4 fence-agents-bladecenter-4.16.0-21.el10_2.2.noarch.rpm f2c5425b489f9273f19850815a2fd2af26422f93e9111fa72c09114aa8974593 fence-agents-cisco-mds-4.16.0-21.el10_2.2.noarch.rpm f65d2ca2ae09bc957279acfab3819afa89a6b4fad45c221655d3f53ba90126d5 fence-agents-ibm-vpc-4.16.0-21.el10_2.2.noarch.rpm f86bf5b2eee3fe4a01366a531f4012957b6b7a9030f7c02c9ebae1fda6d2874f fence-agents-kubevirt-4.16.0-21.el10_2.2.x86_64.rpm ff3ccc98e0579e4839eea9cea8f17da0516f0b757b98b112ed1c2e083d9db2e2 ALSA-2026:25930 Copyright 2026 AlmaLinux OS 0 1 Important

postfix security update

The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS. Security Fix(es): * postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postfix-sqlite-3.8.5-10.el10_2.x86_64.rpm 041a20a728beef07639de4268658aab11e7bf85475d31d954f8cd27a8a5fd27d postfix-3.8.5-10.el10_2.x86_64.rpm 0d6f29a2fe9de63054b9e3bf36590b125e269e3968dbbc5c208677ea119eb6fe postfix-ldap-3.8.5-10.el10_2.x86_64.rpm 3153f41bec2d6e5262f5ed152979e72630b997c0c253f8f64daca882c125f2cc postfix-lmdb-3.8.5-10.el10_2.x86_64.rpm 32782f3e5957702c0e2ee79cfaadeca211bc58287673a8784ecf549445a7102b postfix-pgsql-3.8.5-10.el10_2.x86_64.rpm 552690a548333972e4f6aafafdec979693edb59bc856e8a40f8a60ea57920465 postfix-cdb-3.8.5-10.el10_2.x86_64.rpm 8bd9e9cbe3481c0d4475d1810d4219e968161105fe98b10467e50d6b8a8f32bb postfix-perl-scripts-3.8.5-10.el10_2.x86_64.rpm b099d518e10f58f0a885fa239b31ba5089d35a2e0bacf194fbb4740541fd5f6e postfix-pcre-3.8.5-10.el10_2.x86_64.rpm ec821850da34f36a0a05ce9db500c82461e73edfaa7d18db2fdd2fe505379ea2 postfix-mysql-3.8.5-10.el10_2.x86_64.rpm fc41c237b75d0c20b46afb59111baa91a766cee620495e213c287546594dcec8 ALSA-2026:25999 Copyright 2026 AlmaLinux OS 0 1 Moderate

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-7.el10_2.x86_64.rpm 80a4b5357c0eeb2aeed702830f9c54e9a21ef32dfd100451b7f183dfefaec1fb ALSA-2026:26332 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618) * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518) Bug Fix(es) and Enhancement(s): * Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rsync-rrsync-3.4.4-1.el10_2.noarch.rpm 540a428308cad863c69c33ed960b0bc940301aa9b2b59258a14f1fc3273c97b0 rsync-daemon-3.4.4-1.el10_2.noarch.rpm c41feb2a21f43ce9aa84fc833bcabb0d96f6b707a7ee6ccbb51ade3b02c7e18a ALSA-2026:26532 Copyright 2026 AlmaLinux OS 0 1 Important

dracut security update

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dracut-caps-107-7.el10_2.x86_64.rpm 1d10b3e51acbf4df47f3d5029cee158a78510b294d4e11af0caa1d94cbad9794 dracut-live-107-7.el10_2.x86_64.rpm 6559bb246e13e961da190dd236731d72c86b44c8c8f00998eaacab574cfe3760 ALSA-2026:26566 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security, bug fix, and enhancement update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xwayland] Backport other security fixes without a CVE assigned [almalinux-10.2.z] (JIRA:AlmaLinux-184290) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.2.x86_64.rpm 243f0e35891de85023bf7fa6b5614c5e0a75a3158a71d18da279dbaa9ab59b85 ALSA-2026:27288 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) Bug Fix(es) and Enhancement(s): * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047) * AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774) * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495) * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723) * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127) * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319) * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-doc-6.12.0-211.26.1.el10_2.noarch.rpm 11db01dd6e6ddd890f4d22adb09a488c7d4dc0295f2128ecd209e94fadbced54 kernel-debug-devel-matched-6.12.0-211.26.1.el10_2.x86_64.rpm 124af44469037e7dac33671b2f87ff2785f2dc1781a7762db21be29919d19595 kernel-devel-matched-6.12.0-211.26.1.el10_2.x86_64.rpm 409f3e82ae05498032746f334a4448bcecbaa476867d7acb435f9152236d7a16 kernel-headers-6.12.0-211.26.1.el10_2.x86_64.rpm 49d454aa227a8f29b5b0fc8ce1a7f6ecb3ad18d1caa5018ac7871d1744bb1852 perf-6.12.0-211.26.1.el10_2.x86_64.rpm 5ce086fe5f7ec82548fd106fea22a7cca3fc9d2848cbb58ce2252750f48445f7 kernel-devel-6.12.0-211.26.1.el10_2.x86_64.rpm 6d68e8c03fcb8f632883a2ca0414cb769abd6f6808f6552a635e21b90c0a0198 rv-6.12.0-211.26.1.el10_2.x86_64.rpm 9edc691917b55b3a17a8ccd674278c42696d21b21fdef4bc53cc6affe382d3c6 rtla-6.12.0-211.26.1.el10_2.x86_64.rpm 9f01b1cd97641b3b8472a8e96c75a9a91cd941da54aaf35d1daac3fe6647d9d8 kernel-debug-devel-6.12.0-211.26.1.el10_2.x86_64.rpm f5cd29a3964b3e3f232613452fd5fde70c41aa820cff71b09ba9fae64c5398fe python3-perf-6.12.0-211.26.1.el10_2.x86_64.rpm fd93769386ef96b6fd70aac0d4100a9e80c424643308ae004291223f95f1eb09 ALSA-2026:27733 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default firefox-140.12.0-1.el10_2.x86_64.rpm 616ea39c644ad66dddfb24ab361620b596eb8897925921fc818a1d7e19169638 ALSA-2026:27742 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postgresql18-test-18.4-1.el10_2.x86_64.rpm 046154fa5f03bac2e8c67b1a57663a0e696e9e9dac1d0b0d36fd7ec680c50b98 postgresql18-static-18.4-1.el10_2.x86_64.rpm 0e1cda8fc76d55c14cdcf594bcf7ca388997e54420d14290d66d551e2a3cdde8 postgresql18-18.4-1.el10_2.x86_64.rpm 239367ca18abf1828c9d1e27320775190248bf1c73064d956445b31b2d52d5d6 postgresql18-contrib-18.4-1.el10_2.x86_64.rpm 30dad36c6904a295de1f40c71b0b6fb609f72eaddec75501758267b6561bff30 postgresql18-docs-18.4-1.el10_2.x86_64.rpm 32675cb977803ea8e5495e9fadaad1ce139cf8479564b937c2ebcb83744cb1ed postgresql18-private-libs-18.4-1.el10_2.x86_64.rpm 3ae73f3aed9a20371790c17750d40363a07053ffe235834d171a8448b8e5b341 postgresql18-upgrade-devel-18.4-1.el10_2.x86_64.rpm 3b72bd01863ce23437b08df6f7890b891336117fea560ef858447e8ab3ac75e3 postgresql18-upgrade-18.4-1.el10_2.x86_64.rpm 594dd85b3689cef1e2e8ef6f921c11c7b4e127af6b85bc8fa1c61063a110b466 postgresql18-plpython3-18.4-1.el10_2.x86_64.rpm 64e4dd48ed451d19549db11addee939bd91d85023e542b6b8899476571ac9563 postgresql18-server-devel-18.4-1.el10_2.x86_64.rpm 6c6815e135d8e8f46f82db68a2bc7391a7aa69989d2e0e5d3718c4f64b1ff91f postgresql18-private-devel-18.4-1.el10_2.x86_64.rpm 836a0ffc0fca9388baf853288477237c40d76324eccbf7800b9a2a8fd35eb05c postgresql18-server-18.4-1.el10_2.x86_64.rpm 8c5b05e9c320aa14ff2abb3da0999114c70a5e33d33ada63cbdd3992d49ee12a postgresql18-plperl-18.4-1.el10_2.x86_64.rpm d2e5b28c9090838e0998833d7ab8ca152a218c63af26da5e0908ec0abf0d0735 ALSA-2026:27743 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postgresql-plpython3-16.14-1.el10_2.x86_64.rpm 0b0ed22e56bb8e6f00d61fa86663e0162e641139562446fd287d7e7ef444ff69 postgresql-server-16.14-1.el10_2.x86_64.rpm 1300176981cf384c0c49c781068b2ecd55cff83142f0d4f36e4fe6961866f0c4 postgresql-plperl-16.14-1.el10_2.x86_64.rpm 30651d02d128b86d6e760fbb4a49d68c13f5fdba09a1ee10cd01555eab9c97dc postgresql-private-devel-16.14-1.el10_2.x86_64.rpm 356f5eb813425b8d746d9bc24e2634234054a1490fe1d477f63b29473e1fc84d postgresql-pltcl-16.14-1.el10_2.x86_64.rpm 460c4ccaa320071a71594e5b70d864b166bda85c7c90b94bba5e19980a169b0d postgresql-server-devel-16.14-1.el10_2.x86_64.rpm 573d8c0d3dbd329756a62e138992286b4dfdf605f237826d1d3867ccf0fd6f98 postgresql-docs-16.14-1.el10_2.x86_64.rpm 7b13ada87af15ff7e736cbc229665fa6a7e6edaa7e0d92321ef5e19a8054b18b postgresql-static-16.14-1.el10_2.x86_64.rpm 843d7c52a751580507d0fbd4a236de0260e39d17662612c0dd2b6a71e21c96d7 postgresql-contrib-16.14-1.el10_2.x86_64.rpm a79136a40d8981618aa1305c49b6290fa2bd31d5c7088a8395afea81ee806c49 postgresql-upgrade-16.14-1.el10_2.x86_64.rpm d004827ff0deeb7d73bc0919c782769e19b7750a74e4174cceeea80e3f335eaf postgresql-test-16.14-1.el10_2.x86_64.rpm d95802ede05a0bd8d4ed3224c0be98950ce635c47bb7dd627e9df5b1748b22ca postgresql-private-libs-16.14-1.el10_2.x86_64.rpm e290601310c0eaa1a63727ed5964a9239f3bc68aaf26d915c401a963efd6922a postgresql-upgrade-devel-16.14-1.el10_2.x86_64.rpm e74894c768ec55fe9740a35ab41f524a59603f38f3aa9ec49c5b703766d7f3bc postgresql-16.14-1.el10_2.x86_64.rpm f5abd9bdefe4f522252e833c87bd4ad1fbee838ae2f49137abec2e127b407d89 ALSA-2026:27842 Copyright 2026 AlmaLinux OS 0 1 Important

memcached security update

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load. Security Fix(es): * memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default memcached-selinux-1.6.23-7.el10_2.1.x86_64.rpm befa2e7bd552bd1824e4901a48f62800f2deecc18d5317289fabfe565c2b5524 memcached-1.6.23-7.el10_2.1.x86_64.rpm cecad5d087e653862c61d67b423179d0bdf90eea283ac8f9d18f3411aa0a8ed6 ALSA-2026:27929 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432) * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3.14-urllib3-2.6.3-2.el10_2.noarch.rpm 57130c6cb8bb3cf561d8de37fc42674c447fb5b7868aa36aa521c9f85eb9cdd9 ALSA-2026:28233 Copyright 2026 AlmaLinux OS 0 1 Moderate

libpng security update

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libpng-devel-1.6.40-11.el10_2.1.x86_64.rpm 434294213ecf205e76349ce6242489a7ec3d386d0fcdf51640d8406f528b800c ALSA-2026:28234 Copyright 2026 AlmaLinux OS 0 1 Low

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c (CVE-2024-34459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.1.x86_64.rpm 8c2607c317c7c1783937af65de815b7f8c7cf847dbad0047871acef173116f24 ALSA-2026:28235 Copyright 2026 AlmaLinux OS 0 1 Low

libtasn1 security update

A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions. Security Fix(es): * libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string (CVE-2025-13151) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libtasn1-tools-4.20.0-5.el10_2.x86_64.rpm 8353172c5e93971d349e9aa382de5755651b599ef6aa025b93ac687affc85902 libtasn1-devel-4.20.0-5.el10_2.x86_64.rpm 9d1b14d1f4d7b7029fca0e8b6905e613a284a7454d308e6375528269e5c77a1f ALSA-2026:28236 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsolv security update

The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150) * libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (CVE-2026-9149) * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-solv-0.7.33-5.el10_2.alma.1.x86_64.rpm 77d0fd1dcd059b3d655a2e8d67e38819f45992dface9fb4fcc7ed388e8937945 ALSA-2026:28581 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019) Bug Fix(es) and Enhancement(s): * [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3.14-libs-3.14.5-1.el10_2.x86_64.rpm 0f7b85c19ad697dd35868beb3da1ee70c64f91f911437b462e802709007bf1e2 python3.14-devel-3.14.5-1.el10_2.x86_64.rpm 31703f83cfb0a3777b8da3dcd99b130045f9f3d8cfcdae64ec7bc06f82821daf python3.14-3.14.5-1.el10_2.x86_64.rpm da4074617554c220f9f9e0fb6bab3eb7503ad64c7cb375d9f1c4413bc1cf4e29 python3.14-tkinter-3.14.5-1.el10_2.x86_64.rpm e7d8c7b79d43d79ba9d89c3abdcb4173235ea534d0804a8761a890f526c2717a ALSA-2026:28582 Copyright 2026 AlmaLinux OS 0 1 Moderate

keylime security update

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default keylime-tenant-7.14.1-5.el10_2.1.x86_64.rpm 19ecddd0e4cfc82a01ce2d9611b80f02abab6b2ec2503e31afc93f6c4453de26 keylime-verifier-7.14.1-5.el10_2.1.x86_64.rpm 457c5dccaa9b2917830fa6f8a2f78b470a0cafd14423904ce0e663ec98163961 python3-keylime-7.14.1-5.el10_2.1.x86_64.rpm 5a3bd30daef1cc46aac71624f38223e4fa217bb6fd785e5eeb225ecc39d87872 keylime-7.14.1-5.el10_2.1.x86_64.rpm 67117ccebcc98ffb744c93648f7b1686602c1643b92a73735963dbac34e4b4ff keylime-tools-7.14.1-5.el10_2.1.x86_64.rpm 7f46ddb3ee8d5baadda8ce83650c36dfb5f099223e4850e70ba60f8d4530854b keylime-base-7.14.1-5.el10_2.1.x86_64.rpm 85157a9c2c566261f84f886deca9e323e109be51d2013b46173fb22eca70f089 keylime-registrar-7.14.1-5.el10_2.1.x86_64.rpm 9429e5617a7d3e267165732130954e5799979e29c38269accdb8ac08579cc104 keylime-selinux-7.14.1-5.el10_2.1.noarch.rpm d087cd9f6da8c7f7422c92a84a47ffcc48661ffb612541d27410ec43622a490a ALSA-2026:28584 Copyright 2026 AlmaLinux OS 0 1 Moderate

libxslt security update

libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. Security Fix(es): * libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libxslt-1.1.39-8.el10_2.1.x86_64.rpm 36d25afc6cd084437df16e1a0835c1fa8dfc52408b01cd02a9065cfba4d91d23 libxslt-devel-1.1.39-8.el10_2.1.x86_64.rpm 91a0371e044a70c3f68840461001cd7d426b3f4b0e49716c1759067b5b97a7e9 ALSA-2026:29035 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default skopeo-tests-1.22.2-2.el10_2.x86_64.rpm 1a6166875dcd9bb43ba8f3547f8920196945381b40a33a42531e9049939cb7a8 skopeo-1.22.2-2.el10_2.x86_64.rpm cae483741e677ab81c3554f77098fa59f9020c081fc114298cda1eae3fdc6a6f ALSA-2026:29195 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default buildah-1.43.1-2.el10_2.x86_64.rpm 5fceeaf34895f5e6984a214afa0645cb9a2ebfc6b1a642be093d14f4a9d2c010 buildah-tests-1.43.1-2.el10_2.x86_64.rpm dfae76f30e4646809565f49b4dcbedf6d616c7f584284202fcb7b6c5561ff8fa ALSA-2026:29874 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nginx-mod-http-xslt-filter-1.26.3-6.el10_2.4.x86_64.rpm 03c0c2f844aebebf81f771559b845523b839693b8fda7974737511a0818c4225 nginx-mod-http-image-filter-1.26.3-6.el10_2.4.x86_64.rpm 0e8bb4a102b45c8b4f75062b96dda0b269880d8e484961b84fdcd335c524fb60 nginx-1.26.3-6.el10_2.4.x86_64.rpm 2f1bb134b553a2438429d4c07bdb2ebc65b29e78b2fe4241f01e5c3407c59968 nginx-mod-stream-1.26.3-6.el10_2.4.x86_64.rpm 391e8f81b8392cd45bca0c13c13ba177daa9fc85e2e227d283c1ba66d56a7862 nginx-core-1.26.3-6.el10_2.4.x86_64.rpm 409b08a5a51355524568adaf67e5fbe556b5405dbf6ad4b5d7765218d2cdba4c nginx-mod-http-perl-1.26.3-6.el10_2.4.x86_64.rpm 4b06251af35b4d1fa328ad6b8f8d433c9e516b0e35bd47c67c9b5bdb98a26055 nginx-all-modules-1.26.3-6.el10_2.4.noarch.rpm 562b83c5c4657fa12e3561c30f43284f0fbc49e4d410c9f9b7f57f8dffef487c nginx-mod-mail-1.26.3-6.el10_2.4.x86_64.rpm 7525fc21cc4cd321c353253a07de34f8daf90b46ee21c7f0306246efcd92f545 nginx-filesystem-1.26.3-6.el10_2.4.noarch.rpm 9f23da9e2b3a022ca250a77c0fe4ad02e555ea9d6fc291bd81545b117d01a511 ALSA-2026:29980 Copyright 2026 AlmaLinux OS 0 1 Moderate

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.4+1 [almalinux-10.2.z] (JIRA:AlmaLinux-183347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default golang-tests-1.26.4-1.el10_2.alma.1.noarch.rpm 3726ef009f97fa8d5d3a2547243c897a2ad61b3d3bf8c47c5d2bf97663366857 golang-docs-1.26.4-1.el10_2.alma.1.noarch.rpm 833fa429b2a24d184ef4308625d865d9e06a1d3211c741a966b78c83ea469dd4 go-toolset-1.26.4-1.el10_2.alma.1.x86_64.rpm 8e4913d8d459258a0df40f106330d361917896a8216790fb37014edd915afdb3 golang-misc-1.26.4-1.el10_2.alma.1.noarch.rpm 902dcd6c5009e267bf17ad6a17c944bab1e8d0806d3951286a1e40c6bed7d271 golang-src-1.26.4-1.el10_2.alma.1.noarch.rpm cfe20b9d0486e89e04d2f4b28058235230bff4d282b1571fc4c5279579e60d21 golang-bin-1.26.4-1.el10_2.alma.1.x86_64.rpm dce2e2ed3a0c2c2b4d282512c5a3c38b7fadaa491d876d8a15a52b457789f63b golang-1.26.4-1.el10_2.alma.1.x86_64.rpm e99269d7e094d8e90fea9b435d481c11b7e9cdeca96a14238b09f4d2d9ecc93f golang-race-1.26.4-1.el10_2.alma.1.x86_64.rpm fda8d0563171a1e70532aa893cf8739c1eda713f98cc206c0b34c2fdde68ccae ALSA-2026:30129 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.28.1.el10_2.x86_64.rpm 1bb9f50974a921e8ff690bd3a39211f67602caea6b9a0a4ff74b6797add1d378 python3-perf-6.12.0-211.28.1.el10_2.x86_64.rpm 23a730bfbac38940d6fc8541aad87ef0cccee08496d9c3e83d643be105257d6d rv-6.12.0-211.28.1.el10_2.x86_64.rpm 4527c60bd98cae6c43852475cb2924eb40bf3c3b631c107d11d030209aae048e kernel-headers-6.12.0-211.28.1.el10_2.x86_64.rpm 660c4512b924a7b3b6993f72754f445d1a484cab419d7dea96f5cec415f064c5 kernel-doc-6.12.0-211.28.1.el10_2.noarch.rpm 7017f858229dac25fead46f7a86ea9f48bda9ff21527d8dafd2ca37464130d2e perf-6.12.0-211.28.1.el10_2.x86_64.rpm 76b64fd8347db0e7ed9db3992a78cfc48ddf0f569a6dd1d36f5afc541c597eff kernel-debug-devel-matched-6.12.0-211.28.1.el10_2.x86_64.rpm 93b406a27c163e0553fdb989801b9f863822ec1e4ab3e7f60c9aa3d00a6f812d kernel-debug-devel-6.12.0-211.28.1.el10_2.x86_64.rpm b7844fec725bdc0d32f49fe270307a93bdaa5ef41cd193fdf6beba5023a2e444 rtla-6.12.0-211.28.1.el10_2.x86_64.rpm bf9663fc3d62494376a777d16586b21d95e4fef911aa612fed2792f68c7ce1cd kernel-devel-6.12.0-211.28.1.el10_2.x86_64.rpm fd98c5660a7015b7a476f1fbb758f3afe53b709f2b53d24d947f1bde89076860 ALSA-2026:30845 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_md security update

This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal. Security Fix(es): * httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mod_md-2.4.26-5.el10_2.1.x86_64.rpm 29074722bbc1b44e9c8594c7ca02915268261beb2bfb589cd3708bdb2db727ff ALSA-2026:30846 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default thunderbird-140.12.0-1.el10_2.alma.1.x86_64.rpm 9759f6d8a3dbd70b8f23e4f940fe41813b268548eacc3a8bad178a5db52d017c ALSA-2026:30855 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.5.x86_64.rpm 0da999a3214ac0af02c48dba31d77fec883da58f5b30d9f8bb7a2ef58db2d0ec ALSA-2026:30857 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files. Security Fix(es): * perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-Archive-Tar-3.02-512.el10_2.1.noarch.rpm e6efbbe6db7984a333245143097f48825a68f0f7cc2d488c57fd1eec9db1d08b ALSA-2026:30860 Copyright 2026 AlmaLinux OS 0 1 Important

perl-IO-Compress security update

This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. IO-Compress supports reading and writing of bzip2, RFC 1950, RFC 1951, RFC 1952 (i.e. gzip) and zip files/buffers. The following modules used to be distributed separately, but are now included with the IO-Compress distribution: * Compress-Zlib * IO-Compress-Zlib * IO-Compress-Bzip2 * IO-Compress-Base Security Fix(es): * perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-IO-Compress-2.212-512.el10_2.1.noarch.rpm 741508f5ad1fac081838f6f573ee7ee5aed1ab60be165fde7eab4c556b6b2f28 ALSA-2026:33092 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) Bug Fix(es) and Enhancement(s): * Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on AlmaLinux 10 [almalinux-10] (JIRA:AlmaLinux-174869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glibc-doc-2.39-126.el10_2.alma.1.noarch.rpm 07f1c0fec3d86d729f94febb97a600a9829176f2de6b4eac4354dc95cf165db1 glibc-devel-2.39-126.el10_2.alma.1.x86_64.rpm 52b54ca47203ff25ee65d8c83d797b07e27dc0c6041f9f50f21935633f25d1b9 glibc-utils-2.39-126.el10_2.alma.1.x86_64.rpm 642382c33328d33f7b3d87f6d79446b7ce1fa381e573a450c9bf8b1cf8c3cc31 glibc-locale-source-2.39-126.el10_2.alma.1.x86_64.rpm b39efffab55c8c21e511856e34dc14fd816963152839d70a40f04062d858499a ALSA-2026:33093 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb10.11 security, bug fix, and enhancement update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux10 (JIRA:AlmaLinux-183086) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mariadb-10.11.18-1.el10_2.alma.1.x86_64.rpm 08a8d3a042a3b0dc69f71e776d2636f1f0467719482cda76c916fffa717aa3f6 mariadb-server-10.11.18-1.el10_2.alma.1.x86_64.rpm 234e106746f41dee151997d5d54c1d39ab3c08f4403bc7666c15099f9b49db75 mariadb-pam-10.11.18-1.el10_2.alma.1.x86_64.rpm 5b7ba280e73df50445da7db9ee5b1556d14e1aee60c515044583129c016b379a mariadb-oqgraph-engine-10.11.18-1.el10_2.alma.1.x86_64.rpm 63fc53fac91d4013b0658a6d196f7d578d80661e14a5e3348bdaa8a2946ae6b1 mariadb-common-10.11.18-1.el10_2.alma.1.noarch.rpm 681f8ea6830f9775d238ef434fe0cb1d7ae292f04e23bb51b564dd3396b48a53 mariadb-embedded-10.11.18-1.el10_2.alma.1.x86_64.rpm 6d1b97f960af96162a24f64ef82585d6c2a57c4f130484182f949082bc32286c mariadb-devel-10.11.18-1.el10_2.alma.1.x86_64.rpm 70ef2c895d0b7e1b25716fa03691d07dd48184d5ee38a16069dc312a2d6dd240 mariadb-errmsg-10.11.18-1.el10_2.alma.1.noarch.rpm 714e7719347d3e47e8ad2c0770a97c3dca85f00f5f67c30868bbc81cbeae8dea mariadb-server-galera-10.11.18-1.el10_2.alma.1.x86_64.rpm 810e8e5d8dd4adfd8570ce15e7e99cbd46925df26224c5980269b2612cc7ec7f mariadb-server-utils-10.11.18-1.el10_2.alma.1.x86_64.rpm a1eda874594b15e328f098aa94504c16ad7e672e1dfd07c779f3246e4335c38c mariadb-client-utils-10.11.18-1.el10_2.alma.1.x86_64.rpm a5b98d8cc182d81b55548bb3811770ae275e038265085afb09d16075539eac88 mariadb-embedded-devel-10.11.18-1.el10_2.alma.1.x86_64.rpm cd3337ea8ce4bc7a65c1dbce97e0b655023fe4eea18013578ffabd769c822424 mariadb-test-10.11.18-1.el10_2.alma.1.x86_64.rpm df949e90ca04645bc77f1d507f2b6a9bba6ee440f5583924df0301bb21d33470 mariadb-gssapi-server-10.11.18-1.el10_2.alma.1.x86_64.rpm fc8084756a3df97df345100e6e9c579bdaf273e03f5560f73914b6faf7133ba0 mariadb-backup-10.11.18-1.el10_2.alma.1.x86_64.rpm fd5d062b370364bb5fe025f92ad03d79ab67fc85a87844dd28e63a93e25a56ad ALSA-2026:33412 Copyright 2026 AlmaLinux OS 0 1 Important

galera and mariadb11.8 security, bug fix, and enhancement update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 11.8 to 11.8.8 in AlmaLinux10 (JIRA:AlmaLinux-183084) * Rebase Galera to 26.4.27 in AlmaLinux10 (JIRA:AlmaLinux-183259) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mariadb11.8-embedded-devel-11.8.8-1.el10_2.x86_64.rpm 01c176f0633c93631b8409da2e15b230028c9f9bc2592a217b8930cd77397ece mariadb11.8-11.8.8-1.el10_2.x86_64.rpm 1416feb606f0a912ae44b56794642988e0b4856e035889d767992dc95a2dfc39 mariadb11.8-test-11.8.8-1.el10_2.x86_64.rpm 16f7bf5b3065aba4fd3242a5df0b0a066c9427de39b9782ac463e196ffdc3080 mariadb11.8-client-utils-11.8.8-1.el10_2.noarch.rpm 1b8213a94b5a803fee91159889715d18dce58d1206715acfe2ca987d9c88560c mariadb11.8-devel-11.8.8-1.el10_2.x86_64.rpm 4e3f8f2050335909eb0cfb391976ab3b7fd526edc03010a99ac3a78da609ffdc mariadb11.8-server-galera-11.8.8-1.el10_2.x86_64.rpm 53eb7c6f489463b099046036c2032389d9f6ed914e1ab7eab76131e6c548f200 mariadb11.8-backup-11.8.8-1.el10_2.x86_64.rpm 82d3ad174a45b85c532a9e0b6c7cc624bd88c88f18ad1f3dfede3ecb0fb89eb2 mariadb11.8-embedded-11.8.8-1.el10_2.x86_64.rpm 9073e77de54c35c027f6d6d00148c16c8dc120d18eaf8b5f78c25002f6b9aff3 mariadb11.8-server-utils-11.8.8-1.el10_2.noarch.rpm 9b959318939709d585735442a771104817080a3fa715a214b85e0185a5e94ac0 mariadb11.8-server-11.8.8-1.el10_2.x86_64.rpm bc14aca5fe08a9d313bc94e385591719b2dcefe46cf05241d9d627781c5164ea mariadb11.8-common-11.8.8-1.el10_2.noarch.rpm bf247857f833df313151be70c72cf6cc08b2708a50410ff68503d30347ea33e0 galera-26.4.27-1.el10_2.x86_64.rpm c4f0fe67de076646c9a5c0c97cd2645af75f8c447e4eaebdbbe4b57cf9886efe mariadb11.8-oqgraph-engine-11.8.8-1.el10_2.x86_64.rpm cb62cae5915885b15968302f72fc803580383f0ef5b953a8fe28c38907321cbe mariadb11.8-errmsg-11.8.8-1.el10_2.noarch.rpm cedb5ef493d966e6486d252d6067e6b53503d8ae6ebdb7dd3e8f68edfd7f05aa mariadb11.8-pam-11.8.8-1.el10_2.x86_64.rpm d489354bbc749d132a97034930f5afe63107963120207261bea98c14e9d22552 mariadb11.8-gssapi-server-11.8.8-1.el10_2.x86_64.rpm f3d1769e30cda20e51f77fb2dd6022e35ffe2e7736fefc3424b12003b4ed5d4b ALSA-2026:33502 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default giflib-5.2.1-25.el10_2.x86_64.rpm cac160815ecebca3fc3d5d205cf334de51270b6b6b4acfde59a3d413a860f0b9 ALSA-2026:33540 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ruby4.0-rubygem-pg-1.6.3-35.el10_2.x86_64.rpm 2c35976b7beba21288362fdf1f1198596feda8989ed3bdca19bc7c0c7fbcf023 ruby4.0-rubygem-mysql2-0.5.7-35.el10_2.x86_64.rpm 2ec205cb69349ec956c38fda4cf71f148cd9ad0eb3041a55b32bee47f46d57ce ruby4.0-4.0.3-35.el10_2.x86_64.rpm b99cf267db54db3c95cb5687a55a0a1c11db389a6872b9d7c6750974341a575a ruby4.0-devel-4.0.3-35.el10_2.x86_64.rpm dd32725a3448911badbed4c6ee228d95f4041720b13876f8a325413fdb239b75 ALSA-2026:33565 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rubygems-3.5.22-13.el10_2.noarch.rpm 2f09c90f0b4981535ebbe0b5b7b4ba60dd9bf5785c27f0948403aee04d0d5b28 ruby-default-gems-3.3.10-13.el10_2.noarch.rpm 39ee09200809903651fa2e054e18cb445e9dae3f0c19984efe4045642eba7d34 rubygem-racc-1.7.3-13.el10_2.x86_64.rpm 5b9a69cb46d187641357b50074fd381b6c1657340453d2559d06fbf30801fab1 rubygem-irb-1.13.1-13.el10_2.noarch.rpm 5fe9dfe4760320749f19a851ab422764bf54367af0eb5510c9e54a95549daba8 ruby-bundled-gems-3.3.10-13.el10_2.x86_64.rpm 70ca74a1e73961acdeecfc7eda50f5755ffc3110dcde8747c2d7def26199407c rubygem-rbs-3.4.0-13.el10_2.x86_64.rpm 72448d8f1fabaf2703f5d314519c45991ea9c6583a0b59fd44830678fc3506e3 rubygem-rss-0.3.1-13.el10_2.noarch.rpm 77dbae3e8147ddc42bab5b6ea0d18c2e4118e0105e415dcfe6fde5793202bb0a rubygem-rdoc-6.6.3.1-13.el10_2.noarch.rpm 84f1915103438280abdc5b9e57ca39fb26ffae2bf1bc21027bd6ffc6d79f3a9b rubygem-test-unit-3.6.1-13.el10_2.noarch.rpm 866eeea21e0bb345ada37a03f5d13b57a0399196476d646d5eb5506909bc81d2 rubygem-minitest-5.20.0-13.el10_2.noarch.rpm 8d9d188779b8666f560bb68d91edd4391c9dc0cf440b9130fc0564c11966ea8f rubygem-json-2.7.2-13.el10_2.x86_64.rpm 900ef33822512245710b3ebc1307ade0ab57832c8aff4fcca7c2d06f9f6a52f7 rubygem-rake-13.1.0-13.el10_2.noarch.rpm 9b79c2f558b1658de031381b86dd753b030592a6199883a0022919c04b379525 rubygems-devel-3.5.22-13.el10_2.noarch.rpm 9c2bdfcca295e0d66484e9c97a77cd7f3e0ac57cfdb203043fc7933c70d2ca71 ruby-devel-3.3.10-13.el10_2.x86_64.rpm a3d246aa325214be49d25ad29d1cd48fadb35ae25a9f3db663ba9e32e951eb05 ruby-3.3.10-13.el10_2.x86_64.rpm ac31931608cb40d61e99c17097ab42c0c4bbec6b6ecf37e52c7ea560b464a2be rubygem-psych-5.1.2-13.el10_2.x86_64.rpm adb8860f2d3ad397ff0c0466b849e212489502c9931ce203a3d759092994aa41 ruby-libs-3.3.10-13.el10_2.x86_64.rpm c5eb86d2d4e05d1a4df337c0270ad88192d33fdef769aaa4f702353d72998197 rubygem-typeprof-0.21.9-13.el10_2.noarch.rpm d3a54b16ced51c5e321382a648a7fb7a1a9cac1940df6d3e2b907de4669c5d3e rubygem-io-console-0.7.1-13.el10_2.x86_64.rpm d59514227207ae5d25c73a548105b54b12e8f8df3f8a03f520721dd726cec831 rubygem-bundler-2.5.22-13.el10_2.noarch.rpm dd71e0f69e1f86a3e4c35e6fd46db1e3360041d19976243b46e4612a81b06606 rubygem-bigdecimal-3.1.5-13.el10_2.x86_64.rpm e03dde245e47914b74b2b14598ad65cff532333c573a53889bcd2c8d04a41736 rubygem-power_assert-2.0.3-13.el10_2.noarch.rpm ed105a1583192586a2f3343deb1cbc054e85193e938c0fb1822c3397f0e7ffa2 rubygem-rexml-3.4.4-13.el10_2.noarch.rpm f59082b3a7963f92107e82ec2557edc1e4be848f32ef1752978e61ea1311d1c2 ALSA-2026:33685 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) Bug Fix(es) and Enhancement(s): * CLONE - [AlmaLinux 10.2 Bug] qla2xxx flash image validation failure [almalinux-10.2.z] (JIRA:AlmaLinux-181887) * tegra-se fixes and updates [almalinux-10.2.z] (JIRA:AlmaLinux-182759) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perf-6.12.0-211.29.1.el10_2.x86_64.rpm 222b714992fafbfbdaa36ab80159abae2a86039ef5a93f4d8dec0dece177d260 kernel-headers-6.12.0-211.29.1.el10_2.x86_64.rpm 336e22af6bde94b8c26196fa1e71ad4eff4135c48684a094e694ee6211ce64cf kernel-debug-devel-matched-6.12.0-211.29.1.el10_2.x86_64.rpm 338416b8025445012d3bb77749ced39d9361a05e4c4237dcad60f9e5df5cb2dc kernel-devel-6.12.0-211.29.1.el10_2.x86_64.rpm 3af4648e01711ea67fa6193eafc2547f62a9b0712b43a5c7c5470068e1bf6ce8 kernel-devel-matched-6.12.0-211.29.1.el10_2.x86_64.rpm 508165cf4d64bf4069bcd59b47a34be590bb6866046baea0a769769ddae97a18 rtla-6.12.0-211.29.1.el10_2.x86_64.rpm a9cb26f57a83cafc54bd130bb649fdd1fc2a26219586e2a9a102fa5e3a20ac16 kernel-doc-6.12.0-211.29.1.el10_2.noarch.rpm b836e329534f6755772c1ddbdf8b9206b050a9efd1b92e1c01c0d98fdd9037c7 python3-perf-6.12.0-211.29.1.el10_2.x86_64.rpm c7ad7225878a091b32ef32fef3b99eb866680a3dfe672354cf0c4d52cdfb439f rv-6.12.0-211.29.1.el10_2.x86_64.rpm cb3d783d526dde965605d907b4228e408484e65881dc8e4f232db4476fd0c730 kernel-debug-devel-6.12.0-211.29.1.el10_2.x86_64.rpm cb4c4d9694788a0654e334d62d20406d926851fa6e1d6038b156104413019222 ALSA-2026:33731 Copyright 2026 AlmaLinux OS 0 1 Moderate

rrdtool security update

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density. Security Fix(es): * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rrdtool-1.8.0-21.el10_2.x86_64.rpm 1180ea0d7cc877b3790001b0ac9b1c0b45e5fcf423567c7c7f6699c4e88af66b rrdtool-perl-1.8.0-21.el10_2.x86_64.rpm 87deef7715a9f9266264562ee841a6dc5ea46e5b4234706c03f356e2865f3ce5 ALSA-2026:34109 Copyright 2026 AlmaLinux OS 0 1 Important

httpd security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) Bug Fix(es) and Enhancement(s): * address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mod_lua-2.4.63-13.el10_2.4.x86_64.rpm 04b1ec7b2b14f5e619c6515530a502710dc9d17b2843b2bda588d4b941ce80d6 httpd-filesystem-2.4.63-13.el10_2.4.noarch.rpm 30a9431c19d9b0eaee77dd0b3a9c83a8c8a3a28bd86f1779bae9f85de7bc9f30 httpd-manual-2.4.63-13.el10_2.4.noarch.rpm 5e32be7a095c8c1c4519272d18d660a3422b7a943ac850a731cff5f11027152d mod_session-2.4.63-13.el10_2.4.x86_64.rpm 6e983fb5b3c48eae5eb9806891adc8bd01399007367f6879dd4250bcd613f62a httpd-core-2.4.63-13.el10_2.4.x86_64.rpm 6fe618c10f1539f09ad9a3dcd28c6ba2792c89388c8b79d5e4cc4c1263c5a592 mod_ssl-2.4.63-13.el10_2.4.x86_64.rpm 7e904209f76be48f00d7cf3f2e1da484a7e83219d43c1b0cfcc346b18a330234 httpd-tools-2.4.63-13.el10_2.4.x86_64.rpm 8e47adecd11354def1ac92f87a7bea0b31607a42aa0e3389b0b8c5f9e1d8fc0e mod_ldap-2.4.63-13.el10_2.4.x86_64.rpm 956c298478071fc565d7b4fedf42469e7db3f46e58f4e6375a45c2178eb38347 httpd-devel-2.4.63-13.el10_2.4.x86_64.rpm cc8067bd0949526415899788ddab5a4c8a9e9fdd20738e1ac595e6f7f735cf5f httpd-2.4.63-13.el10_2.4.x86_64.rpm f072b01be5ef050a8d280d9a86ff2087d7d63481efd6acc35ac0d245c910d944 mod_proxy_html-2.4.63-13.el10_2.4.x86_64.rpm f8ba3696c5bcbac939b042557b5307cc356399709f55c000ee17fe5ba1bebab6 ALSA-2026:34355 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_http2 security, bug fix, and enhancement update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Bug Fix(es) and Enhancement(s): * address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:AlmaLinux-188008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.2.x86_64.rpm c5241eba414dd3c76d1b334aba1ac16df013306c0c1315ae2cebc86013be6a78 ALSA-2026:34357 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default opentelemetry-collector-0.152.1-1.el10_2.x86_64.rpm a3495082924fc67198a5b6d5ebb2247b1a18107f95ea64e72ac8f696af612558 ALSA-2026:34911 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) * kernel: kernel: ipv6 frag escape () Bug Fix(es) and Enhancement(s): * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z] (JIRA:AlmaLinux-182537) * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perf-6.12.0-211.30.1.el10_2.x86_64.rpm 1fad00df2cf8aaf8c3d28d75bbd58956a40cd460034143f8faa6813650919c5f kernel-debug-devel-6.12.0-211.30.1.el10_2.x86_64.rpm 32c21efe263a6822ec25d686bf5d1ef9309321a37977d805c314d962fb6745b1 kernel-doc-6.12.0-211.30.1.el10_2.noarch.rpm 37071c47ef6d33902382a8ed775082ac0e87202627db8e9d81a39e5f0fbdfabc rtla-6.12.0-211.30.1.el10_2.x86_64.rpm 7ee2ec094e78893552120be26c4c53f678ae54b2079b376aba5d3eea8883014b kernel-devel-6.12.0-211.30.1.el10_2.x86_64.rpm 80a406ffedec8096b899275eb83b8ba0e715f76c4c75d3e2123dc7282a37190a kernel-devel-matched-6.12.0-211.30.1.el10_2.x86_64.rpm 96112cce561726aa8b50c44aa07c5eae58594556f4bb1dd91d8306b8595632b1 python3-perf-6.12.0-211.30.1.el10_2.x86_64.rpm c852449bc8702ff56763919fe12dbb458d0cbe7b7e3e3a82f89f2607130ac8e7 kernel-headers-6.12.0-211.30.1.el10_2.x86_64.rpm c8aa9e2fbef77caf935bf2e9e1fd1a3ed8feff256533a222af3ddffb86ae19ca rv-6.12.0-211.30.1.el10_2.x86_64.rpm cb896b547d5cc5cc9af26bb98f8373b308df604ba5c6e19f53d15a616bb26c39 kernel-debug-devel-matched-6.12.0-211.30.1.el10_2.x86_64.rpm e20c7129b6c52cb16e1cb33661db157cf9a2779f9064c583e40292ec194a7cfb ALSA-2026:35826 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default grafana-pcp-5.3.0-7.el10_2.x86_64.rpm 9eb47148ba763ed6a9290a1583bbf8325b502fdd398b1dffa782ee4b7b387d14 ALSA-2026:35827 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default grafana-10.2.6-27.el10_2.x86_64.rpm 0fe99c0636b08ce9fa2d7ef0ccfa71966fe8ff9f759af991c4efe5fb527ccb98 grafana-selinux-10.2.6-27.el10_2.x86_64.rpm e8c74f6f60e144cb8baa3158fca37f8836bd289bb302c61e975db69ce8e58ec7 ALSA-2026:35832 Copyright 2026 AlmaLinux OS 0 1 Important

golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ipp-usb-0.9.27-7.el10_2.2.x86_64.rpm 91b616469e5c9f3139f81f30be554b06363972d52d473d56e823f0ae4a7780cc ALSA-2026:35841 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs24-devel-24.18.0-1.el10_2.x86_64.rpm 20b60b9c9bc65122a251254e79d07f7b834c293538ea00ec0e53a648cddead4b nodejs24-full-i18n-24.18.0-1.el10_2.x86_64.rpm 4d8fde974b7b0107371082f4a599e75e6c9b13a81bb248477c496644690dba68 nodejs24-libs-24.18.0-1.el10_2.x86_64.rpm ab3cefa94eac2b0bd7fb31c94c645b6e35445bb3809bf3f830816b0046e3f3ca nodejs24-npm-11.16.0-1.24.18.0.1.el10_2.noarch.rpm b26d8267ca66276f7e691e6ae46d36fc0beaccc3064246c73bf7e97f5437ff7d nodejs24-docs-24.18.0-1.el10_2.noarch.rpm cfbfb133600350bcd79f384de1fe77fa2508bf7bbac0e804b4b4b5991450e772 nodejs24-24.18.0-1.el10_2.x86_64.rpm f13137f62792250e07a08e6234ace4ac759be94cfeb542f322d2140ca71ca392 ALSA-2026:35842 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs-libs-22.23.1-2.el10_2.x86_64.rpm 0a10beefb725c901aa74a9d6aec85fb68dc70955363031af0c5e315091f9f568 nodejs-devel-22.23.1-2.el10_2.x86_64.rpm 3ca1e0c4404efc9c06130c4d240ec04a2c5d363702c3f4bc510d731b42207210 nodejs-docs-22.23.1-2.el10_2.noarch.rpm 492a598f325fdb1de667b1cf3eb563ff290a931816399634238410c6852efc36 nodejs-npm-10.9.8-1.22.23.1.2.el10_2.x86_64.rpm a8979b7c3c488fbc0879cb3fb2ffae985519edddd89ea6c47e8a4a9b9f2c5ee4 nodejs-22.23.1-2.el10_2.x86_64.rpm ca9c67ba787a0c21554f14ce1caadba3ba320749a3244ece4e030ce44bcf04f2 nodejs-full-i18n-22.23.1-2.el10_2.x86_64.rpm f0ff87688d04a00f27926acf38f20a7ea32ba6833cac25228764c7dc6f2f69af ALSA-2026:36193 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-pip security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3.14-pip-wheel-25.2-3.el10_2.5.noarch.rpm 80456c6bf4f96a398309a5858cf83bf96d5c0f655b8b581a95e3ff83b8664e80 python3.14-pip-25.2-3.el10_2.5.noarch.rpm 927cdfb0565ce93516e52106bc6c1092e3eb33f3170f0a74c8dfae46233929be ALSA-2026:36196 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default 389-ds-base-snmp-3.2.0-8.el10_2.x86_64.rpm 604197033ad506e8f6d5587b7d4706a5f8e94b3f6f8bae9c362da6660bf079cf 389-ds-base-3.2.0-8.el10_2.x86_64.rpm b282427aacdbe05067ba54d2189679ee09b2cf61a3263cb489e15da5738eadbc 389-ds-base-libs-3.2.0-8.el10_2.x86_64.rpm cf442e2736acde0e918d129735fa02db37625a625727a5c3c1089ba875ceba4d python3-lib389-3.2.0-8.el10_2.noarch.rpm db8acba0242228f0760021708fbba6f09ec6c3ed8b57470de69e594a8a184aa0 ALSA-2026:36199 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default buildah-tests-1.43.1-3.el10_2.x86_64.rpm 625581c9ce9daef1bb6ab269d033f94e2428bba94ce6f8174fc1258964b15d47 buildah-1.43.1-3.el10_2.x86_64.rpm 8708a2aa20e3360f34dab87b679bd1cb3b683e0353a32ad0c570c9e8f2b40829 ALSA-2026:36203 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033) * freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422) * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700) * freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421) * freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libwinpr-3.10.3-12.el10_2.6.x86_64.rpm b501f14f5e186a43b4308a8285244b7c80e2f9a4e32c543ca7c42458380b799e freerdp-libs-3.10.3-12.el10_2.6.x86_64.rpm cc170912f23610d3e90b45aaf18e65dfc991d0b7374c6b37f9cce4b7f0097d7d freerdp-3.10.3-12.el10_2.6.x86_64.rpm ffac1e4d44179db82cad107b992c6c51979855bfbb9129eecd8476d112ff0a0d ALSA-2026:36211 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default freeipmi-ipmidetectd-1.6.18-1.el10_2.x86_64.rpm 3c24f75229f4087dc2f56b778fc56c599eb03c0eb5741244d72eff647f2365fa freeipmi-ipmiseld-1.6.18-1.el10_2.x86_64.rpm 78b35e204d71b9e35700717ae2384dd2f8e0909990a8dfeb1bce99cfaa53a2ac freeipmi-bmc-watchdog-1.6.18-1.el10_2.x86_64.rpm b0f5068d7e1a07f6169c33bffa0456bd1648be663a5bbdce075bf897b0585ad6 freeipmi-1.6.18-1.el10_2.x86_64.rpm dea9fc6e606700e5eac9d772f0c062fff85b649562fa91bbe4cb7aa64e914762 ALSA-2026:36320 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292) * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622) * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390) * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default unbound-anchor-1.24.2-7.el10_2.2.x86_64.rpm 0507705a4972b9add048f62f9ae6226924f386490fb3523c56f47f5376c19376 unbound-1.24.2-7.el10_2.2.x86_64.rpm 1e0c8febb022cb58bb18a0b0259203738cfbb557fcf619caa449c104b01e95d4 unbound-utils-1.24.2-7.el10_2.2.x86_64.rpm 4a9c5d7b18bdbbf334ab9ed79fa0f78c7ebdfa87a4e8dcf96d3d3e628ed22c9b python3-unbound-1.24.2-7.el10_2.2.x86_64.rpm 6a117f45107c8e5057b5deeabcd1ef4b260a7d8196aa9d52358534698912ef59 unbound-dracut-1.24.2-7.el10_2.2.x86_64.rpm 744e7d976ad035fe803f8593895d5aa2898298c1cc48436b0a98398af060113b unbound-libs-1.24.2-7.el10_2.2.x86_64.rpm 8f121e809b6d6e51a1e6b812e9e024d475c0119c30acd9d7c1baa4e6312db1cb ALSA-2026:36364 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) Bug Fix(es) and Enhancement(s): * "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-10.2.z] (JIRA:AlmaLinux-191778) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nginx-1.26.3-6.el10_2.5.x86_64.rpm 001ba9523912130b6794361a5f942965a9453d904d2a2440895e3c19516c9ccc nginx-all-modules-1.26.3-6.el10_2.5.noarch.rpm 63783f2757ef9f4c14eb7739660124c6c7d8094475d4b3333f54aa552c72f0fd nginx-core-1.26.3-6.el10_2.5.x86_64.rpm 737ec213dbf9ba1be9dbb7c32a3191e5dadb2c45253e986dcffd1fb2578c3f2f nginx-mod-http-image-filter-1.26.3-6.el10_2.5.x86_64.rpm c7f6461118c1df5d4d1f8616d2851023992de54cbdb76ba491c6bccee7707e7a nginx-mod-http-perl-1.26.3-6.el10_2.5.x86_64.rpm cbae987d1ab79aa200bd7fcea653412cd88aa9758053cdcd27f786ec5d880441 nginx-mod-mail-1.26.3-6.el10_2.5.x86_64.rpm e18fe3178e3a3de4db4de59e7f49bf6fb0f94ac0bdd3c152d7d3c034027397f8 nginx-filesystem-1.26.3-6.el10_2.5.noarch.rpm e33cd1bd4272896159c0e7c1cd3fb48f85a85d98e7641fd3ac67aa121ff5fae5 nginx-mod-stream-1.26.3-6.el10_2.5.x86_64.rpm e5b3c6ea3b15e7d2db7ac570879cb779c25648ee14048b71b5624917f26ac677 nginx-mod-http-xslt-filter-1.26.3-6.el10_2.5.x86_64.rpm ecc550ec6fadb2cd848b043814c4a6aa6cf2e4205d682f2822bd75185ad2e8c0 ALSA-2026:36541 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) Bug Fix(es) and Enhancement(s): * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z] (JIRA:AlmaLinux-162140) * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z] (JIRA:AlmaLinux-182770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.31.1.el10_2.x86_64.rpm 084aaa0c0aed91e9d7d152a8e489dc77f090581b2eb104939e10a9ef3c97f273 perf-6.12.0-211.31.1.el10_2.x86_64.rpm 4f9c4e422337ffad90e944069779af9f5fdbb3f2c9d2ce79adf61822a18baca3 python3-perf-6.12.0-211.31.1.el10_2.x86_64.rpm 6570c4e352620459d16c320f9b161f0675f53e03f390525325fbc6e3849a744d rv-6.12.0-211.31.1.el10_2.x86_64.rpm 677c69f94b18e270c701997314a8d9512d63935c57b8f987165572fd46741386 kernel-headers-6.12.0-211.31.1.el10_2.x86_64.rpm 687b067e39d6207061bf46afe0c3dd16927b70e596b92450a17b2c55e887d088 kernel-doc-6.12.0-211.31.1.el10_2.noarch.rpm 89b91f15b9a6c2c75be8b2c7e16409d5457cac0e17efe5cccd145ffe6964e501 kernel-debug-devel-matched-6.12.0-211.31.1.el10_2.x86_64.rpm b6237446274babee95e6725bd2366f5cc78586b57276b26e0b5a23cf78e95584 kernel-devel-6.12.0-211.31.1.el10_2.x86_64.rpm c5476fe124a310ec5b568c428301c5d549a164a9b88990f87357f4471c37cdf7 rtla-6.12.0-211.31.1.el10_2.x86_64.rpm c984cd6c09d70dcc269f2fc4bce4bc4068f0acb1a97b7d3380483658df22e175 kernel-debug-devel-6.12.0-211.31.1.el10_2.x86_64.rpm eabb6855e5668d5f19358495313ddb779830936b508a24eb5846c58849aff7e3 ALSA-2026:36673 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL. Security Fix(es): * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1.x86_64.rpm 89f66493e0a4dbe9b3cb0e614c317e10b65aca9e84ec8b845d97aa588e72b4e9 ALSA-2026:36675 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.1.x86_64.rpm 4bd2eec87182e86a086229556fb16567498c725aeca5b77a11d5c5d19edcb74f gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.1.x86_64.rpm e40b254a9d94a31b79d726e1df80e8e03cf6d6da9921acbf581572f2f7d3b0e9 ALSA-2026:36749 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.x86_64.rpm 142f17b32e7117a2779ce4837c0ff969a7bb863b829406fee81f8a8093297fd7 gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.4.x86_64.rpm 2e946d04bc8afa69d42a858ee7274ab38d83abb4222adc99544e493d5dbe7ac2 ALSA-2026:36782 Copyright 2026 AlmaLinux OS 0 1 Moderate

aardvark-dns security update

Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in `src/backend/mod.rs`. Security Fix(es): * aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset (CVE-2026-35406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default aardvark-dns-1.17.1-1.el10_2.x86_64.rpm 2e6b2341243545a93b527d1de4e8ff8c00c4c98e0e266600c16fad11d9ad1247 ALSA-2026:36788 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat security, bug fix, and enhancement update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default tomcat-jsp-3.1-api-10.1.49-3.el10_2.alma.1.noarch.rpm 1819dbffc1a4bca43680dfb716f9f6bfca480b2c4603395e77e0a419a58fbf40 tomcat-servlet-6.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm 2554b1cd27aae45d566ee543e529a7f8b631976f3dc644dccaa3151198093639 tomcat-el-5.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm 4b09a49a6a830ea70914354fdb2180be3d73be82a0bebb83bdfefc3d3432cb85 tomcat-10.1.49-3.el10_2.alma.1.noarch.rpm 7a52ade066f085dc82c61eb86e4ef336c98d2ac6ba70eff0127686795e779fa3 tomcat-lib-10.1.49-3.el10_2.alma.1.noarch.rpm 8493861578941c0333c0447a8fba9719aa909187e4dfce1eb7ea6f9689eb73f4 tomcat-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm 8545fc47344bf1f124375700093b8bd550c7b5bbd3885316391a2c6901779bf3 tomcat-docs-webapp-10.1.49-3.el10_2.alma.1.noarch.rpm cd529a071ef3d5271bd60e65c7097b158dc762889174cff1d29908a19942df9b tomcat-admin-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm f1ca32a57c82c415745065d6ad5dee139ea70ca3e4b206c2c5213577fb413f9f ALSA-2026:36790 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat9 security, bug fix, and enhancement update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default tomcat9-el-3.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm 1e7a1f290d83d33dca1568da1d68c956d2ff9d703a7b398d2955f8f881f6c51c tomcat9-admin-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm 35f74b44de15b3b04a6bc454a111d3dfb26dfee6c7ad16644fb1a88130dce735 tomcat9-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm 3682120341af35136b188a86d60de457c2c5936026aea99b5a7b1317d71f90f2 tomcat9-lib-9.0.117-2.el10_2.alma.1.noarch.rpm 3a1e23335ca4fc1ca27006743516d5c74f7da734dc74dcdc72f5a4bed710668b tomcat9-servlet-4.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm 42f01e89a5d4c20d96e5212710be93238f72ce04851d86ae714c53b925109a88 tomcat9-9.0.117-2.el10_2.alma.1.noarch.rpm 7b18a53d3580ad05f99f8ee76bc0a5408bc9f0a2ca45465fd3446184546c2cb9 tomcat9-docs-webapp-9.0.117-2.el10_2.alma.1.noarch.rpm a59f4bad7f545f5287804da402c7f5be36cbae0c74cf7b8b5f691c3473fe68b6 tomcat9-jsp-2.3-api-9.0.117-2.el10_2.alma.1.noarch.rpm ac4d0fe0045a2723cfb5b6f43bdf719a027a0d7e5f26985bc08e3b4c1c91feb3 ALSA-2026:36956 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rtla-6.12.0-211.32.1.el10_2.x86_64.rpm 288a3394d50259b2ce4a580c8fb20a8c9a395c45ebcee2768e831e79518e9b3c python3-perf-6.12.0-211.32.1.el10_2.x86_64.rpm 3e3c912a6c678ef86529c0247854e77fbe895ff1c910845bd786947edb735612 kernel-doc-6.12.0-211.32.1.el10_2.noarch.rpm 4f6f025dca58da64c2300881e18f8767aa214eab6914aec981f04cad4cabb279 perf-6.12.0-211.32.1.el10_2.x86_64.rpm a257e5a28a853eafa5ebb7af28a286e55ac37669da61734b4758343dc6bc0838 rv-6.12.0-211.32.1.el10_2.x86_64.rpm adbf03139738d116a97c3a6ca8b45de382a47d1020908c834ba6876382864895 kernel-devel-6.12.0-211.32.1.el10_2.x86_64.rpm d7d68f28282feda6904eb1d85ef7f7e1c122abe6a58fc9b4950d8362cabda7ae kernel-headers-6.12.0-211.32.1.el10_2.x86_64.rpm e6018dffe864b879bfda55c8e2407945ddc0b711e8c531f6c7a01d606ec0570a kernel-debug-devel-6.12.0-211.32.1.el10_2.x86_64.rpm eb5e268154934764583c97f40fe9f95430a795b4715ae3c6ada0e9f137b06da3 kernel-debug-devel-matched-6.12.0-211.32.1.el10_2.x86_64.rpm f73f267d97f2f2e5e27d3d2263a52f6aa8f66bf351c013468ad587a09f750f73 kernel-devel-matched-6.12.0-211.32.1.el10_2.x86_64.rpm fc166dedb20b94fe7a276fa9627cd004d196297b5bb23733d4b4fec034e279c0 ALSA-2026:37436 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.5+1 [almalinux-10.2.z] (JIRA:AlmaLinux-193473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default golang-1.26.5-1.el10_2.alma.1.x86_64.rpm 05f1f1b2a2f7f0a865876ab564cb8e2c43164372af3c431aaa34613653c9ec8c golang-race-1.26.5-1.el10_2.alma.1.x86_64.rpm 56a18be868c200ba2e8561499a87f78c51516230c1cedb894fba81daaaed7ecc golang-misc-1.26.5-1.el10_2.alma.1.noarch.rpm 8b1baa3232557c008b80897b0d878d2d32cb781b8cc9b3418c2541f114ab8bd2 golang-bin-1.26.5-1.el10_2.alma.1.x86_64.rpm db95e3495c07d8f14379c8d8294766478501f2e43087bf4b2a3b41728ea5b022 golang-docs-1.26.5-1.el10_2.alma.1.noarch.rpm e79232aca5b77e65b500df22bd8d4d8328e0c2dce6833e3fc94730d5830a9c07 golang-tests-1.26.5-1.el10_2.alma.1.noarch.rpm e793fc42fe1650f9a19106e8b5b7a3d9bdb7d8d0204ee5e5af2c808d2d66a9bc golang-src-1.26.5-1.el10_2.alma.1.noarch.rpm ec33bba2e56c497962b088c3e47106cc014d357d9e7a0743489c3b9f1da82635 go-toolset-1.26.5-1.el10_2.alma.1.x86_64.rpm f17a2aab2b29fb1398d359c5bdf5586a4f2e27d3771b92325a5b5b27c2d58507 ALSA-2026:38492 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rv-6.12.0-211.33.1.el10_2.x86_64.rpm 04851f7e76e1982182657a182cca5a2c3b90ce78d5cebc1e1e2dc228b5666ce2 kernel-debug-devel-matched-6.12.0-211.33.1.el10_2.x86_64.rpm 0d0f81ce11c0f46b81adb4c7a65c65ca84367faf5ff876eb7dc39095728daace rtla-6.12.0-211.33.1.el10_2.x86_64.rpm 25ade2e90f3bd86bc021e2caf1a2dc333a4d8728f2c373165be2ef409778c898 kernel-devel-matched-6.12.0-211.33.1.el10_2.x86_64.rpm 309fdbf35fc19bb556c69f8fb1a0f139753bc7a1c07e45c9266809d465225a81 perf-6.12.0-211.33.1.el10_2.x86_64.rpm 5b5bed36211eddef09476bf2b1d3a73ce34ad28c431923964cb128aaec1e74fd python3-perf-6.12.0-211.33.1.el10_2.x86_64.rpm 73c05cddfe952ab5a6416e8908c62c834a3c68a87d61e32f42839c2b80a66b55 kernel-headers-6.12.0-211.33.1.el10_2.x86_64.rpm 8b765dac2404ac35a372e8133a2a66745889e12a7a20767718e0a903a9848f37 kernel-doc-6.12.0-211.33.1.el10_2.noarch.rpm cb6b5ac15159f9f1673206a9a80d24ed89608d643c0b10f5ae9295c1579474e0 kernel-debug-devel-6.12.0-211.33.1.el10_2.x86_64.rpm d09000c44a00fdd85af0669f8de1531d9bbd03bb3eb0953020b4b5d713ee6df3 kernel-devel-6.12.0-211.33.1.el10_2.x86_64.rpm f3ab05a04998604103cc72819b734ef786077ec13c2d5aa06e257288813a645d ALSA-2026:38494 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default buildah-1.43.1-4.el10_2.x86_64.rpm 9a09ebc2058de01cbfa351be541d375e9533317c91994f19b98a95f54ce22fe2 buildah-tests-1.43.1-4.el10_2.x86_64.rpm f7f8c93c22a56ff23a03fd12f1d027bdcd5f4396592873a0b3df6744496828bb ALSA-2026:38495 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default podman-docker-5.8.2-5.el10_2.alma.1.noarch.rpm 6d642e7bf54d7d8737244e959bd94e167100278c8303a9671587b40898d8f8a0 podman-remote-5.8.2-5.el10_2.alma.1.x86_64.rpm d2bd55fc3b8093d88661166e17b083ca07df7c28e8616f0bdd6ba71eeef95ad1 podman-5.8.2-5.el10_2.alma.1.x86_64.rpm e02438aa9237fedeb71795e36729baa4f13b8400314b39685fffd6852c847749 ALSA-2026:38499 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142) * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openexr-libs-3.1.10-8.el10_2.3.x86_64.rpm 2c37892300b956acab905f2e5363a7f25d28be540586628241be1fa23f6466c4 openexr-3.1.10-8.el10_2.3.x86_64.rpm 4a703b25fec905a46722f11dc1623fe018fea7e79f179e403e6267f70c0e7b21 ALSA-2026:38509 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162) * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858) * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default xxd-9.1.083-9.el10_2.7.x86_64.rpm 60b6d5b70047495ffd66ada161dfa8ee78b52a67c0bd1c070c74c496f68e5df1 vim-enhanced-9.1.083-9.el10_2.7.x86_64.rpm 91ad4b798367510f98fcec834e2cf8c07271b218c0f90756fc49b14da3b85556 vim-common-9.1.083-9.el10_2.7.x86_64.rpm b9e321e9e383bc4884c53851b93b268150e13f0323e815fd145f7d7cc5094e70 vim-X11-9.1.083-9.el10_2.7.x86_64.rpm f537734adfb652c7f0df843804fe29fe4a05ed8761ed1b481fa3ba3f0d99b5f7 ALSA-2026:38513 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.1.x86_64.rpm 1fa3e1ee27267437c0dd70fc43cc4455db5e72635193fe45c72ed68d3403d467 ALSA-2026:38514 Copyright 2026 AlmaLinux OS 0 1 Important

plexus-utils security update

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage. Security Fix(es): * org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default plexus-utils-3.5.1-9.el10_2.noarch.rpm 0e05d395f8b55a153026dfa3c8010ad4245d0439c34d80e42db758da41ab8738 ALSA-2026:39183 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python-unversioned-command-3.12.13-2.el10_2.1.noarch.rpm 01fd0cfaa34357b582559770297e93d57c2b9e0ffb6f529c89ba4cd34d50ce96 python3-tkinter-3.12.13-2.el10_2.1.x86_64.rpm 24b59cb8ead62e4a03778e8bcdb89f5a9e6d8650b9e6c8db40c43dd2d092668d python3-devel-3.12.13-2.el10_2.1.x86_64.rpm 7f527600ae5ef9113eee793a004687d6fa58873845c99317153eaf750370cfe5 ALSA-2026:39272 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.6.x86_64.rpm 85af898723f4eaaf0bb5f75247ad96be602e738e17e7ebd7a6eced3b07a0d809 ALSA-2026:39296 Copyright 2026 AlmaLinux OS 0 1 Moderate

libinput security update

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es): * libinput: local privilege escalation via crafted uinput devices (CVE-2026-50292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libinput-1.30.1-2.el10_2.x86_64.rpm 09b9d335aa99f1bf67bc957b8af506407bc7b63431611d4b5714ccf5b7649fbb libinput-utils-1.30.1-2.el10_2.x86_64.rpm cb520258aa59ae4ef9fbbadde190f0c6bb1c7762201874d5ac7a5b9e6dd89292 ALSA-2026:39297 Copyright 2026 AlmaLinux OS 0 1 Moderate

edk2 security, bug fix, and enhancement update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) Bug Fix(es) and Enhancement(s): * edk2/x64: re-enable legacy kernel loader [almalinux-10.2.z] (JIRA:AlmaLinux-182421) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default edk2-ovmf-20251114-5.el10_2.2.noarch.rpm 15c2aa72562324380757fa4e4264b27e8d215a4ead60505448e6556096472823 edk2-aarch64-20251114-5.el10_2.2.noarch.rpm 5ebf1586f73cdbb4f6af4b6fac8634e21e96c81337572dd52d11cb6022b477ab ALSA-2026:39302 Copyright 2026 AlmaLinux OS 0 1 Moderate

cups security update

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVE-2026-34980) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default cups-devel-2.4.10-18.el10_2.x86_64.rpm 2f4e8d05d8ceef3d31c185a3f1d9737d265dfe7b4c2efd07657252648b623809 cups-client-2.4.10-18.el10_2.x86_64.rpm 8aae837bdb40351f54bf70ea63759c196e612cc46f241477be9137e3ca256ce6 cups-lpd-2.4.10-18.el10_2.x86_64.rpm b66c8eefaf996617c5dc20242cc5121153cb42e845a3d09cfd0fec47e4f36fe3 cups-2.4.10-18.el10_2.x86_64.rpm e303357f332ebc9fe53cdc2c4c966b4e3f0e8ae100a28a611e720b2008bd99cb cups-ipptool-2.4.10-18.el10_2.x86_64.rpm f0bfc29f62e9539f8ea77a1f44235b1aa5548c3d9a352aeea2b65f4f13498dfd cups-printerapp-2.4.10-18.el10_2.x86_64.rpm ffad58cb237b2eb6105d86f4c2f8a324e72942894d5a217ce3d06b912efa9602 ALSA-2026:39304 Copyright 2026 AlmaLinux OS 0 1 Low

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling (CVE-2025-6170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.2.x86_64.rpm 029443c20a6fe306668bfe6ca910b99c017d137bf2493abea5d9010fc67dfde4 ALSA-2026:39494 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: XFS data corruption using reflink () Bug Fix(es) and Enhancement(s): * [Exploits (KEV)] kernel: XFS data corruption using reflink [almalinux-10.2.z] (JIRA:AlmaLinux-193945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-perf-6.12.0-211.34.1.el10_2.x86_64.rpm 13bfe5a7aae06de6d9be5d813f5bde7cd0299b9dd3138b77fff0a3917c6787da kernel-headers-6.12.0-211.34.1.el10_2.x86_64.rpm 18803ad550b09c2f9a2bacdc950510ab0c50f272be18ebb42db38e3071986b34 kernel-devel-matched-6.12.0-211.34.1.el10_2.x86_64.rpm 2f27f654558f0052129d1326173683a0257deb712a1a070077ab971ced32c13a kernel-debug-devel-6.12.0-211.34.1.el10_2.x86_64.rpm 41c4682d38fd53ec89eef8872bed5bca18efe687788edca66c4c12604f743405 rv-6.12.0-211.34.1.el10_2.x86_64.rpm 4a3485e105f4274eb8e9be25ca97ccfe8a803728a4ac40bd0f4f8c87913c7838 perf-6.12.0-211.34.1.el10_2.x86_64.rpm 4cef84894abe99598720966dafd7fd800c0bfeed563847155665cd25c4f13899 kernel-devel-6.12.0-211.34.1.el10_2.x86_64.rpm 78010b36c404d84c7b4e49278243b090f0194db3939a6acc4aeb3cbfc8c28eb5 rtla-6.12.0-211.34.1.el10_2.x86_64.rpm 988e57799bf820bee13fc189fdf3214124011664b4faf4085eff3f779fc13014 kernel-debug-devel-matched-6.12.0-211.34.1.el10_2.x86_64.rpm dd3afe6b8e891e6bc804571e06546266b8d93ee5dec990a8d7be86a94bdc23a9 kernel-doc-6.12.0-211.34.1.el10_2.noarch.rpm f70c0c028135ad9c40726ef7b16d8d2b3251fe80614da1fb1532d5c0d7eb97a4 ALSA-2026:39547 Copyright 2026 AlmaLinux OS 0 1 Important

perl-XML-LibXML security update

This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fix(es): * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-XML-LibXML-2.0210-4.el10_2.1.x86_64.rpm 263b91a8f019e2ec0790c79473586efdf57bf628ec9f7f56ae7cfa04bde1660d ALSA-2026:39573 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.x86_64.rpm 6fd2d13f76b5df9110797da6f6f45e6c556293d722de84cef9c4067509bfc6db ALSA-2026:39976 Copyright 2026 AlmaLinux OS 0 1 Important

hplip security update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * HPLIP: Incomplete Fix for CVE-2026-8631 (CVE-2026-14544) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libsane-hpaio-3.23.12-10.el10_2.5.x86_64.rpm 469734543f41c4c0ba0de64cdeb783018db65e4e26bb574ae85f5dd6a080493e hplip-3.23.12-10.el10_2.5.x86_64.rpm 771d673fcb9c4697f3ec6b675a816d789311c4703c87d7ed97ffb93083c0058b hplip-libs-3.23.12-10.el10_2.5.x86_64.rpm a20e0a6753c8a316ed13a48b09255be814028d55cc4c5c543b2539d5633a1384 hplip-common-3.23.12-10.el10_2.5.x86_64.rpm db9056e214b9b40b2116a5eed98a74e19186a17bb1b9238eb67e64890ea2477b ALSA-2026:40833 Copyright 2026 AlmaLinux OS 0 1 Important

pacemaker security update

The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures. Security Fix(es): * pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default pacemaker-cluster-libs-3.0.1-5.el10_2.1.x86_64.rpm 32e75b4387d97b1828f7614bce01887d35a3c5b9f9db3d227b7101d3843ed120 pacemaker-libs-3.0.1-5.el10_2.1.x86_64.rpm 38d2a58fb05efe9df37d49201146dd1401d181b6a88489bc2e0436fceeaf4b24 pacemaker-schemas-3.0.1-5.el10_2.1.noarch.rpm 6e3da70c121af183095ce7a58c2b0a382194143758f71b5c897c62fa60a07c53 ALSA-2026:40856 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3.14-3.14.5-1.el10_2.1.x86_64.rpm 023215d1245293e1e8981f7e3f09ad94fe82b64454ca1dda6c038b885a5508fa python3.14-devel-3.14.5-1.el10_2.1.x86_64.rpm 1ab49ae710d6e1a26ac81b0e3d06eecc32d6ab6e44ca9dddcc729ddafd1070d2 python3.14-libs-3.14.5-1.el10_2.1.x86_64.rpm a5a57783f5e5c550e5a351e5308b42a727a5e97310276e0c93ce1c5a4ed3ffca python3.14-tkinter-3.14.5-1.el10_2.1.x86_64.rpm be837a76ccfc2361e2c8a887155e1f706d8702b1baadc9554079562420a8d235 ALSA-2026:41892 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security, bug fix, and enhancement update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355) * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) Bug Fix(es) and Enhancement(s): * Reintroduce the `tiffcp -i` option (JIRA:AlmaLinux-185328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libtiff-devel-4.6.0-8.el10_2.4.x86_64.rpm 4e6f9634a30002ea8cb5003014bfc7adc22deb985434a3b468e8db3f6c207469 libtiff-4.6.0-8.el10_2.4.x86_64.rpm 4f32c74d6599208ec88b92e2f927e052603d08f4ed9070efb991eed9614f2213 ALSA-2026:41893 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-10.2.z] (JIRA:AlmaLinux-192468) * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-sdk-8.0-8.0.129-1.el10_2.x86_64.rpm 03ac16fcb9359f856ade5bf9e4752c515ef8043fa87e1aeee424790a2aadf5ca dotnet-hostfxr-8.0-8.0.29-1.el10_2.x86_64.rpm 198806dfc3e82c88f2c298df708ebeb7ed79c308ca20f9cda6580653789320fe aspnetcore-runtime-8.0-8.0.29-1.el10_2.x86_64.rpm 5f8edb92708d28133a4476701a9f801cbb1de39a3245ed6eb2dffc36711d7fa2 dotnet-templates-8.0-8.0.129-1.el10_2.x86_64.rpm 6c7919336bf1e1a0c2c57691652262aa9dca9c8160134dae0fa76d8f1714b7a5 dotnet-targeting-pack-8.0-8.0.29-1.el10_2.x86_64.rpm 711fd29e079e9c772a41354eed9f988115b429989cadfedfac9ecd4a044bcef4 dotnet-apphost-pack-8.0-8.0.29-1.el10_2.x86_64.rpm 800e73465e38bc395733b5ec6c103135eb512f134037ea4d0c4a163c9f9d2d11 dotnet-runtime-dbg-8.0-8.0.29-1.el10_2.x86_64.rpm 884c5f4bdf08e219d889c01880ee25a1466a4dfacaff508ba3457a1e15077532 aspnetcore-targeting-pack-8.0-8.0.29-1.el10_2.x86_64.rpm 947ce9dc8731f3143bf5a76a041f4595a80a7bf9d57a16995558da0bfc423293 dotnet-sdk-dbg-8.0-8.0.129-1.el10_2.x86_64.rpm bae642d70d9b13f50edc3aa1aac005241e3c4ad9057ecabb1b6b6c4f6d88ac36 aspnetcore-runtime-dbg-8.0-8.0.29-1.el10_2.x86_64.rpm c290b855c0ec4a9df1fa8124e36e8c8a6ddb09d08b8e154c29c6cec82b47ccd5 dotnet-runtime-8.0-8.0.29-1.el10_2.x86_64.rpm d635d8f928851785a6ef8dd059cc1e1adfc2b431f7bd5ce80e39f4a8180c28d4 ALSA-2026:41895 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64.rpm 01085fad4a020a4b4d629e44ca0cc89d781b72cf21de21cac9fbaf2acf5e1d3f dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.x86_64.rpm 16bbf3a629070bc2e6dc95ecc2ad50f45c306f199fbb2d0cba5b6f1c8be77be7 aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.x86_64.rpm 1e3a27e893108bdea47b1607be7433d8dccbd4f3cdadd99fb1f5b20dd7e6b3d1 aspnetcore-runtime-9.0-9.0.18-1.el10_2.x86_64.rpm 26cc90930ff667e6d35bb771af3b92797dbbb33cc3982860f826ae9b580c9c44 dotnet-apphost-pack-9.0-9.0.18-1.el10_2.x86_64.rpm 31dd9fcb03829ef924ef10ed0a0e2c24e0972037ae8f3dd1f7e9fd90589d48f5 dotnet-targeting-pack-9.0-9.0.18-1.el10_2.x86_64.rpm 50f132cf8c98c5bfac8edb71bdb8cbe3417a344b0d00cdafb91180798f0dc75c dotnet-templates-9.0-9.0.119-1.el10_2.x86_64.rpm 56f38362547fd89b5c899556930494ab829eebe99ba833e54793c34168556330 dotnet-hostfxr-9.0-9.0.18-1.el10_2.x86_64.rpm 576e6ac08793535a6eb8fe938c15f63789a0407db9a4649fd746d4d525aff2fb netstandard-targeting-pack-2.1-9.0.119-1.el10_2.x86_64.rpm 7a8ded4402484ffe84e2eb760468d984ab6fc439ddceb514653b22517eec0b96 dotnet-runtime-9.0-9.0.18-1.el10_2.x86_64.rpm 9eba22808ff26f50b25730b23dc803e542b01d6d3c5e01d22d4bc501556f79b9 dotnet-sdk-9.0-9.0.119-1.el10_2.x86_64.rpm d198d5318bb8790cc66f16f6c7d3c12cf8d56fcff2492294533ec3f2d787168c dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64.rpm db511eb7c12e61e516a4c12c805de45ae44dc9c2d8f41a0badf8b2a2a1852288 dotnet-sdk-aot-9.0-9.0.119-1.el10_2.x86_64.rpm edb5cecc64a02d37b732885b10ff8326dc6db05bf47fb4d755a2eee6fe1f0c64 ALSA-2026:41897 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-10.2.z] (JIRA:AlmaLinux-192463) * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192326) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-sdk-dbg-10.0-10.0.110-1.el10_2.x86_64.rpm 02ed8c02eb694d0b7c659ad114bb03d1d0e9fcf545d4a14cc436af68118e7a47 dotnet-sdk-10.0-10.0.110-1.el10_2.x86_64.rpm 0845c31ea61905c1406e7cd70b59141dfdc598486b2697ece32beb53ace16277 dotnet-runtime-dbg-10.0-10.0.10-1.el10_2.x86_64.rpm 098fabafb8a12188897c48fe997f70269601be534f9f3e897aca9439b2bfa4c4 dotnet-templates-10.0-10.0.110-1.el10_2.x86_64.rpm 18fa279636229bdc2c632d8d2752355a93d4f4ecb70f7a7a260a32b070b2457d aspnetcore-targeting-pack-10.0-10.0.10-1.el10_2.x86_64.rpm 3c869d59d0f73073723077ba75eafd82cbb5b3f58124bfe9f6275a9c85380bd6 dotnet-targeting-pack-10.0-10.0.10-1.el10_2.x86_64.rpm 4c73aa76d45fd4b6fd5a1b724b5491ff75264722eea3a1cc1a1d0be8d81fc8d7 dotnet-host-10.0.10-1.el10_2.x86_64.rpm 4ed730b9c88eef690f0fb9ef897832cf01d9457321186d0ae25dfbc8c4270137 aspnetcore-runtime-dbg-10.0-10.0.10-1.el10_2.x86_64.rpm 6da15a98a5b4044d459db8e5bcb2168cd8778d4ddde8dd3f5f2f09862722029d dotnet-runtime-10.0-10.0.10-1.el10_2.x86_64.rpm 7e6a0480932e6a0df2716eac48054fa4dec703319efe7839d4c08010a9df42f4 dotnet-sdk-aot-10.0-10.0.110-1.el10_2.x86_64.rpm 7f6292afad58539e3060a848a6b05e6b1c5250cfaee939f2554a13f3d09c880d aspnetcore-runtime-10.0-10.0.10-1.el10_2.x86_64.rpm a6d3a388710915f41f10b9ccc5b7fb3457a63aec2c71decb1e30507105b5b2bb dotnet-apphost-pack-10.0-10.0.10-1.el10_2.x86_64.rpm da17cbb4d426446193431dcc55f454c5c44de090fe1dd51498fc166c3603f0b2 dotnet-hostfxr-10.0-10.0.10-1.el10_2.x86_64.rpm dde53ae46419e06ed697cf24532bc62a32795c00d103c2c7d9f946df1c5a5173 ALSA-2026:41937 Copyright 2026 AlmaLinux OS 0 1 Important

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) * sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sssd-idp-2.12.0-3.el10_2.1.x86_64.rpm 197d814b68a031317874c9d5341d08d02fb93ecb3dc07312759579b68642247d ALSA-2026:41988 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dovecot-2.3.21-19.el10_2.1.x86_64.rpm 4824e508650503be534ae89b6fb06330c93733800a3e67a37f08f6a2d3b72aaf dovecot-pgsql-2.3.21-19.el10_2.1.x86_64.rpm 68cada4f35da914cad80aaeb910923ef3b1e32bfb184475d1480305b8824236f dovecot-mysql-2.3.21-19.el10_2.1.x86_64.rpm 83f3a80520deddb30284930d57cd6b25105908d6a5799ed620e0b7f99c9786db dovecot-pigeonhole-2.3.21-19.el10_2.1.x86_64.rpm cc1ba16d1cce6b975b0a1628f444b509a937f052711e6ea0a2aa1ed22e567b01 ALSA-2026:42063 Copyright 2026 AlmaLinux OS 0 1 Important

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.14.x86_64.rpm 01cf4a8220b00324ae22399a6b8092bf6a88b5172c4d2e841729a240e5385748 glib2-devel-2.80.4-12.el10_2.14.x86_64.rpm 491fa3d0dc89da0b9dea2b80c18d6a33c5495a2ff3d3f3d1d6985dcc66c926db ALSA-2026:42096 Copyright 2026 AlmaLinux OS 0 1 Important

c-ares security update

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default c-ares-devel-1.34.6-2.el10_2.x86_64.rpm 9b11ce8ce36443ef4783cece3692f698e38b303045c84dd215f83153948c4576 ALSA-2026:42694 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928) * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435) * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glibc-utils-2.39-128.el10_2.alma.1.x86_64.rpm 362b4dc27648e520a4a6ec7a95d4d31912c6ebe44e5fad5cd3c9c0d7b61c66cc glibc-locale-source-2.39-128.el10_2.alma.1.x86_64.rpm 6b1c858de87a311a44127349a31c1b3277726d98195c6824fbd8042fd3f70ada glibc-devel-2.39-128.el10_2.alma.1.x86_64.rpm 85031dd21baa54f9bcb7afd4f8ef4baddb7825472788aab660cb1f89d8ca5cf8 glibc-doc-2.39-128.el10_2.alma.1.noarch.rpm ec6e77a457ba7f13faf9ac4994f0f83f6fa55864f6690c7cb0495903d28a82f2 ALSA-2026:42739 Copyright 2026 AlmaLinux OS 0 1 Important

acl security update

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fix(es): * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libacl-devel-2.4.0-1.el10_2.x86_64.rpm e07cdf42dac993be9b794447bb4341ebdc892ddf3f5854583083e1849d94d6f6 ALSA-2026:42895 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default java-21-openjdk-devel-21.0.12.0.8-1.2.el10_2.alma.2.x86_64.rpm 107b8110e688b8a69fbbd571aa6fbeb40e724e50177d56503a3f698cc05560ff java-21-openjdk-headless-21.0.12.0.8-1.2.el10_2.alma.2.x86_64.rpm 1339e3820f3322aeaf802dfce7e914cdd593f8e4241c96f68ee000e7016c990d java-21-openjdk-static-libs-21.0.12.0.8-1.2.el10_2.alma.2.x86_64.rpm 3199a1325b7373e51f59c14e7b6f20b65caa6f01678a2d427a8a22b6f420aaae java-21-openjdk-jmods-21.0.12.0.8-1.2.el10_2.alma.2.x86_64.rpm 60556a046d2644eb5721dddf449efc4b7bd5a876c431dc18c1d7ef9fccee2da4 java-21-openjdk-javadoc-zip-21.0.12.0.8-1.2.el10_2.alma.2.x86_64.rpm 7503aad8cbb2e4efda4874fda1dd707c2479a7d157e30f64d0707cbfcd5f7b3d java-21-openjdk-javadoc-21.0.12.0.8-1.2.el10_2.alma.2.x86_64.rpm 907781292ca04a4f67aa6898bfe0a8e0bae7dcf574522ca64f93999bfbe5f6ef java-21-openjdk-src-21.0.12.0.8-1.2.el10_2.alma.2.x86_64.rpm a11e7b6ff802c63c6fc6b3237325b2f32866786f21780baa64affd5fc6af3b3a java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.x86_64.rpm aa0e189adcbe4869b72955bd9f2060cf5a302fc7a5f961316f956a110610c8f0 java-21-openjdk-demo-21.0.12.0.8-1.2.el10_2.alma.2.x86_64.rpm d145738f1f44f9f2adc9214ca8f51347c8513d9103258b2e795d7ee4fec29329 ALSA-2026:42899 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048) Bug Fix(es): * The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052) * On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default java-25-openjdk-devel-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm 1bfda4320a3ec529a0fa32168274b7f5be6b1a551ab18aae19ea3ebecb17ecff java-25-openjdk-javadoc-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm 37bebeacd468248549607a2be44a9441ecb2fab1afba70bfa708baf166ed2333 java-25-openjdk-jmods-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm 56130eef5fa4424f04fe2d1d3324b86d4966dff5205ed52b9b675cdbd05ac1d1 java-25-openjdk-javadoc-zip-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm 6388ffe04c1084d63988d81ae2b2217ab142c5dd4c673d5fb004776664e54759 java-25-openjdk-static-libs-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm 6768a694f028a033bc0c4e1bcf681676ed6557db6b4f2e570c1ae994ccbe476c java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm 75ec536e3bec34cfac700e91a02a36520ba583925322f8fd0fd5b9119186e9c1 java-25-openjdk-crypto-adapter-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm 7f6536a07dae2393799165e7b77f233f0fa9336453e72621cb7b1327980da173 java-25-openjdk-src-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm 978c196ec788082e85c712da41a9cf0ce889d8346d9c3a0e86b5556938ad36b9 java-25-openjdk-demo-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm c219675d7292c2c7b969d34384bab7135698e1d4252ca91816b7c74521ad6830 java-25-openjdk-headless-25.0.4.0.7-1.1.el10_2.alma.1.x86_64.rpm e9432519719b20c12bf27777078d527c3e27dd1057636abe010f22fb00c2c059 ALSA-2026:42919 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168) * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950) * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: can: bcm: thrtimer use-after-free during RX operation teardown () Bug Fix(es) and Enhancement(s): * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:AlmaLinux-173103) * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975) * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [almalinux-10.2.z] (JIRA:AlmaLinux-186311) * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.37.1.el10_2.x86_64.rpm 00703689e886fbd4f6b34900db6045a0a505eec3282d0190f58f8aedc2ef6a90 kernel-devel-matched-6.12.0-211.37.1.el10_2.x86_64.rpm 05d9ff0e4b4b31ad91050c090832992caa9f3b5b11f47922cf5d581c7b12ed40 perf-6.12.0-211.37.1.el10_2.x86_64.rpm 0e5144959b432cfdd3fa5134e29645931c14df3e657e8f8812c0ad208f381390 rtla-6.12.0-211.37.1.el10_2.x86_64.rpm 10b28a9ec82f8a634042be4d20f1196728d5165445b54b9e11b53fce88bcc2fc kernel-devel-6.12.0-211.37.1.el10_2.x86_64.rpm 167560a50c07311b2baf8fb65743c1e92a357d24a5dbcb75021b3842f73c727c python3-perf-6.12.0-211.37.1.el10_2.x86_64.rpm 6123a8669544d82db42f4e733460b1b445efe65d36a7db04655ef95df2c0c33d kernel-headers-6.12.0-211.37.1.el10_2.x86_64.rpm 7a0cea2eb286fca371dfef59ff168f164be02cfe6dee0c4aa7623caaf1c43bcb kernel-doc-6.12.0-211.37.1.el10_2.noarch.rpm 87d31242d05551914e981aae0b0f4d898f16e6999a0326758830d5c4a4582d3f kernel-debug-devel-6.12.0-211.37.1.el10_2.x86_64.rpm 9fad410375490cd50bd6dbd27680878fcc5df90ceb2c271c0bcceab65838c497 rv-6.12.0-211.37.1.el10_2.x86_64.rpm f4392a318be71b7c521faf36c0427ed8eecef8da46488b7373f74a6f4684beee ALSA-2026:43400 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default idm-pki-kra-11.9.0-4.el10_2.alma.1.noarch.rpm 0969cdaf908804a41b9168709166a69e8aa7ae8fcc2e747357080f04a1172f5e idm-pki-ca-11.9.0-4.el10_2.alma.1.noarch.rpm 0b735f0dd0d261caa3582e67de71f6261dbab4015274cff710fc04879b00b9e9 idm-pki-java-11.9.0-4.el10_2.alma.1.noarch.rpm 19db97d8c3e96b064b9b644b115703383e1a284592656856fb4c10b17f0ff783 idm-pki-base-11.9.0-4.el10_2.alma.1.noarch.rpm 2078148c1821766f42e07686376b4f47372e0d8d1f28117d64c14ecfa9c35ec2 idm-pki-acme-11.9.0-4.el10_2.alma.1.noarch.rpm 65f47e5c5837435369b77d7a6e0414cfd4e2ab76ac728e69b36043659fdf4ae8 python3-idm-pki-11.9.0-4.el10_2.alma.1.noarch.rpm 6e8938d303bc048889247d06f240b4f4e4629de2d3a8d8d05230791ef281e8a6 idm-pki-tools-11.9.0-4.el10_2.alma.1.x86_64.rpm 7cbfde5bd25d488bebfb2350e9a3af81af2bab3c24c36176722b712f93cd861c idm-pki-server-11.9.0-4.el10_2.alma.1.noarch.rpm b82532ebd593f44ece5bc792082777393864e54da71878f86dc5d3f9abd9a78a ALSA-2026:43505 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb-connector-c security update

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fix(es): * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mariadb-connector-c-devel-3.4.4-2.el10_2.x86_64.rpm 75f933315be1b942bc549f4a58fe37503da546739f317071de680c42210515d6 ALSA-2026:44270 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.38.1.el10_2.x86_64.rpm 02bb94c6c2c75ab4e73c8cbd73fb6919193685db090b9cc0ed6813bba77e2915 kernel-headers-6.12.0-211.38.1.el10_2.x86_64.rpm 4996ee3dc9484bde8def6a1fb2554649bc8bdad17d4fbfa25fa218f21699071a kernel-doc-6.12.0-211.38.1.el10_2.noarch.rpm 4a069b5675e58961c90a55b7563fc8b4cdfeb44341f929a948dd293d00bbc4cb rv-6.12.0-211.38.1.el10_2.x86_64.rpm 76b04689d7a87bad8c7759645ec2d0cb2481f8a7b6fe6baba034388e7e2ae735 kernel-devel-6.12.0-211.38.1.el10_2.x86_64.rpm 8e418c3916ff6a2b8b10e0a8a3d38e2e2360a8e1c3d301c67902bcb7671202ad perf-6.12.0-211.38.1.el10_2.x86_64.rpm 993fef9fa361dca7918fd58de4c6b2091529f99be2b29aa23cbc0454925f0ec0 kernel-debug-devel-6.12.0-211.38.1.el10_2.x86_64.rpm b51e6b7ed417544755a65a55b846d027e4ea1e2181affa69b77482b2e616be8f python3-perf-6.12.0-211.38.1.el10_2.x86_64.rpm b79cef448aee8a37c582b426c50e752909d2cb3cf9f1aa1061acfff3b47ee220 kernel-debug-devel-matched-6.12.0-211.38.1.el10_2.x86_64.rpm c1a2ee64bf67c86c0d231fe38fe920af7c47ccb9597791307792b100cd5d7691 rtla-6.12.0-211.38.1.el10_2.x86_64.rpm fdcfa7ec7919a79f0472e5cf77d42ef91626573f11e2aa9f9b2ad2f294839f84 ALSA-2026:44391 Copyright 2026 AlmaLinux OS 0 1 Important

libpq security update

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libpq-devel-16.14-1.el10_2.x86_64.rpm 4af8a5054ca7f053963513336a026a7707e6a6afb02e835df93c58bc508bce57 ALSA-2026:45114 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973) * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-perf-6.12.0-211.39.1.el10_2.x86_64.rpm 15718fc8eec78ca93dfba689cf5bfa0d1484b3e0d29a119eda99a6e71525b189 kernel-debug-devel-matched-6.12.0-211.39.1.el10_2.x86_64.rpm 2fa1e687f98f7bc8a6c33652f4fa4632ef67aad24f136c533fc6032a6b781d32 kernel-devel-matched-6.12.0-211.39.1.el10_2.x86_64.rpm 5304d2c2730857b8a77fb6caf98ef9107819f61f62e4ff8943aba6711637ef02 kernel-devel-6.12.0-211.39.1.el10_2.x86_64.rpm 5e3d21e1387338459e63abfb418cf87f3e1277415cbece1a6a1c1d9dc8234f12 perf-6.12.0-211.39.1.el10_2.x86_64.rpm 6196d3ea850667395be77738dc930ba2a5ec46bb57bc6bc62bb27714a000ead2 rv-6.12.0-211.39.1.el10_2.x86_64.rpm 775a4c46836ade993d5e3155a76fd3673dffce0fd96a99cf0292c9b2382418be rtla-6.12.0-211.39.1.el10_2.x86_64.rpm 8038531f81f679d55a4755933b0531d56ae0c6e6493a0dc008501db38f91a3ec kernel-debug-devel-6.12.0-211.39.1.el10_2.x86_64.rpm 82fe75e59f29b1c666b61088e354388add8b49c5311617b68190d1b65a66920d kernel-doc-6.12.0-211.39.1.el10_2.noarch.rpm bed818f0799b768ff6cfc2f657938405ca4fdd836ecda0511057e50c36a60fb4 kernel-headers-6.12.0-211.39.1.el10_2.x86_64.rpm c61b063496073b09566089b6ff69952c4cb96063e91c0ac27f95667bd81a676c ALSA-2026:46394 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fix(es): * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default go-fdo-client-1.0.0-4.el10_2.5.x86_64.rpm 1736d1f74d3b36dec4fd0e8fd1ab31d05bca3c5e5bce11dc17d5b29574ddb8a0 ALSA-2026:46395 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default go-fdo-server-owner-1.0.1-2.el10_2.3.noarch.rpm 8a1f12fb60dd6f709e8d044b6d020d14de7e6afbde8dda5848544a5e669cff85 go-fdo-server-1.0.1-2.el10_2.3.x86_64.rpm c4741acefad17150edccd0b74b13025d64dad7a36e1846c0552733a875d0a7c1 go-fdo-server-rendezvous-1.0.1-2.el10_2.3.noarch.rpm caf1db0da6a4940dc368733c9e45509fe9a782dd4331421e6ca8bcf1a5779321 go-fdo-server-manufacturer-1.0.1-2.el10_2.3.noarch.rpm cb7c2a74215550a5f2ce3d4355be09b754b0e502285caecb7e0f536ef2a0011f ALSA-2026:46398 Copyright 2026 AlmaLinux OS 0 1 Important

libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721) * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722) * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413) * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libreswan-minimal-5.3.2-1.el10_2.x86_64.rpm 26ef6b7f001b74cc7f6ccdacf0d0fde7139c4108dc1f47309a7b1f74b042ba37 libreswan-5.3.2-1.el10_2.x86_64.rpm cc5ba989c08a83cf5c519bb9d074d9817f70ad9330a922e71a7c9b35b5d4102c ALSA-2026:47017 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281) Bug Fix(es) and Enhancement(s): * rxrpc: Address CVE-2026-43500 [almalinux-10.2.z] (JIRA:AlmaLinux-178254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-headers-6.12.0-211.40.1.el10_2.x86_64.rpm 04f36fbc6a6e6888cc717618d1dc91fc3727c9d6d2d4694578be407c6e04873c kernel-debug-devel-matched-6.12.0-211.40.1.el10_2.x86_64.rpm 128d17bb83f51ce17930087e278dca8f4430e9346038c65b9153633959032395 kernel-devel-6.12.0-211.40.1.el10_2.x86_64.rpm 32a55a1bdc406a9531c6dc1992b8f1adae107d3ec633623beabd2cad92760ba4 kernel-debug-devel-6.12.0-211.40.1.el10_2.x86_64.rpm 338f331d0146f6081e192158f02af77da97f088c9a947626f95719ccd84cb241 kernel-doc-6.12.0-211.40.1.el10_2.noarch.rpm 3f33284f7c4ea3f56149f8190f4db9d0acabacfef1186c7aa7ad46d25395aa49 python3-perf-6.12.0-211.40.1.el10_2.x86_64.rpm 45bdc0121a05052f663b523a80bb49d3c1890ef160f4b87a5a7227e7982ece14 rv-6.12.0-211.40.1.el10_2.x86_64.rpm 824717cad39a5964ce5c3e92e02b6ced39be6de5083118e958b680468fae6335 perf-6.12.0-211.40.1.el10_2.x86_64.rpm 9a36a441fd37b23e36401ca514ca03724b32aa22b34f7c93cfdc2a15d461c7b8 rtla-6.12.0-211.40.1.el10_2.x86_64.rpm b172be661905eca2b154a9c9676be6012853fc32463ba497c4659fecaf0f6531 kernel-devel-matched-6.12.0-211.40.1.el10_2.x86_64.rpm f5a1c0db3c60ec5942cd9c4de36e68545b0020e0ae9c173a50cc72af3a348847 ALSA-2026:47079 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libXfont2-2.0.6-5.el10_2.1.x86_64.rpm 05b8b1826c668cf68f61b41facfbcce917d4c05abd9f719d1c831f6317a3e4c5 ALSA-2026:47083 Copyright 2026 AlmaLinux OS 0 1 Important

pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading (CVE-2026-5674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default pipewire-1.4.11-1.el10_2.x86_64.rpm 03d96d65a83a8e60f90ca7f3e5aec18e8de6eeb95366875c6ea2fd97764f9145 pipewire-alsa-1.4.11-1.el10_2.x86_64.rpm 0d4e01a0b1d05af33ab31edd22d2a33b6efa8ebd91b39558c36273f1c18f64d8 pipewire-jack-audio-connection-kit-1.4.11-1.el10_2.x86_64.rpm 2f8cab57dbb752710c603965bb9dbf0537dcaebeb3117edbca07d4e44d56c7f4 pipewire-jack-audio-connection-kit-devel-1.4.11-1.el10_2.x86_64.rpm 3baaab2c0a3cc6e18ff0f7b29b4dd1b266cc3a507b59ab5058be2c8b3133a4d6 pipewire-libs-1.4.11-1.el10_2.x86_64.rpm 43cd783704d0a4997e2f1ec8edafdb68141b6a7edb0942a7763efd1fba37d52b pipewire-devel-1.4.11-1.el10_2.x86_64.rpm 63576f726f09a365a74a052c95e1eb199b5500959544b73b7cf34326bc83b228 pipewire-plugin-libcamera-1.4.11-1.el10_2.x86_64.rpm 822798da898d086746c67500970b12971b41347905271efce18f1a35ec9f7b41 pipewire-jack-audio-connection-kit-libs-1.4.11-1.el10_2.x86_64.rpm 8c4e3c1f5579aa76dda519e377ca4b0123c8540fd99ff7da260f577a112a9674 pipewire-utils-1.4.11-1.el10_2.x86_64.rpm c618e9064789e2871233cbd2ea771d8180fa3bda5dba7b74596cbfbcaf066905 pipewire-module-x11-1.4.11-1.el10_2.x86_64.rpm e3bf3bf4c75e2ce8d1668ceea2e3c61645d563af67fb3631df09014053ac513b pipewire-pulseaudio-1.4.11-1.el10_2.x86_64.rpm f33fb76bff5ccf5494f5ba23f093ccd0ff362c29276650b97f02a2bd1b392d60 pipewire-gstreamer-1.4.11-1.el10_2.x86_64.rpm ffcdacb1b583a4c8f88ed92f4069489ab4d6027b6492880cbb49ee066ee2ae38 ALSA-2026:47085 Copyright 2026 AlmaLinux OS 0 1 Important

rest security update

The rest packages provide a library for access to the RESTful web services. Security Fix(es): * librest: weak random number generation in PKCE implementation (CVE-2026-16615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rest-0.9.1-11.el10_2.1.x86_64.rpm 12ee43f9d2770668d3d9b6989e851902f1a9eb8128a98a6519d47ce5dd6a8651 ALSA-2026:47101 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default firefox-140.13.0-1.el10_2.x86_64.rpm c8755869745a79c37569db040d573c6ac0868489a931ff08941ce0027a4696fd ALSA-2026:47180 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer (CVE-2026-59691) * gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback (CVE-2026-59692) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.6.x86_64.rpm 8dafe32aa06338a8bc9856ae08967d0e7d68ebfffdb740e4ce282eeb9af1943f gstreamer1-plugins-bad-free-1.26.7-2.el10_2.6.x86_64.rpm c6eafbb352a18d92c3d7e2c51eeaec9334a5f327a4fca4612f482ccc89c6b678 ALSA-2026:47757 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenSSH client versions (CVE-2026-55655) * openssh: Double free in AlmaLinux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653) * openssh: Heap out-of-bounds read in AlmaLinux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654) * openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002) * openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy (CVE-2026-59996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssh-askpass-9.9p1-25.el10_2.alma.1.x86_64.rpm 336ff98f6c201a89486b329c5ce6f465eaa8a058c352939c7db857e02881e063 openssh-keysign-9.9p1-25.el10_2.alma.1.x86_64.rpm c83bdd726572a79dcfeff702c19c24f52fde806dc630aa5939bb3ff7f4370cc6 ALSA-2026:48032 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm bbd3e0be33345b40f7140ed617b9d6ac035fa7d714eef964005b4f634524f37c ALSA-2026:48033 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs-docs-22.23.1-4.el10_2.noarch.rpm 4a83c12224f35412b6625e9741ade14adf2898f3deb3cc76c129e06984205bf2 ALSA-2026:48034 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs24-devel-24.18.0-3.el10_2.x86_64.rpm 283dd9c7663558278b2463680bab4fff82a913418f83ba3967cc2cb496713f83 nodejs24-24.18.0-3.el10_2.x86_64.rpm 807b715a991353b9a867694e25ec3aa2e028d4dab148393505b98444327dfdc0 nodejs24-docs-24.18.0-3.el10_2.noarch.rpm 89066bd3e4a424f6060b375e6c02c05394b0753a9457c3f2bea0b8ca3a7ef097 nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm a0d67f6698a66c5d36c8a723a620bfc3e7512941af628d160a75f70e47142745 nodejs24-full-i18n-24.18.0-3.el10_2.x86_64.rpm dd1e7a800d4c964db6b329e68174eda0300a3d2b4fd05a380df1893c5c776fee nodejs24-libs-24.18.0-3.el10_2.x86_64.rpm e7536800c3441786c05e1a892fadd38c240fc63594964892e3129c54adaaaae4 ALSA-2026:48170 Copyright 2026 AlmaLinux OS 0 1 Low

php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default php-soap-8.3.32-1.el10_2.x86_64.rpm 014ff38ff4781cdaeea97ac95791f7658568a3db18a76e90c54526389b7086c0 php-gd-8.3.32-1.el10_2.x86_64.rpm 0d1ea842fe02fad661ed7c76cc20637706c9278066aa7935bf47fe8f8b86dbf0 php-gmp-8.3.32-1.el10_2.x86_64.rpm 19ab3862b0b100722cd8ce8c755bd699bb0943c8e4bc0e9ab58519b6cb9ce56c php-8.3.32-1.el10_2.x86_64.rpm 3491db15ad0ae4a0d79833c0f2b1af461a0286ac4bf7904c8874a9861e24adef php-process-8.3.32-1.el10_2.x86_64.rpm 425efd75232066ea0f39695ebd11192a2b8da69e78410e411ee2e458a2bea460 php-bcmath-8.3.32-1.el10_2.x86_64.rpm 4351266a814ad2202948c6083243b32b30fe5b3cbde13c04a0d755f531ce890f php-odbc-8.3.32-1.el10_2.x86_64.rpm 51daac5ffd80ccf26cfeab05773a879a035f4644b154ed6091c54fb1822bfbd3 php-snmp-8.3.32-1.el10_2.x86_64.rpm 654276431771e3b93071dbdbb7115f6357ff3804ae6358f1f0f52e376ddcaf45 php-fpm-8.3.32-1.el10_2.x86_64.rpm 6941929af6d517c541e101748b701ecb0cdeb8c18d26aa6a9ca4b328f00e9763 php-enchant-8.3.32-1.el10_2.x86_64.rpm 69564ff28f30894f82a1ab9b7140788d167d359a11c56ca71bb7bae162775ae2 php-intl-8.3.32-1.el10_2.x86_64.rpm 6e8d7c374ab0d55d79ff57727921094034ff60693543c86f622b14ec3975f8d2 php-cli-8.3.32-1.el10_2.x86_64.rpm 844e592dbd4847f330f9f37e833113501e7cf03164f2716e46784669431daabd php-dbg-8.3.32-1.el10_2.x86_64.rpm 855edbbe3affb2dc5691be050d310f3de0aeb6cf08a9677b5afc2ef57dd904b3 php-devel-8.3.32-1.el10_2.x86_64.rpm 8aeaa446e53699f95e45c36bb62d7fc1479666df0ab132f6aaa8035e7c3f8f6c php-pgsql-8.3.32-1.el10_2.x86_64.rpm 8e4dc7b3f5b7a38889583e723817a763bda44b965ece1b1491438d3ed435c3db php-mbstring-8.3.32-1.el10_2.x86_64.rpm 8f535891bc35bd55c89fb84e5647f23b25c2f2857d0865403e6030eeca9c19f0 php-ffi-8.3.32-1.el10_2.x86_64.rpm ae42c2d0ff4a111696e66ab7260e7597d06665dd53329a40bb891b06e76f95fa php-opcache-8.3.32-1.el10_2.x86_64.rpm b13c92718326f7e5ff9a84b3106593977175078fc1b0dc3578d1d5940ec308ad php-ldap-8.3.32-1.el10_2.x86_64.rpm b8e729596bcfa337389a39549d5c901234f69b22684700aa971b739474d68271 php-embedded-8.3.32-1.el10_2.x86_64.rpm c5d7d8f4b2feb98061682e805216df17803623b2a322d7091763a346797a5d43 php-common-8.3.32-1.el10_2.x86_64.rpm d82eab46746df436111478cbfc1cd607de4a5d5b07f54f3b0708d1e466f810a6 php-mysqlnd-8.3.32-1.el10_2.x86_64.rpm ddf57578e7f00fd118c20b7a4e52816e8df5f56c4ea047ab8ba2ac77fb654bef php-dba-8.3.32-1.el10_2.x86_64.rpm e174cbe820c566113fe90a3eb90db5934e81b14ed27c780fd787920cd9b0e6a3 php-pdo-8.3.32-1.el10_2.x86_64.rpm f9df484a85a89fca6ee4496db227ea9b025179bc88a8b42a702061850a6b1d4d php-xml-8.3.32-1.el10_2.x86_64.rpm fc6dcfd72daf987bdbd10681ce9a93ed9aeabaccfbe693836f5398f2d0884405 ALSA-2026:48585 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default fence-agents-scsi-4.16.0-21.el10_2.5.noarch.rpm 02a9562b78a8a24d7e333970efbc532e24161062499846a84fe75f07c16df2e2 fence-agents-cisco-mds-4.16.0-21.el10_2.5.noarch.rpm 0585c3e9f38920e515019f74ebdb69e2987cda9c3fc8f55553b0d5b46a04667e fence-agents-ifmib-4.16.0-21.el10_2.5.noarch.rpm 079ef24bb4d641ff4713ab43de2a354ad8dc7350f764f31380313fb52bb8e396 fence-agents-eaton-snmp-4.16.0-21.el10_2.5.noarch.rpm 089facbd88cf4480c948daef5080d8a4e863f876af741e894953a052c18472f1 fence-agents-azure-arm-4.16.0-21.el10_2.5.x86_64.rpm 0d6f95df67b86c312a9e5e1a1a47872a0c477a5970fcf98029e9f62392230844 fence-agents-apc-snmp-4.16.0-21.el10_2.5.noarch.rpm 0ed42a2237e32de2ee788e8d1ce0205de2e3e3668fe8621b0454862360f4cae9 fence-agents-virsh-4.16.0-21.el10_2.5.noarch.rpm 0fbe596f99db8f892c67c85f7cca46ccd883667a63ee6aa5c0a06fc771d1546a fence-agents-all-4.16.0-21.el10_2.5.x86_64.rpm 1916af3a3ed479f45a031e989b2e8917f9467399f07897f8afe460506f88b583 fence-agents-rsa-4.16.0-21.el10_2.5.noarch.rpm 1af89745129e72d3cf10835d0b18dc20f4fbb3c87def696fa64d2677f26078eb fence-agents-rsb-4.16.0-21.el10_2.5.noarch.rpm 205874c6618128431f134d578571738ee9368d524e16f9991bf507a48a1fc4af fence-agents-wti-4.16.0-21.el10_2.5.noarch.rpm 2ac50c4183e12154477c90ad233354a1b426ce6ada8318cd9ff1c95783d0a6e9 fence-agents-ilo-moonshot-4.16.0-21.el10_2.5.noarch.rpm 33a6033ef28cbf57fe6ae177ba899bee9efa2586458cfc9f4b17d8816f4852e9 fence-agents-aliyun-4.16.0-21.el10_2.5.x86_64.rpm 381b84fd629e745a5142d0763f099f8d265024d8976c73be449a124b12e5c3ac fence-virt-4.16.0-21.el10_2.5.x86_64.rpm 38cc11def034868bb37435710045b49764737bc58aeb12c257795cb037976ba4 fence-agents-sbd-4.16.0-21.el10_2.5.noarch.rpm 393ba16d2124e745058334be1a9ea19466f1ea2ed79be749f9534c0eb2eae3a0 fence-agents-ilo-ssh-4.16.0-21.el10_2.5.noarch.rpm 3b06b3b6370f1542f6c561b830148802a761f1a54cced27f5b897bc72bbf000c fence-agents-redfish-4.16.0-21.el10_2.5.x86_64.rpm 42141b7e25476d2a78b01e5fa8c1912714b2d264903b3e7aca6395d6113d35fd fence-agents-bladecenter-4.16.0-21.el10_2.5.noarch.rpm 43be7813f12ea8487c7144e058efdca667f8ee63e3b8fb3688b1ee768242c4db fence-virtd-cpg-4.16.0-21.el10_2.5.x86_64.rpm 4868e1eafd693a4d1a78458f20d45c8aa4d40d33aa04170c1beb0f8b0952c154 fence-agents-amt-ws-4.16.0-21.el10_2.5.noarch.rpm 4f4f9455dc2124c09068d3955018c52d59c5e5787e20c74b56664df7585682b8 fence-agents-brocade-4.16.0-21.el10_2.5.noarch.rpm 512d3a91950b1d4aba9d521f1b1298cb5281a94cc741007163fdefa3ff9c6d6b ha-cloud-support-4.16.0-21.el10_2.5.x86_64.rpm 5aed99cfabbcbd5557c53ab2a75e7412d39a2e577d6dd00036d718b5307eae91 fence-virtd-serial-4.16.0-21.el10_2.5.x86_64.rpm 62450f812de6d82d560d633c59582f1ec0d81352322bb1119e36ceedb92f54c7 fence-agents-mpath-4.16.0-21.el10_2.5.noarch.rpm 63316b6226135353f691c6e8611077a5d55c61e96e1bbd2f0feae1ef1156055f fence-agents-eps-4.16.0-21.el10_2.5.noarch.rpm 70805cb3186ce3b83c61dd6a92392e10e2269d97bb12901831a705caa2e13e67 fence-agents-ibm-powervs-4.16.0-21.el10_2.5.noarch.rpm 769c27a5bdf674e7ae7d3e284ca2ef59c325032952f687138b4de3eb49bbf684 fence-agents-ibmblade-4.16.0-21.el10_2.5.noarch.rpm 7d422de49cf099ef097c46e463774d835a7a6341739f62bf21f362bf0369b424 fence-agents-hpblade-4.16.0-21.el10_2.5.noarch.rpm 89fef3d43f7585019392d0dc5d961f1c4648edbad79329024e184b6e229a1f31 fence-agents-lpar-4.16.0-21.el10_2.5.noarch.rpm 91ae58cf021e245e1a1bf1024c70c1f559915400b560633a3068c117a652dbec fence-agents-cisco-ucs-4.16.0-21.el10_2.5.noarch.rpm 9380d9758dfd4d1453e71e86b6de038363038a4d33fa19c298d368038b30f2cd fence-agents-vmware-soap-4.16.0-21.el10_2.5.noarch.rpm 998f6222b512104dd6ebeef7539b27e306dc5fcfa10ff8331e8975e680821aff fence-agents-heuristics-ping-4.16.0-21.el10_2.5.noarch.rpm 9a5a0dc003e77f5a9ea108f92a622c5d6976e36a844c4b748e069257b31f1021 fence-agents-kubevirt-4.16.0-21.el10_2.5.x86_64.rpm a3ac0a4f88847fc2e61895699e1543203163bd8d09551492ddedd9cb399dfc99 fence-virtd-4.16.0-21.el10_2.5.x86_64.rpm a4fd3345fafe0eec61619670648dd11cc7a57ddad759a5151c9a10355f3bcd57 fence-agents-kdump-4.16.0-21.el10_2.5.x86_64.rpm ada69df744f7c02ffe3d8929c0b6e1d82b80eed80e1e8716e4ec1a05af616837 fence-agents-intelmodular-4.16.0-21.el10_2.5.noarch.rpm af75659dc64c53a891fd4636e3b0602ad519684579d5271ea03c01a7caa278b2 fence-virtd-multicast-4.16.0-21.el10_2.5.x86_64.rpm b20626e6fea678715cc301e967b6e4888fa07e4f973d9d3c2ddbe84315afcc3d fence-agents-emerson-4.16.0-21.el10_2.5.noarch.rpm b3ba20e516f6f7d2812656bf61775f98e42e342544de7b9ed01aa80028d7e454 fence-agents-vmware-rest-4.16.0-21.el10_2.5.noarch.rpm bc1b3776aff2e7d3bbe29a17599074c9bf396e5e1b77fe5ab1defede6847358b fence-agents-apc-4.16.0-21.el10_2.5.noarch.rpm bec0c532edc9657fca3d85daa3a0597c46af622904928c2339a37f0adf7ed7ce fence-agents-nutanix-ahv-4.16.0-21.el10_2.5.noarch.rpm c009350e071848c015df98437c80cab01c9ca98f0801415e0e5a445ee998c502 fence-virtd-libvirt-4.16.0-21.el10_2.5.x86_64.rpm c23b280c6d0fa05f629935e7f1295649330a3f4cbf73276c5c1f231128a21610 fence-agents-rhevm-4.16.0-21.el10_2.5.noarch.rpm c41641cbe4507b116bd310318f52a3d80536a50089c6df7dca2a11a7a759457c fence-agents-drac5-4.16.0-21.el10_2.5.noarch.rpm c72dc94ebe3471be09580a457d1e65fd832107047626548b5bfb15a04b9060dc fence-agents-ipmilan-4.16.0-21.el10_2.5.noarch.rpm cc3c20cef2b889d5204bd8db41430e7e4147d375fba2c598f1d7f4ae9a00fd26 fence-agents-common-4.16.0-21.el10_2.5.x86_64.rpm ccedaae68b1896b9c172245f4a3a7bd8cef46e786e425e35db8134cf6c05b059 fence-virtd-tcp-4.16.0-21.el10_2.5.x86_64.rpm d129dfcd07e59635770f0f8d53a670a9ff887d7d0f8b12fe0c5e0d4f449dd9ed fence-agents-openstack-4.16.0-21.el10_2.5.x86_64.rpm e251e2eff3eb8884125d04d749c02f4e8e9ce16bb844f4ec1a329138268a532c fence-agents-ilo2-4.16.0-21.el10_2.5.noarch.rpm eb84f77d4c349914d249a21e99b260421c5f9152deb8ab4f6aefcad2c4b71e68 fence-agents-ilo-mp-4.16.0-21.el10_2.5.noarch.rpm eeb9b2bc6cde8b87c3ec4e65ba4ab628d789e89f6bb675f9de06ddff240c830a fence-agents-gce-4.16.0-21.el10_2.5.x86_64.rpm f565fbb26c13ff5a8746a7425df1c749ad7f5d695d70fcb37d8fe72ab2d78e58 fence-agents-ibm-vpc-4.16.0-21.el10_2.5.noarch.rpm f902c8e652433f804325f4d993ebdaaa7d96b4806e8da803c04d74fd44eb47e5 fence-agents-ipdu-4.16.0-21.el10_2.5.noarch.rpm fc9de80e97011d49b8861f131eb3794c92c566c1c4502d917365892d71a8bb61 fence-agents-aws-4.16.0-21.el10_2.5.x86_64.rpm fdd37a65d490b3f018493ac7d3846449b1eb5d52f956d14361eeb7e0bf074184 ALSA-2026:48650 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default vim-enhanced-9.1.083-9.el10_2.12.x86_64.rpm 17c023366cd6bc85c91bedb173ba097d25bc368933d82052e0af27e33f4ef636 vim-X11-9.1.083-9.el10_2.12.x86_64.rpm 3b910f034b00e32c34d6870e7599809968782a0eae1657ec8ef9251309eb1dad xxd-9.1.083-9.el10_2.12.x86_64.rpm 65c811aa17f4e86867265c69086a26b4649dd3e4a55e0c027d818ca911b64f08 vim-common-9.1.083-9.el10_2.12.x86_64.rpm dd50411d3d69e3bf6cc28f3b184a6ceb62e24cd70c0f6583ce8a67d66887cd85 ALSA-2026:49211 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () Bug Fix(es) and Enhancement(s): * [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [almalinux-10.2.z] (JIRA:AlmaLinux-185669) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-10.2.z] (JIRA:AlmaLinux-212063) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-headers-6.12.0-211.42.1.el10_2.x86_64.rpm 094e235bcc181354957cc5109406aac9b303f696c5a50a54ac331a6b51b0135f kernel-devel-6.12.0-211.42.1.el10_2.x86_64.rpm 22f47cb421884e7628160872177b79e8a524816cd21370671c0799980c181c3d perf-6.12.0-211.42.1.el10_2.x86_64.rpm 387bc58fab6d365875b00255d492f6ce3c46b840252175d8714de5ebe0507e72 rv-6.12.0-211.42.1.el10_2.x86_64.rpm 8879b869b2741e729e189f0fba188592793196a525b23ded497f7224026fe1c7 kernel-debug-devel-6.12.0-211.42.1.el10_2.x86_64.rpm 9741e69280f8ad10b23c7dbac16c304ce5a959dee3f7c06dc5e0e34c097033a1 kernel-debug-devel-matched-6.12.0-211.42.1.el10_2.x86_64.rpm ae0e9a2f9c09e8ade716c4bd632b0e9163e984ad1dd0e726e410ebdb09642491 kernel-devel-matched-6.12.0-211.42.1.el10_2.x86_64.rpm b03cc5bef2ab9c405f962f49412382dc178d8494c389437db04d61fc180c32a7 kernel-doc-6.12.0-211.42.1.el10_2.noarch.rpm bf419056c1f25a425baf0071c6b140681f7a5be5fb6970d09bdaddba8a9d6353 rtla-6.12.0-211.42.1.el10_2.x86_64.rpm eff2da86badada1afd81c1c5dc2a2ca0a4dfddc4fe2501121c36f79ee6deabc2 python3-perf-6.12.0-211.42.1.el10_2.x86_64.rpm f91d6d11ad4a1cf0990c26942fc901db8d395c1adf9fd34640b25441d83250be ALSA-2026:49508 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux (CVE-2026-5056) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.2.x86_64.rpm f52b5e69379ef422951c16f1588b32e40b054d2fe26248c919f2b188be66f27d gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.2.x86_64.rpm f6e5a2531825de6484faa52637efcd3076f732fa22788772d560d8d8081c7fce ALSA-2026:49514 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380) * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.3.x86_64.rpm b9400ee4244979256c910ac7980fecf9d0d3617f6785b7033b7124a7691a8c33 ALSA-2026:49523 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files. Security Fix(es): * perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size (CVE-2026-9538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-Archive-Tar-3.02-512.el10_2.2.noarch.rpm d2c6df33777b5bff8ce63f4a073d414a7c9afac6e1da152d7b5a41393951e548 ALSA-2026:49526 Copyright 2026 AlmaLinux OS 0 1 Important

osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default osbuild-composer-165.1-3.el10_2.1.alma.3.x86_64.rpm 03c79859705becd4ad705e747c6201c560b0bf31fae92624f9886fbe5134d974 osbuild-composer-core-165.1-3.el10_2.1.alma.3.x86_64.rpm c94f2c184912df1ffff1e4038b79a10868bd546914f84b38fbdbfd5b18311d50 osbuild-composer-worker-165.1-3.el10_2.1.alma.3.x86_64.rpm eb4c7cfebb17f8dfa298823849f9432a320b2797befd4fb6ee82cc6d6a4a24e9 ALSA-2026:49621 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default thunderbird-140.13.0-1.el10_2.alma.1.x86_64.rpm a3ad73d07ab70c94e4b4bc7e590fa6b99f76578e14a370c2ca998c56ebce0353 ALSA-2026:49668 Copyright 2026 AlmaLinux OS 0 1 Moderate

p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files. Security Fix(es): * p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing (CVE-2026-13757) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default p11-kit-server-0.26.4-1.el10_2.x86_64.rpm 0b877842e6d5f34d2c8638a272af52e7431fa9e7753576bfd56743508e6a6d4f p11-kit-devel-0.26.4-1.el10_2.x86_64.rpm bbbca6d78b2541b2a3ef0ce171fada35b63dcd08ae6f2c71130fbacf4b791c7f ALSA-2026:49836 Copyright 2026 AlmaLinux OS 0 1 Important

ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets. Security Fix(es): * ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ldns-1.8.3-18.el10_2.1.x86_64.rpm aaf262d398ae7c8ca25ad0e90a499742d53dc751a4ba1cba04467145d9d14df6 ALSA-2026:49871 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214) * kernel: procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199) Bug Fix(es) and Enhancement(s): * [Lenovo] Graphics not working on T14 G7 Intel (Pantherlake) (JIRA:AlmaLinux-172832) * Possible regression with FM350GL [almalinux-10.2.z] (JIRA:AlmaLinux-184266) * [10.2 FEAT] CNB102: dpll: sync with upstream (JIRA:AlmaLinux-211011) * backport make module and modules-core provides use variant [almalinux-10.2.z] (JIRA:AlmaLinux-213965) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-headers-6.12.0-211.43.1.el10_2.x86_64.rpm 1bd65a5b07fbb331bd3f4d872cebad6e4c8ba8f7bf33193b7754d4440b4ae7d5 kernel-doc-6.12.0-211.43.1.el10_2.noarch.rpm 1c74553d75296b52e5083e8873de03e04a8574cf085839e5ac3f4e2003a287ca kernel-debug-devel-6.12.0-211.43.1.el10_2.x86_64.rpm 257ac5a50a76f57c032d8199bb695614be1b31d016ccf8f3b9ccd6f962fe209d rv-6.12.0-211.43.1.el10_2.x86_64.rpm 260868c5e84840daf23496061065595485f18c761b897193ec013123d6d72c68 kernel-devel-matched-6.12.0-211.43.1.el10_2.x86_64.rpm 66d44911f8a189d677d1fd60a5b1cf0b9cb389357b338f0c965a80a2993b11b6 kernel-debug-devel-matched-6.12.0-211.43.1.el10_2.x86_64.rpm 70c90188d7d4ccff2b7f8eb10580504a6ffa6615a0019db6f36d3a155ba3a5f2 python3-perf-6.12.0-211.43.1.el10_2.x86_64.rpm 92439475010808f0c3e44c069fada818d1b0996fab41487fa9d100575325864a perf-6.12.0-211.43.1.el10_2.x86_64.rpm 999be8a561f1890a3ef81583968c7eff9b6aab07e4e0c921b33c031900635681 kernel-devel-6.12.0-211.43.1.el10_2.x86_64.rpm e517605a7915efe32b70c2b326eb294f7f0b5779be91bb2f265d3cc66b680aef rtla-6.12.0-211.43.1.el10_2.x86_64.rpm ef55741efc319703be2a39ae59887fff5dc414c038cc4135e4c00bae02e7d63c ALSA-2026:49914 Copyright 2026 AlmaLinux OS 0 1 Low

php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.4.23 for CVE-2026-14355 in 10.2.z (JIRA:AlmaLinux-192616) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default php8.4-odbc-8.4.23-1.el10_2.x86_64.rpm 079531e014c85ba84628d9a5c64b7da59edc1f6c776b37cd6905d0c1763048e3 php8.4-dbg-8.4.23-1.el10_2.x86_64.rpm 2305fb5ea44aaea5eb54d914e435e8daabff649794796e404c24f5dc4e4b0636 php8.4-ldap-8.4.23-1.el10_2.x86_64.rpm 242c7053fb00ac432def6cec2cf6fc9af1973803fca70f9f065c7941f4e9066c php8.4-cli-8.4.23-1.el10_2.x86_64.rpm 28f45d28851b6053bc924f68af6f21b560edaae9f193b87f8b599b621b41b02f php8.4-enchant-8.4.23-1.el10_2.x86_64.rpm 3e21d5a40bc77042ad53d6cb8198130079776ec2e6d66cbd02505d596059e5e3 php8.4-mysqlnd-8.4.23-1.el10_2.x86_64.rpm 4102c724ad7070d28d1487417b49335f30eb89c509a33d22430f3d6de63728f9 php8.4-ffi-8.4.23-1.el10_2.x86_64.rpm 456d06a50b8f0dfb7c814e6deee483ffb28a08209d219c04a7a41bf2287f0f03 php8.4-pgsql-8.4.23-1.el10_2.x86_64.rpm 4c6bb63c7516db61e911a300839e397cd7557d1d35ed22cf42305aaae65ae763 php8.4-process-8.4.23-1.el10_2.x86_64.rpm 536de05ee12670fa5f3f22088d5365af11ef19de6b224ddd2413425f2d977ca2 php8.4-opcache-8.4.23-1.el10_2.x86_64.rpm 54a3b122fcd114da98efbf28c4cffb15c6a42cdec5224554d635150df98a9450 php8.4-fpm-8.4.23-1.el10_2.x86_64.rpm 5d1989b7958b76523cc511711ee25a2a21b9fb5001cdfa7b6ff98ef893b95895 php8.4-pdo-8.4.23-1.el10_2.x86_64.rpm 7d9d133ec8fc5b57492c66fca8865fda742256c6a65a173c66065c157675ca89 php8.4-8.4.23-1.el10_2.x86_64.rpm 82d8160a436b29dc421ce7081704ead2b291039f3657e4313aadabafc24ea7e9 php8.4-soap-8.4.23-1.el10_2.x86_64.rpm 85a879a926de3d2c0da8373dc44aa6e7f327ee5696707fdc159cafdd62849ae6 php8.4-bcmath-8.4.23-1.el10_2.x86_64.rpm 97e1bbaee5ace4a0e5b5370ae66a6d9481f51fbd9a35682f3b401ae38129fa98 php8.4-intl-8.4.23-1.el10_2.x86_64.rpm 97e2369522a6b6b8a72292dce202831f9ddc95522dd555792c7310e9dfefe63c php8.4-devel-8.4.23-1.el10_2.x86_64.rpm c179ce33f97016a6ae9cdfa8245fd8b5f2d22759db5a667ba4b3c15e9ab55a0e php8.4-gd-8.4.23-1.el10_2.x86_64.rpm cc85eef6cdc7e904363c44868f99e2e35e4b650ee809b4552d42e65089f24c2e php8.4-common-8.4.23-1.el10_2.x86_64.rpm ce902c10d5881f540d7674cf7027b67ac61e8687bfa727f5f247498d2ebeca32 php8.4-dba-8.4.23-1.el10_2.x86_64.rpm dbdc2ffad37493616858ab9eed806d85d6421cdf579f4421d61c85a651cd9463 php8.4-embedded-8.4.23-1.el10_2.x86_64.rpm e745b7d401695f56c665f1a30dd5f9f2b578f13387992f3fdfbc26313fc6296b php8.4-gmp-8.4.23-1.el10_2.x86_64.rpm ec7f6a0f1655678958f1aae174546f54c77024eaf868b5bab25af3b9e49b787f php8.4-snmp-8.4.23-1.el10_2.x86_64.rpm f0d0fe674d186f56f8f9d25f5246d81c3b9514c9e03ef6e949e578419e9ddd32 php8.4-mbstring-8.4.23-1.el10_2.x86_64.rpm f43e3ccc2838b7a5816cf595aa39667a10fa17ba9c34f6c640a4f11bb049ea1c php8.4-xml-8.4.23-1.el10_2.x86_64.rpm f5da7f4c78ec84ed0a94063bbf9b7834da94319e09656a25013a4842dd80568f ALSA-2026:50144 Copyright 2026 AlmaLinux OS 0 1 Moderate

libgcrypt security update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix(es): * Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libgcrypt-devel-1.11.0-7.el10_2.x86_64.rpm 2a85adccba5a8a157cfc432c791afb19901444160d0832a800a108d059e384a9 ALSA-2026:50747 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding (CVE-2026-55827) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.7.x86_64.rpm 483fd0bc70a23a21bdb34d3434765ae874b07e4514b6239357511d85ff2a7129 freerdp-libs-3.10.3-12.el10_2.7.x86_64.rpm aa01db52a97d0c7ecd6c8ca75747028de58ed3605cf0fb1f53b0f6b741642bb3 libwinpr-3.10.3-12.el10_2.7.x86_64.rpm c55998d0ca254f7182ffe4dbcd19f1781f695d8c5470d200c0c715dea836e4fd ALSA-2026:50773 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security, bug fix, and enhancement update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241) Bug Fix(es) and Enhancement(s): * ruby4.0: Rebase to the latest Ruby 4.0 release [almalinux-10.2.z] (JIRA:AlmaLinux-211310) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ruby4.0-devel-4.0.6-36.el10_2.x86_64.rpm 1b6f7612cd4c85f98cafd38f23490ca0c9f4d2b117d496cfd2932c29d137fbb6 ruby4.0-rubygem-pg-1.6.3-36.el10_2.x86_64.rpm 7572d0c5321d743cac743887a9b8e41c8a5051f1dd06756bec54c245a5ad5b1b ruby4.0-4.0.6-36.el10_2.x86_64.rpm 8d8ae3060a31e87b34cc885350a915503a51481081fe066badfc258272c82675 ruby4.0-rubygem-mysql2-0.5.7-36.el10_2.x86_64.rpm 96e03642b2598591ece6f388230a877427ad5b6c9da80aa14b691039418dfc73 ALSA-2026:50778 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241) Bug Fix(es) and Enhancement(s): * ruby: Rebase to the latest Ruby 3.3 release [almalinux-10.2.z] (JIRA:AlmaLinux-211300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rubygem-test-unit-3.6.1-14.el10_2.noarch.rpm 131dd8cdd912467ba1f8827ee2132e59e97772a0a19a34d30dd7839e793b2109 rubygem-minitest-5.20.0-14.el10_2.noarch.rpm 21c1889fe2fe8b665fd8d07927f509fe6feeaf78754ab805c15679497e55be47 rubygem-bundler-2.5.22-14.el10_2.noarch.rpm 2351acfc5df3fcc5dde89c2945b1b2c2f82584566adf5020e0254e7f592cfebb rubygem-rbs-3.4.0-14.el10_2.x86_64.rpm 271e03faa4972f51c9096418f1d00d28c31905e57f6f3dc99a650d141026a397 rubygem-io-console-0.7.1-14.el10_2.x86_64.rpm 29c3ac06c75545f0190dd6010bce047af5d414498afe837ddc21cd0dea9f5c59 ruby-bundled-gems-3.3.12-14.el10_2.x86_64.rpm 30cc78468dda28d09cfd0d7244ef5148ec2abbabda829519f5146fa2fc054890 rubygem-psych-5.1.2-14.el10_2.x86_64.rpm 340eae976ffaea5caa9924b9461a2471b3fa9dbdea16150a04319b98afe175f8 rubygem-irb-1.13.1-14.el10_2.noarch.rpm 46613819af1fb9478b0e629651c46aa11e4464bb5c9cffee7e759d6786dec0bc rubygem-rdoc-6.6.3.1-14.el10_2.noarch.rpm 5c00d2550ead68020d3187766315cf476e673c256a3075d89c40e6868434b24e ruby-libs-3.3.12-14.el10_2.x86_64.rpm 71b3954f80bc6f6621f667e2adeae9d9e36c8d81d54deb5d1e550e617fa956e0 rubygem-racc-1.7.3-14.el10_2.x86_64.rpm 72850c595224935bdc4bcb47a4bc4a6e67c9ec2b78013901c146100440a2372d rubygem-rexml-3.4.4-14.el10_2.noarch.rpm 797e9b5def067ed1b4a076e585bd427d2faa3fa20db74f61c349ce54a17001bc rubygems-devel-3.5.22-14.el10_2.noarch.rpm 7e994cc7820f22d4c3173560806e49845622523b1b6813aaaf17a3274d4dd035 ruby-3.3.12-14.el10_2.x86_64.rpm 8379e4f4a2158e2f054665e0eb9c22ad4d6a4dbe61aa68481aa879684fd9f4fc rubygem-rake-13.1.0-14.el10_2.noarch.rpm c53bb678682a61e82cacd04f0a3d4f33c0e1d8dcad90c1eefd2d5de20caafebf rubygem-bigdecimal-3.1.5-14.el10_2.x86_64.rpm dc773ed99f804177928f57108bb1d3323cea2c79836553b7a9c41af20354ebce rubygem-json-2.7.2-14.el10_2.x86_64.rpm e1d901636880f1e8cd8726da9b517d42d4385260af195e61cd4d8e053653be4e ruby-devel-3.3.12-14.el10_2.x86_64.rpm e423e6367dc4f60a6eba721cb7a74f6ea13e3fa92dd9091d0ae51ad20812f72c rubygems-3.5.22-14.el10_2.noarch.rpm e614c319dddb353036831b3163c6c76c806a302b2d1b420f110dc3ac9779a8bd rubygem-rss-0.3.1-14.el10_2.noarch.rpm edcf8a577a06115a59a8a5e4d7f017b389372a4f7da251061524db691c1b5132 ruby-default-gems-3.3.12-14.el10_2.noarch.rpm eee30784ab9187664bab88713a780f0e03173777cb24eeeb2c65f08854146ff3 rubygem-power_assert-2.0.3-14.el10_2.noarch.rpm f635633eb2dfd48b67a65aa9e6a82eadfada6bc616d85081cdf4cc5bf73f08e4 rubygem-typeprof-0.21.9-14.el10_2.noarch.rpm f76ebecc0e4d4bec6ed47f476de014cea992d3b11812f607afaed01950bc5dc6 ALSA-2026:51075 Copyright 2026 AlmaLinux OS 0 1 Important

gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See <https://access.AlmaLinux.com/support/policy/gpsd-support> for more details. Security Fix(es): * gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution (CVE-2026-58459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gpsd-3.26.1-3.el10_2.1.x86_64.rpm 1451ce3c7b64bdeba2bca3fdc5ee940f0b458c647dea0b33908374e7d716e086 gpsd-clients-3.26.1-3.el10_2.1.x86_64.rpm 5b5ae0474e58ba50febb11f92a065f413628ade99187a7a8d8499c61464189ce python3-gpsd-3.26.1-3.el10_2.1.x86_64.rpm 7a4076d4a9f0c4f02ae7e30da4459cfc0671cad0738d64c5e1a5c5ab272ef8a5 ALSA-2026:51295 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CVE-2026-43186) Bug Fix(es) and Enhancement(s): * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-10.2.z] (JIRA:AlmaLinux-186345) * ice: driver update 2026-06, part 2 [almalinux-10.2.z] (JIRA:AlmaLinux-193134) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-doc-6.12.0-211.44.1.el10_2.noarch.rpm 1c4aade5d5fb516248eb660f2819523377e9feca8b77c696901ba628dcc0602a kernel-devel-6.12.0-211.44.1.el10_2.x86_64.rpm 3a80515921fbb29933ff578c7d00c0291bec6f8bd12d83aa45f3aef61a23d290 kernel-devel-matched-6.12.0-211.44.1.el10_2.x86_64.rpm 4fb8f3c592b52b4c23d596417fb182cca01ceab4c02887b52bf1f688022e586b kernel-debug-devel-matched-6.12.0-211.44.1.el10_2.x86_64.rpm 58c4ae4c2fcc0cf687c4a47ed4caefd39b38a68600e8867d4a37fbc0ffea591b kernel-debug-devel-6.12.0-211.44.1.el10_2.x86_64.rpm 689913615789c919f637383a5c7c4b529407361179302f93152bdc9ab1ee4e03 python3-perf-6.12.0-211.44.1.el10_2.x86_64.rpm c1858808fa09d146c00ecc9961885a5c9fe2e2bcbdcf8545bfc8fee043a95281 rv-6.12.0-211.44.1.el10_2.x86_64.rpm c1da2c5866ae27afc196ce925c5ec846723085a7a1c92a1725dcfd340a9f84f2 rtla-6.12.0-211.44.1.el10_2.x86_64.rpm c78cddfdb213814ca0ec580991a245efb79c088995dabb500f4ed01408377460 perf-6.12.0-211.44.1.el10_2.x86_64.rpm d1210ceb5fb64e66db060a4bb79ab6c307359cb802e79b0e5fda9b031c2a0aea kernel-headers-6.12.0-211.44.1.el10_2.x86_64.rpm fbf0282906df3da25257025643bd586649b0b3cb4414718a73d4a4423a575550 ALSA-2026:52675 Copyright 2026 AlmaLinux OS 0 1 Moderate

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libarchive-devel-3.7.7-10.el10_2.x86_64.rpm 50acdf83e37369e3d14fbeaadb57f84e6ea09c6decbd18f6206bcf22e4c26369 bsdtar-3.7.7-10.el10_2.x86_64.rpm 80df6c70921e381402912f40c7f42f34bb53afb415093a5a96f15c779765c882 ALSA-2026:52841 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs-nodemon-3.1.14-3.el10_2.noarch.rpm 754dbb75c7096126fe89e0025ab2e31e63eda960fb77226c5e627a74feb18d21 ALSA-2026:53330 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fsnotify: Fix ordering of iput() and watched_objects decrement (CVE-2024-53143) * kernel: shmem: fix recovery on rename failures (CVE-2025-71072) * kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415) * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368) * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531) Bug Fix(es) and Enhancement(s): * Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-10.2.z] (JIRA:AlmaLinux-213035) * AlmaLinux10.0 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-10.2.z] (JIRA:AlmaLinux-222503) * AlmaLinux10.0 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-10.2.z] (JIRA:AlmaLinux-222505) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-perf-6.12.0-211.46.1.el10_2.x86_64.rpm 0313e8f09e1c8f989583b7ec77a3034f30eb4778a1063cc21a29d3d7eb07c9ef perf-6.12.0-211.46.1.el10_2.x86_64.rpm 1860d5f74694003c17c4a578665588c83e57ddc23a7bb2712334ea8863dbd7d0 rtla-6.12.0-211.46.1.el10_2.x86_64.rpm 70be2928a08c7af6ef1a96dba70513f7dc1122ea82bd2e1d58d1f41e981650d0 kernel-devel-matched-6.12.0-211.46.1.el10_2.x86_64.rpm 761f0ea671bd1afcee4c00562a7f322280950fb6c38a9a8c2d1a85c386495da1 kernel-headers-6.12.0-211.46.1.el10_2.x86_64.rpm 763b33740d85c3be369fecf594ebd9a1334311b16a4f3114edf58e3adc80b3b8 kernel-doc-6.12.0-211.46.1.el10_2.noarch.rpm 889073b12cc0ea295f2ca8fe44265cfc363bf64df9f9389e1236bf5667da86f5 kernel-debug-devel-6.12.0-211.46.1.el10_2.x86_64.rpm cb25166080f1e3d50fc2156a375bb6a5c7df7700ae8a62d5e68de9570c242b85 rv-6.12.0-211.46.1.el10_2.x86_64.rpm df3bc18de1aa484c8395c05e34b4bf0b2417b96a0e6d97c5b639306c1c633513 kernel-devel-6.12.0-211.46.1.el10_2.x86_64.rpm f1127b4f570616e85c2cbb68d0ca8094bf3945a2e87344b700a7635ceb4518b6 kernel-debug-devel-matched-6.12.0-211.46.1.el10_2.x86_64.rpm f38c3366309e00daff513128f73f9e651f63c6281bafcb69c202cfa1778d8d1f ALSA-2026:53435 Copyright 2026 AlmaLinux OS 0 1 Important

udisks2 security update

The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default udisks2-lvm2-2.11.0-2.el10_2.1.alma.2.x86_64.rpm 0af994695e77025da25d1343ed055f27c394aefde0c1a341d95ac8d7c376667c libudisks2-2.11.0-2.el10_2.1.alma.2.x86_64.rpm 29ce400b47633eed61eaf92ffe333ba62489f9f429aa0d9ccb4799e6c0094f12 udisks2-lsm-2.11.0-2.el10_2.1.alma.2.x86_64.rpm 529975b34d9165b6d3ab1e4f629efb2e79299f01f60df94e3af2bfead9c4a11a udisks2-2.11.0-2.el10_2.1.alma.2.x86_64.rpm 75ce0a3afb3cebdd796b3b2d02fa9e31c1a45946f7cd90f2c779e6f74c20bc8c udisks2-iscsi-2.11.0-2.el10_2.1.alma.2.x86_64.rpm eb8f020584011beb1a511f1d10a61421001b15ed32aed56f6eef534a3acb4a01 ALSA-2026:53451 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.3.x86_64.rpm 57b731f6a7e6c2c53554361a145d42393d4aacb010804e57a7a518150aa0cd77 gstreamer1-plugins-good-1.26.7-2.el10_2.3.x86_64.rpm a89a7ee987ddaae759dff970836d1c63a2af270160b7961e69160b2c46648fe3 ALSA-2026:53845 Copyright 2026 AlmaLinux OS 0 1 Important

iscsi-initiator-utils security, bug fix, and enhancement update

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks. Security Fix(es): * open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944) * open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943) Bug Fix(es) and Enhancement(s): * [FJ10.1 Bug]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [almalinux-10.2.z] (JIRA:AlmaLinux-191899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el10_2.2.x86_64.rpm 911f20cf3b598473d0042abb6123743886b28621c7c32c22ad73eddb249d0b78 ALSA-2026:54178 Copyright 2026 AlmaLinux OS 0 1 Moderate

grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382) Bug Fix(es) and Enhancement(s): * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default grafana-10.2.6-28.el10_2.4.x86_64.rpm 97824da0e2fb86e9361120f9dc380c2b30de0056c09b75f41d378b113d0eded7 grafana-selinux-10.2.6-28.el10_2.4.x86_64.rpm e027c152a86c7c2145a73c8a950aedcd5ef9ace4ba9e6905011801aee0d5d144 ALSA-2026:54343 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: perf/aux: Fix page UAF in map_range() (CVE-2026-64300) * kernel: af_unix: set gc_in_progress to true in unix_gc() (CVE-2026-53361) Bug Fix(es) and Enhancement(s): * netfilter: CVE backports for AlmaLinux 10.2.z (JIRA:AlmaLinux-185311) * tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-10.2.z] (JIRA:AlmaLinux-214436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rv-6.12.0-211.47.1.el10_2.x86_64.rpm 09b67fa0550455420ca6844c1d5026d40938498da4ba0ecfef64a55aa0d9d9ae kernel-debug-devel-matched-6.12.0-211.47.1.el10_2.x86_64.rpm 198a198ded078caf217fbd81e0fac74bb41280f2ad41728bcf533278a64d04c0 kernel-devel-6.12.0-211.47.1.el10_2.x86_64.rpm 30e175ca3c449db3f67280b4bd36eafd335bc6f683d0491c993ba03238867ab6 perf-6.12.0-211.47.1.el10_2.x86_64.rpm 4d1fc0ab96bdc06aa4b44b9482433e72b1d0b5a2ee6619e8fa0bfbb58312debc rtla-6.12.0-211.47.1.el10_2.x86_64.rpm 68bb43ba44faa4d5a61afc3d054cf44bc14d8a6188f2825eada91995ac396a03 kernel-devel-matched-6.12.0-211.47.1.el10_2.x86_64.rpm 6a9c1c3a3fd29aee67085d889c4d864682caa1b6de87db039db4998f653244b7 kernel-debug-devel-6.12.0-211.47.1.el10_2.x86_64.rpm 7ccc3c1150537e724a861521e17ddbc162bcd41fd5bdd1d597af1135fcd4ba57 kernel-headers-6.12.0-211.47.1.el10_2.x86_64.rpm 81b44209f62058f93d327cf1e9d95fd8325c1f6a4650c8bb32da53815bb427fd python3-perf-6.12.0-211.47.1.el10_2.x86_64.rpm a89d3cacb6ccf0b35b213de51f65e093ba81203f5e712c91dbdfd4c1782f3afc kernel-doc-6.12.0-211.47.1.el10_2.noarch.rpm b6ea785a24bb7a5f9f936164f09340cbc926d13f91290fde4caa9d611fc41c48 ALSA-2026:54486 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620) * FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621) * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libwinpr-3.10.3-12.el10_2.8.x86_64.rpm 1a9743848a4667c096eba54e317d76359c05d9b5d4d5a2f0c32ff5b7be8e20c1 freerdp-libs-3.10.3-12.el10_2.8.x86_64.rpm 2072c441cf20577fd220caac841584290438c56898b1b6adfe02bc7b567c2ed6 freerdp-3.10.3-12.el10_2.8.x86_64.rpm dcac9399e99e661d6409b24fc3728cf0b1e6f273b6da6e0013b2fab1fbbf0cac ALSA-2026:54512 Copyright 2026 AlmaLinux OS 0 1 Moderate

gnome-remote-desktop security update

GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fix(es): * gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service (CVE-2026-18358) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gnome-remote-desktop-49.3-4.el10_2.x86_64.rpm 82696f7c19f1556203f4c92bfa3fb4c70ee8fd77e4a0a063454c67d62ef62f41 ALSA-2026:54541 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.130 Runtime version: 8.0.30 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-10.2.z] (JIRA:AlmaLinux-235472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-runtime-dbg-8.0-8.0.30-1.el10_2.x86_64.rpm 0e7ee04dd1e57a98dc52368cdb83f0c567f0e06cb70d6e6fa284bd0a3988736b aspnetcore-targeting-pack-8.0-8.0.30-1.el10_2.x86_64.rpm 170b0205a94abc417dcde0883dcd2b0bb50110072d2d6cd2344b66629845e380 dotnet-targeting-pack-8.0-8.0.30-1.el10_2.x86_64.rpm 18846bad320355ae81bed4f1dd2e55d0ce51fe2a3ef6a7f182ea8fe89960a8c8 dotnet-apphost-pack-8.0-8.0.30-1.el10_2.x86_64.rpm 1c956c3de9d222a0df7b3230b463049954ebc1f786fc6d0c2719cb28bfc8801f dotnet-hostfxr-8.0-8.0.30-1.el10_2.x86_64.rpm 35b2053f157241ff7d593ec4f394914d3267b47b5487c829faae0f7cfc2ff4f7 dotnet-sdk-8.0-8.0.130-1.el10_2.x86_64.rpm 5202292cbd90039542a9a469381e1bac795ca4b00b2b93e697b53a1aab04ac00 dotnet-runtime-8.0-8.0.30-1.el10_2.x86_64.rpm 54a4af85ab9b73980061cef5e1b6258ea8953e27d8c6d963321d3125a6dab557 aspnetcore-runtime-dbg-8.0-8.0.30-1.el10_2.x86_64.rpm 5d1d4baa7a170ae93b8a162c72a4aa1cbca8734656ec76efeb20c28f8227ae72 aspnetcore-runtime-8.0-8.0.30-1.el10_2.x86_64.rpm 8e9b49f6a728b88381c9de9e309a57988f643e8c0950a6e9b8536c0b3b9e4088 dotnet-templates-8.0-8.0.130-1.el10_2.x86_64.rpm 9db2cfb93a524b93aedb9d5b28294e85758be7b71afbdc390c1e31bbe630347e dotnet-sdk-dbg-8.0-8.0.130-1.el10_2.x86_64.rpm b2a7539f0180fe7ba4e9b6a027559ce1d832a6a065813ebd76cbe2787a57924a ALSA-2026:54576 Copyright 2026 AlmaLinux OS 0 1 Important

dracut security update

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dracut-live-107-9.el10_2.x86_64.rpm dee8f138b60aa758f80fb2965f4ebcabc7d7278d08ed83b0a35210e939521c1b dracut-caps-107-9.el10_2.x86_64.rpm ed0665d8c9e60a9ce9820b8560a8a880c79bd1d41d7eb1340e6888259d7b2cef ALSA-2026:54590 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.120 Runtime version: 9.0.19 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-10.2.z] (JIRA:AlmaLinux-235477) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default aspnetcore-runtime-dbg-9.0-9.0.19-1.el10_2.x86_64.rpm 0937a01a6f68be8a545fa8623e3a3ed95b9279c3d32f59326a8b3a32c00f7463 dotnet-sdk-aot-9.0-9.0.120-1.el10_2.x86_64.rpm 132079bb599877d33cdc9829c1322fc92de3f1e0dc496b69c18d4c5e40420ec6 dotnet-runtime-dbg-9.0-9.0.19-1.el10_2.x86_64.rpm 4740cd2aae001410c32d9a5db3b0c88eab42a52987aaae0d5acfd0860e1c67c8 dotnet-sdk-9.0-9.0.120-1.el10_2.x86_64.rpm 69b7c4b91e825d8e9527e518bfd51bcc2334a53a7931a3591688d51edf06b397 dotnet-targeting-pack-9.0-9.0.19-1.el10_2.x86_64.rpm 6ae71a277744fe073491af3a51e45287b85ae20ec44030ebe0d8382f7e709cf9 aspnetcore-runtime-9.0-9.0.19-1.el10_2.x86_64.rpm 7138525b74a0f1c604328213d59bb3214d93aa25dcb6ae40935149b232224c7d dotnet-runtime-9.0-9.0.19-1.el10_2.x86_64.rpm 76fba266a2b20547732ef3fa321a467163798a0a1a36ec8a7d44022bcb2c6e8c dotnet-templates-9.0-9.0.120-1.el10_2.x86_64.rpm 8813900b10a8cb005e06212061e86d50155fc0352f6fd9f6b63e0cadf88c60e7 netstandard-targeting-pack-2.1-9.0.120-1.el10_2.x86_64.rpm 8af14e4cd80ae458e31d1d4bd71f54542533c94c17edd3ae608b7204a3e07b36 dotnet-hostfxr-9.0-9.0.19-1.el10_2.x86_64.rpm 93988623f5c5f3ee04e6ae8422fde0a076525ce1024c232ce3decfc1b4ca8a3b aspnetcore-targeting-pack-9.0-9.0.19-1.el10_2.x86_64.rpm e9c10162968f69e302ab8ebb589b36b7b4730eb003c516de95b5ac257e266154 dotnet-apphost-pack-9.0-9.0.19-1.el10_2.x86_64.rpm f6c9ed95e914804b27cffd53a4ced9532a219cb6f40380b3fbbc9f0f1f3436d2 dotnet-sdk-dbg-9.0-9.0.120-1.el10_2.x86_64.rpm fb3a68eee91af7626f0cf92722ba42f2bda4422e5052937c0cfc1b4eda694840 ALSA-2026:54650 Copyright 2026 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libnghttp2-devel-1.68.0-3.el10_2.2.x86_64.rpm 8b4c5dd2716c45ccf9bec2e356a9dee56b781712de596fe4ec248ce63f219ebc ALSA-2026:55424 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-lib389-3.2.0-9.el10_2.noarch.rpm 27cf3e06e99257f4c51c72088b1f9e5f48d590b294e516768385c0f484ac53a2 389-ds-base-3.2.0-9.el10_2.x86_64.rpm 48de894c10203885adff6503dbe0c741d9b1a9eff10daf247476e818c7c0cbd7 389-ds-base-libs-3.2.0-9.el10_2.x86_64.rpm 8250ac771878c73810d293a35c0e21ec8e2813f2ea555a89247d9735dee3a1d5 389-ds-base-snmp-3.2.0-9.el10_2.x86_64.rpm 878f70eed89a498ac0d11c236da751455cfd2f7ef15f7ba89647059eda1a4e94 ALSA-2026:55432 Copyright 2026 AlmaLinux OS 0 1 Important

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.4.x86_64.rpm ab758b8296b6470976f04a6c8f5e855b7f703441bad87e131b8f5702a8e90aad ALSA-2026:55433 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.x86_64.rpm 34dbb18b824630d2d66087bdabcb5dc6dc3bc9a5f917af33f3b364c2de25e5d5 gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.7.x86_64.rpm 41e36020e9720d001a38b61a7789f5695505cc30686edd13bebecbb928563db0 ALSA-2026:55434 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433) * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.5.x86_64.rpm 2e579b7c986082141793efe12c42ffd31c9343bd1c992a8f5551af28e6cbd15d gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.5.x86_64.rpm d471bb43bea65fbde1d3cda86d9a859b0b8eb288e7a28820dd58a7252692fa0e ALSA-2026:55435 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL. Security Fix(es): * gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.2.x86_64.rpm 87ca66be1b5fbf7903a391342539e1e4916cec746b044f56d715a792533b066e ALSA-2026:55437 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default bind-libs-9.18.33-15.el10_2.10.x86_64.rpm 0db9b2b68d79c6f45892c6fc54c4da330d648fce39b199791ad2fa1585c731d1 bind-chroot-9.18.33-15.el10_2.10.x86_64.rpm 24c989eaafab7d8fe8b21cda04bb6522a06dc99816c8aefc946d0e09e068fb06 bind-dnssec-utils-9.18.33-15.el10_2.10.x86_64.rpm 6d6c61dc36eab38f3fdd1f9a94d08efc102e9317d0e180815b5fea4a2b36082d bind-9.18.33-15.el10_2.10.x86_64.rpm d9307112a0dfc7dd3b89d076480e489f39e6c7dcebc2701f285d3922b8356679 bind-license-9.18.33-15.el10_2.10.noarch.rpm e7269f3a04d0f19af0b01cb87ae997a2d63f8b901c3fbbbd06b2be1ac756d519 bind-utils-9.18.33-15.el10_2.10.x86_64.rpm f5c9476545b6c321d5ebeebec1e7609910285fcd4d8e16b190c97a622565ea59 ALSA-2026:55448 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679) * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libXfont2-2.0.6-5.el10_2.3.x86_64.rpm 0992b6a710dc47252118fd3d535a671ef8f9d52aa3ef5fe46d5d60967e5520c1 ALSA-2026:55541 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs-22.23.1-6.el10_2.x86_64.rpm 435a77386e232d0253c85b6111808212def9d57b8816f65e2e80e8a78bc04000 nodejs-devel-22.23.1-6.el10_2.x86_64.rpm 65b97d6ee340b526c68f7a8a42d7057c1ae5071770f7ec6cb2b26340c21af745 nodejs-libs-22.23.1-6.el10_2.x86_64.rpm 7dbd1d82f0b935d584595dfb1baefdcbab3d2cecd947990238172572fe605f51 nodejs-npm-10.9.8-1.22.23.1.6.el10_2.x86_64.rpm 9cb191cccdbb7a501903d70b8d5988534c62881c9141db84625417a2fce49326 nodejs-docs-22.23.1-6.el10_2.noarch.rpm a4cf7db461223295f0f82718617815510079e00e6e5e5f79921d8490e5169df3 nodejs-full-i18n-22.23.1-6.el10_2.x86_64.rpm e7e167096e2de38747733562d3f2af3b4132e05b57d8724ad03666659d0485d8 ALSA-2026:55617 Copyright 2026 AlmaLinux OS 0 1 Important

pcp security update

Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fix(es): * PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524) * PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526) * PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527) * PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default pcp-pmda-pdns-7.0.3-5.el10_2.x86_64.rpm 060f73e5aec139251802d9972d4d8f238f6d6b45367eb1c4386b5b30f0da1e94 pcp-export-pcp2xml-7.0.3-5.el10_2.x86_64.rpm 065e38817defd3f8656a6eeababb9cc628aa4798361e60fcabda491ab5013fdc pcp-pmda-zswap-7.0.3-5.el10_2.x86_64.rpm 08f223b842154a593764ced948d28e187a1a671828c688ce0c30859721450253 pcp-pmda-logger-7.0.3-5.el10_2.x86_64.rpm 0a8f56a09badd017e5f05ef4e981431b3504384fdae516c1c9eb2326fe52af7b pcp-pmda-zimbra-7.0.3-5.el10_2.x86_64.rpm 0f7c725958d5e30dc9ac088179b4a20048d9f6d0239f654ac536a5121f325ab9 pcp-pmda-summary-7.0.3-5.el10_2.x86_64.rpm 0fb6b1893540a488aa1cf41baaf3a7f94603858a3350119ad08780684dc22b78 pcp-pmda-rabbitmq-7.0.3-5.el10_2.x86_64.rpm 12e9c20bc8ff5cd0b092578c680cc979fdc70798ac3f4eea2f4f526cd2c40f8f pcp-pmda-gpfs-7.0.3-5.el10_2.x86_64.rpm 154440480cf8eff80bc2797b778b11908b27f78ca35ea09452fa1954ea8e6ed0 pcp-export-pcp2spark-7.0.3-5.el10_2.x86_64.rpm 15841c980bf671bda93a30c3224ce13904770ae8d9df9e3509e2bc6598de6b64 perl-PCP-PMDA-7.0.3-5.el10_2.x86_64.rpm 168f097c5665cc137033359d8343bd926306a64b03d81a302cd1f8b6cedf275f pcp-export-pcp2influxdb-7.0.3-5.el10_2.x86_64.rpm 18660eea8cda76bb2e54536caa4cc42e9bb4bb55a4cff7155e2cba47fe9dd89b pcp-import-sar2pcp-7.0.3-5.el10_2.x86_64.rpm 18f61f9a40b2a91874eb76661b25fe26edb7ad1631fef443b781cb6c78bc785f pcp-pmda-rsyslog-7.0.3-5.el10_2.x86_64.rpm 1a0752c0ad8775918cc4dd9556be18a1cef70d69f86f0a8a087aecdeff615e75 pcp-gui-7.0.3-5.el10_2.x86_64.rpm 1dfa91e64b95493636a2454dbb99c9bd5e27cdd8b2777a879e8cd494556b3ca5 pcp-pmda-postgresql-7.0.3-5.el10_2.x86_64.rpm 262029e1fa33e744264570804c77d46ff6d0a991fcc437c5fea8f9b6e47dda4c pcp-pmda-nginx-7.0.3-5.el10_2.x86_64.rpm 279e5e911564521386bbd89f0f0e4805e4059344219261510d6a85d878a08074 pcp-pmda-gpsd-7.0.3-5.el10_2.x86_64.rpm 2827b69cb871252d78f65ef8c0524009aaae10fcba93e4faa43c436b5105481d pcp-pmda-libvirt-7.0.3-5.el10_2.x86_64.rpm 2ac05b16bdef7b97a1ae803237808b042584ec7238b55c4c8d4811af7250b799 pcp-pmda-oracle-7.0.3-5.el10_2.x86_64.rpm 2b2640e4797cfac0e0b603682f38c637b55550400a6563c4f4f7dff998226ebb pcp-import-ganglia2pcp-7.0.3-5.el10_2.x86_64.rpm 2c7b6420ed2b74e28a2f3e6879d9c700f6fb4388fb592814bc9277c178d720f0 pcp-pmda-samba-7.0.3-5.el10_2.x86_64.rpm 2c949587a044612204009bd454b29c415a6a6cd1483c93c56e129db681fc2e5e pcp-pmda-opentelemetry-7.0.3-5.el10_2.x86_64.rpm 2caa9595dd97d5587df381fee41458381cb25a28607d01468f74de59b45ce045 pcp-pmda-hacluster-7.0.3-5.el10_2.x86_64.rpm 2e1e5ee5b270a21a8c526203d056348fee939e5ca937e637f7547aa54a251c69 pcp-pmda-bash-7.0.3-5.el10_2.x86_64.rpm 355deeb9c90a7614b995bd22cbbc355e59c91de1e62c3797840f9506ae5b1edc pcp-export-pcp2graphite-7.0.3-5.el10_2.x86_64.rpm 364f765ce4ed5da53b3cf9c473bf8f6f0c3cd6fbe04a790a2012f36fe3e54d5b pcp-pmda-sockets-7.0.3-5.el10_2.x86_64.rpm 3a7afb1bf30c9fb23ddf36f67ab52776216763f0abff96db147a1864785e599b pcp-import-pmseries-7.0.3-5.el10_2.x86_64.rpm 3b1c1ed8ab3e59301bfd861dd8ae720258892cee2d1a1158a7c83e952aa6da67 pcp-pmda-snmp-7.0.3-5.el10_2.x86_64.rpm 3b96c6d7af8559d1ac40396d851ffc4b8eb515b35baad0a235836d6bdf2405dc pcp-export-pcp2json-7.0.3-5.el10_2.x86_64.rpm 3e19671e15b51f3682e379f87612cc127c705a751ec758d1bf0ba47d372e4f47 pcp-pmda-elasticsearch-7.0.3-5.el10_2.x86_64.rpm 3f88ecc5ac5e8a2b286f49d46512c9d415eb939b7e4585567f43b07107e112a2 pcp-pmda-lustre-7.0.3-5.el10_2.x86_64.rpm 42a876e21ecc32e8046fa0b88bf0557fb5a6a1c55d5960a00254fa0c802aefbf pcp-libs-7.0.3-5.el10_2.x86_64.rpm 46fef19b0d9d84077254701963f790b38d213ee53a27d4922d16c7dd96eb2877 pcp-pmda-unbound-7.0.3-5.el10_2.x86_64.rpm 47366b76ad12ec8af08b1c2c7f8a50daccd86846eeb00b2ccd198743904c7e33 pcp-pmda-activemq-7.0.3-5.el10_2.x86_64.rpm 47fa8759e8df20b1f5b95283057955fba8117cea7e2128c8447f1b052e90b334 pcp-pmda-bcc-7.0.3-5.el10_2.x86_64.rpm 481a42ebefd0f494370b3143a7238003e72a1a17f48bbde26d378e148392c654 pcp-pmda-mounts-7.0.3-5.el10_2.x86_64.rpm 48e7543d5d7c50350e9520cc95aa9ede63c66483dc2b4eabfd468b314b933887 pcp-pmda-lustrecomm-7.0.3-5.el10_2.x86_64.rpm 48f45a113dddf9e8a58aa5f1250c90921f6853126cc84d094a70c91314e05dd6 pcp-pmda-podman-7.0.3-5.el10_2.x86_64.rpm 49912747b825f802ca99a5d701cab247ed4d2e751975be1cad111145daf1477c pcp-system-tools-7.0.3-5.el10_2.x86_64.rpm 4d5289a273a7521dcb215020d71b374a7c31652325f590c05b21271e632dd9a4 pcp-pmda-perfevent-7.0.3-5.el10_2.x86_64.rpm 4e8255c0faece589de8daccc2e084f9029680b1e83ffa65067a2634654901cb1 pcp-libs-devel-7.0.3-5.el10_2.x86_64.rpm 4ed30c2927a3b8fe83ba9b764c52bcc27df63a222a518c7abe2d7ae2bf66e383 pcp-pmda-netfilter-7.0.3-5.el10_2.x86_64.rpm 4f166e26b57309d7bc1b42e2923a46a53b68a71904c75c7d916ee05c2a153d9f pcp-pmda-postfix-7.0.3-5.el10_2.x86_64.rpm 5129d75eaa9007caf0fe72fdcba4e723268b035e8e5da179fc69ac61871e06d6 pcp-pmda-named-7.0.3-5.el10_2.x86_64.rpm 5173c01a8175884429f2f352a8083441b3d81524cd56da998f3c5c070b1d657a pcp-pmda-infiniband-7.0.3-5.el10_2.x86_64.rpm 5255102354e00a1b87e5ddb7d01bfeebb6db9a57b7020dece843f0bbe32273b2 pcp-pmda-cifs-7.0.3-5.el10_2.x86_64.rpm 5457dea493b21a6789e3e19015221331785abf007788e4df0d68c30f3bdd2a18 pcp-pmda-ds389-7.0.3-5.el10_2.x86_64.rpm 5d1abe7a391aa313c8ccc5f61feeea725554342e64dc5846a3da3cac3b682301 pcp-devel-7.0.3-5.el10_2.x86_64.rpm 5f6e84cac4a324d5f26a9e649cff998281ae7acbd579cb4f8d1315867f1ba612 pcp-pmda-slurm-7.0.3-5.el10_2.x86_64.rpm 5fcf0fa52a58afe45bb963df6efcb468b87bffc24207c97070d0f3e908096cd5 pcp-pmda-nvidia-gpu-7.0.3-5.el10_2.x86_64.rpm 6055735c790157a46151985d6d9c7ed4bb18a6cbfa5b1a3885ca46f023670f74 perl-PCP-LogSummary-7.0.3-5.el10_2.x86_64.rpm 61022338fbce3809982f2660a1d6c6dc4718160f382db52b69470d05fb869305 pcp-pmda-news-7.0.3-5.el10_2.x86_64.rpm 6973f1a6e4c72920fbc67867de4715f4399ce1c65cee6c3c5dbb4316ac601a04 pcp-pmda-netcheck-7.0.3-5.el10_2.x86_64.rpm 6ce4a0e3e9e2c71724bb1efbc74dc854233468a9b5f10bce432c6f8f553ce353 pcp-pmda-nfsclient-7.0.3-5.el10_2.x86_64.rpm 6e2f1c0b1f6cde1e3a8dd2178d1c4a53227cac804a3a3cc850b2bcdc29a0eadc pcp-import-collectl2pcp-7.0.3-5.el10_2.x86_64.rpm 6fdd5ac03dfc7d30547d2d37061fbcd0bd882576148693035955d2c8006f81d3 perl-PCP-MMV-7.0.3-5.el10_2.x86_64.rpm 70ee043bc4cfc369dad4e43d3c6427ebafb106d74981084bb13f9e17a1f10325 pcp-pmda-haproxy-7.0.3-5.el10_2.x86_64.rpm 815dccfb09adaac2266f540e311249338eb01e77cbd396b2ce2b7da251d2cef2 pcp-pmda-shping-7.0.3-5.el10_2.x86_64.rpm 82f5983593eb08ab062e6caadaca4d6494ad10aed4c62e4c5bf983f0f3d791c1 pcp-pmda-weblog-7.0.3-5.el10_2.x86_64.rpm 86464cc86173ec8e30b26f89d8506c31b8c051a3efe8bb99d76ca23ab5c7e4b8 pcp-pmda-bonding-7.0.3-5.el10_2.x86_64.rpm 8766c2b73f8619bae251e75cf7d40ebbfa50e697b3abcc5c8472100f8fbb47aa pcp-pmda-rocestat-7.0.3-5.el10_2.x86_64.rpm 8b6ccd3c74a8e8712ec5c6d34b085df6150cb2993872afc7687619b5151b39b8 pcp-pmda-apache-7.0.3-5.el10_2.x86_64.rpm 8f7de846ef07edc677741d67491c58715e32a6c40b72f1ec111c553f652f5cad pcp-conf-7.0.3-5.el10_2.x86_64.rpm 90d963c80d7707182145bd8a7d4dab1957caa49927809d6a0e6856c7ee83f638 pcp-doc-7.0.3-5.el10_2.noarch.rpm 94a7dc3f75afab71ce735dd038541108a4e6b18e03790db4d1e46bbc272ecb1d pcp-import-iostat2pcp-7.0.3-5.el10_2.x86_64.rpm 97ad55dc6d13e5d00fba5d4b29719dbc22094830625386c5c842588511a53b8d pcp-pmda-lmsensors-7.0.3-5.el10_2.x86_64.rpm 9934bfad13c0e61db2f60bd4c058a69fa72833b509cfdacbe070c96ffe7cb75c pcp-pmda-cisco-7.0.3-5.el10_2.x86_64.rpm 9a26200ab00c8db570fe0867962bc3995c7f128cdbd83e7bc6b65cd0338dc360 pcp-pmda-bpftrace-7.0.3-5.el10_2.x86_64.rpm 9cdd441401abee33938853215c03de30e32bdc4b3cc288a0c1c15655cad04b63 pcp-export-pcp2elasticsearch-7.0.3-5.el10_2.x86_64.rpm a312fc5db4665d54ffbe70d5f158cf4346ea7d42c406e3f78b63b9e31dd7c4f2 pcp-pmda-uwsgi-7.0.3-5.el10_2.x86_64.rpm ad9abcf964c1b71ac416790fc67aac65dc39d219f8de86a6c118df087238cc03 pcp-geolocate-7.0.3-5.el10_2.x86_64.rpm b8d9f6a1dea94993ce63f37e0032da04054ea76c204bafe39c4d931a809bd74c pcp-pmda-dm-7.0.3-5.el10_2.x86_64.rpm b8fe7ba21b3c144fe0ab0f94b3ca20a8019d7955a61f07f0aea98a4c00b78b1b pcp-pmda-bind2-7.0.3-5.el10_2.x86_64.rpm b952e7d7b65cc3f49f49c4c55001914c790196607eced977517aaffccc0eac84 pcp-pmda-mongodb-7.0.3-5.el10_2.x86_64.rpm bbd052ace819abfbea45b86eb47ea59c2abb7b77661598a2b9c32e7109478592 pcp-export-pcp2openmetrics-7.0.3-5.el10_2.x86_64.rpm bbdfcc43e79b81636a4e8c5ae92747a58f0da163b50c7b23780db9123a95e89c pcp-pmda-systemd-7.0.3-5.el10_2.x86_64.rpm be096e244da5e47adca16663fe2ce9f5ed3ca73f0c630f4b56fa666c696b5df3 pcp-pmda-openvswitch-7.0.3-5.el10_2.x86_64.rpm bf51d8dafb40eb7549b509290e801a869fa72b764196b9f2238bf8095c958fac pcp-pmda-trace-7.0.3-5.el10_2.x86_64.rpm c0d352ee0d92ae5a11428e89e7e253e03ef9ad50331ec54b3f36ff0e814ac460 pcp-pmda-dbping-7.0.3-5.el10_2.x86_64.rpm c302ad208a8b8b9b8bda79edbe6f5fda0efac29fdea91d0341f6d403f413727a pcp-pmda-sendmail-7.0.3-5.el10_2.x86_64.rpm c45e982777445ec59b37badf9e323d781b36e059f5e75fd2e014c03621650d66 pcp-pmda-farm-7.0.3-5.el10_2.x86_64.rpm c5d79a9d413cf8264cef2fdaadb812ec5109ae39e599551495daedad8e4e129d python3-pcp-7.0.3-5.el10_2.x86_64.rpm c6b64f9dc47a5b7c82c6f594ce5970a80e7bafaeaa3517037d6c0e689cf382e0 pcp-pmda-resctrl-7.0.3-5.el10_2.x86_64.rpm c7605dfb45325f135b9e65f5f07109e5a24a10cc0375919ba3b9f7c7ffca8943 pcp-import-benchmarks-7.0.3-5.el10_2.x86_64.rpm caacd920db0ca56d43b813f9649254032e616734525e7f634d535c07fab08b65 pcp-pmda-lio-7.0.3-5.el10_2.x86_64.rpm cae7fcf2572f7029c7a5815ad28218ebcce746c2b7c5feabe24d6d4ffe8a921c pcp-pmda-amdgpu-7.0.3-5.el10_2.x86_64.rpm d14faa76c6960bb170ed889907d39face1e3bcc65554741eca125c1e920d0411 pcp-pmda-gluster-7.0.3-5.el10_2.x86_64.rpm d2ba6b601bff843fdf06030d28030f4bee4773157430613f64dbbe524a5abe89 pcp-export-pcp2zabbix-7.0.3-5.el10_2.x86_64.rpm d4446389b7c234d0c65f9c292a2293b554cc88a31a16db113759cc2a444f5a07 perl-PCP-LogImport-7.0.3-5.el10_2.x86_64.rpm d79ae821d759e16f1415f4a4e61efc644377fd38b7120d0cae8513c0c0da5873 pcp-pmda-statsd-7.0.3-5.el10_2.x86_64.rpm d83240af389e2a82d16d5bc47622ded1fbd3fcd9f83582b5d4913c79ee2f68b1 pcp-pmda-mssql-7.0.3-5.el10_2.x86_64.rpm de267529f9ec6c6c9f514be6641f39651444a392410d124b87fb0fe4eaf3f85c pcp-import-mrtg2pcp-7.0.3-5.el10_2.x86_64.rpm e13590e457c9aa34511099e5b6ae174d71a89ee42e86515347dd73c844c1ae98 pcp-pmda-docker-7.0.3-5.el10_2.x86_64.rpm e3c5ac524b9fd9a18b9179a17de4872883e8b49b25874974a6a8ff24eeefe18d pcp-selinux-7.0.3-5.el10_2.x86_64.rpm e53a3395ee38e9edb23659fbe6749c0de641e53834637ed9935bb9c374a00a12 pcp-pmda-hdb-7.0.3-5.el10_2.x86_64.rpm e543df5ea5a65b25d9b3ce3a69ed7adb3a8c3ee02a89a48daa53e1c322da9331 pcp-export-pcp2opentelemetry-7.0.3-5.el10_2.x86_64.rpm e54a09ce83369a0c05d92b6659d0804dd550a3cd3cd69720eb247b1462852018 pcp-pmda-mic-7.0.3-5.el10_2.x86_64.rpm e5f17c51fe21b3ed4d9ff8a01cfbf64a2052d29427bdff83609fc8b7998b0e35 pcp-export-zabbix-agent-7.0.3-5.el10_2.x86_64.rpm ee8b469ce1629309539a6f50cbf76eca267b2e1707b8124532a63a22c9b8a2b6 pcp-pmda-mailq-7.0.3-5.el10_2.x86_64.rpm ef2f29f58a2d1135d84b4a70fa90e99170ee9178a371e409f4f697c0463258d4 pcp-pmda-memcache-7.0.3-5.el10_2.x86_64.rpm f1d2405ebd2c0638827c43e4781894081d4721c31ed3c7632137c7896200d5d9 pcp-pmda-mysql-7.0.3-5.el10_2.x86_64.rpm f42e897d817aa3d71bbab4e998f5403e1fe5d8ffd04279e4d12cd4febcf70f5b pcp-zeroconf-7.0.3-5.el10_2.x86_64.rpm f65d8e7971370587ed93bb0aa013f0f2acc0155aa185f7d287b429bbbb8a0b07 pcp-pmda-openmetrics-7.0.3-5.el10_2.x86_64.rpm f683eaf0f4fbf8fc57b437ab46b1e973f3a71879803e0b4edd9ccc8d488a31a6 pcp-pmda-smart-7.0.3-5.el10_2.x86_64.rpm f8a6d100d1e1823605422bd1e9a1850b68290cad528e71345cc577140ff1ac4f pcp-pmda-ds389log-7.0.3-5.el10_2.x86_64.rpm f99aa8ae84f24f88afe8af7311f8276a8720256e53601badc0c878bb08574092 pcp-pmda-bpf-7.0.3-5.el10_2.x86_64.rpm fd0c11841f1d34a4a02a1d86901d93cd26f05deea5ef710cc3bb758460c3cca2 pcp-pmda-denki-7.0.3-5.el10_2.x86_64.rpm fd2960fbe64feefac48d449cf63c8167ef64a1f594e8d8806c24856178b3337f pcp-pmda-redis-7.0.3-5.el10_2.x86_64.rpm fd58f1398d7ebcc7fcd9df42edc753d4fde6d68ab0e7579334e3c7443346bada pcp-7.0.3-5.el10_2.x86_64.rpm fda7a8d1a0f8baff38dadfda91abe6363678e90604d67042db026f0b622cf9ae pcp-pmda-roomtemp-7.0.3-5.el10_2.x86_64.rpm fe3714938b380e7948cc63ead58282fd48d3ce249bc97af0e73feb9623f735ea ALSA-2026:55679 Copyright 2026 AlmaLinux OS 0 1 Important

haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fix(es): * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204) * haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default haproxy-3.0.5-6.el10_2.2.x86_64.rpm a69ec555334c0106e2835c3f051e38aa34e9ab34528b50b2a0242f804f987141 ALSA-2026:55787 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default java-21-openjdk-src-21.0.12.1.1-1.2.el10.alma.1.x86_64.rpm 09fc17c3e28562970162ec78aa5cd2175f8256936718fa3f4ad800237d75becc java-21-openjdk-static-libs-21.0.12.1.1-1.2.el10.alma.1.x86_64.rpm 1f495f5039807e13ed8a168a56ceee4ac33f22698a770fd428960f91dcfdf6ce java-21-openjdk-javadoc-21.0.12.1.1-1.2.el10.alma.1.x86_64.rpm 5ef9e356f6977928af6f3168e17f9d0d15573503f29717cc25c95409b1af4352 java-21-openjdk-headless-21.0.12.1.1-1.2.el10.alma.1.x86_64.rpm 64374f82e01b2ef92b7ab313e59f5b500d519546533469dba70875ada7653177 java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.x86_64.rpm 662f365a5e474a9d41148575fecbfc71c3467903a1bffe74d6e55516dde8ff38 java-21-openjdk-devel-21.0.12.1.1-1.2.el10.alma.1.x86_64.rpm 7d86f412092e5380bf314615d78f9f7af77ea2897c1100b43d29acb47d5adf12 java-21-openjdk-demo-21.0.12.1.1-1.2.el10.alma.1.x86_64.rpm 87b8e800c48df459c1855b1bacf57b0f13645bc76304d56a0ab52e4b6c7b8487 java-21-openjdk-javadoc-zip-21.0.12.1.1-1.2.el10.alma.1.x86_64.rpm b296289367ecd07fbf6e14bc5e2e86acaf5eb9fda643d9ec2f1d188dc412e7fc java-21-openjdk-jmods-21.0.12.1.1-1.2.el10.alma.1.x86_64.rpm bec4b7ac015eeef623ef8a1374ff2a89b780ab0c6661b33be9fb40a323518c11 ALSA-2026:55798 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Improve font loading (CVE-2026-70906) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default java-25-openjdk-devel-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm 360358824a0d53679c4b4b714a534143beed33592989f50194a3cdf7d016f393 java-25-openjdk-javadoc-zip-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm 6222410d1b645398e2eb2c4c5c06933b2d15915c933a3815fd3711fe85cd9b0f java-25-openjdk-javadoc-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm 6262b6eb386386aee3cde8d575cc34b1478109867640b20874b41d2f1c2b12d4 java-25-openjdk-headless-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm 6f1544280aa4816d4d2804087840dee5cad16c8febc1737ac544ccbf21c859b1 java-25-openjdk-crypto-adapter-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm 8162600a492814c8a838f29db81a834df372e8f40a8a0c9ac534750215615c14 java-25-openjdk-static-libs-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm b279e0c6bf37b14601f9877c9a5a62d05bed6499ea274875eeb4fae63ec61467 java-25-openjdk-demo-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm c2ce81d5e2f86083beb59406d006b6bfad0715cae4e3b94e5f5fb22c4191db8b java-25-openjdk-jmods-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm d8db4f1608bcb6f9772ff20552eec51318057fb1e74c26773b3d7232bf43bda7 java-25-openjdk-src-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm e392b07c2ad0e1abd13472237f7055b0bb2ce41b4bda273abc5167e22be7a10a java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.x86_64.rpm e4e11f465d9d59509182ad57004f19a6ab271043056924f66bbac9414328ec7a ALSA-2026:55855 Copyright 2026 AlmaLinux OS 0 1 Important

libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842) * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843) * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844) * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845) * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846) * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847) * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848) * libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849) * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850) * libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851) * libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libssh-devel-0.12.0-3.el10_2.x86_64.rpm e4ac68d4ccd2ec01bcf448d5e424717fa959d2b24742bad7af61b895b6f1af41 ALSA-2026:55858 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.111 Runtime version: 10.0.11 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-10.2.z] (JIRA:AlmaLinux-235482) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-sdk-dbg-10.0-10.0.111-1.el10_2.x86_64.rpm 1a5d3e2673759a1a965a31bace5c2efcbf5331a24f73deaa8215bcffcddfc9a9 aspnetcore-targeting-pack-10.0-10.0.11-1.el10_2.x86_64.rpm 346c7d453d43f2ddaf582e5ffb4b30ed51cdce667aaed4d01f3d140d2ac81c42 dotnet-runtime-dbg-10.0-10.0.11-1.el10_2.x86_64.rpm 3c875df9ab3e1fb467457f2465be42fa965f53d10702550d64ca3dec3fe9ce00 dotnet-targeting-pack-10.0-10.0.11-1.el10_2.x86_64.rpm 4e7466b921359861d26b790b5c56e66eddf6df07385524380cfa088e19f40df2 aspnetcore-runtime-10.0-10.0.11-1.el10_2.x86_64.rpm 6e9b3b0f1c6fd2368b651730cc270ce21858fd0755e460918371ed5af69c6e02 dotnet-sdk-aot-10.0-10.0.111-1.el10_2.x86_64.rpm 704a83dbf041b5f89876141f8d2d68ad4dbb1b5d1f6366fba987ed7f26922d9a dotnet-apphost-pack-10.0-10.0.11-1.el10_2.x86_64.rpm 7611b85a90a5ef9fc3a67988b3cb8224c7038403f8f9ff0df0198677d62eda49 dotnet-sdk-10.0-10.0.111-1.el10_2.x86_64.rpm 9180d6304aa16b9fcfd35839df75e7d1fb1a619ce654b8c775f274c64839b396 aspnetcore-runtime-dbg-10.0-10.0.11-1.el10_2.x86_64.rpm 9e200c94bccf47442caf58bf382001f564dfcc82f63f85feafde6a6b897ac98f dotnet-runtime-10.0-10.0.11-1.el10_2.x86_64.rpm a4b8ad929a705c5b23f758ee7cbbd6f47a55f36c8e2d41b283502b85bde8a999 dotnet-hostfxr-10.0-10.0.11-1.el10_2.x86_64.rpm aadcf15c062b54fac0149c2910410ea5aa3af7d030007bde836f4f1861662d2c dotnet-templates-10.0-10.0.111-1.el10_2.x86_64.rpm bbaf3ff2dcca922626e38ce6199fbe285ee74ee8bc68cf003508ad351d6bb845 dotnet-host-10.0.11-1.el10_2.x86_64.rpm e66b857fdf7966f146612d95ffc40d6ccd690acaeb6061c4fee52a590e29a8d7 ALSA-2026:55892 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-unbound-1.24.2-7.el10_2.4.x86_64.rpm 2aafe576faa95de984be705e393b7fe20ff703fdf2a7842c30653f133528e350 unbound-libs-1.24.2-7.el10_2.4.x86_64.rpm 44c4c4a14dba0dfd75a662669073ab60e8977489fbe555046ae9016359e1a0a0 unbound-anchor-1.24.2-7.el10_2.4.x86_64.rpm 6b2235a9da2e405270c2b6e16bf16dc3fa7f3dbabb0f7c7009a1f0568996d6d5 unbound-dracut-1.24.2-7.el10_2.4.x86_64.rpm 8b1f472dd4f2dd76113059b3f5779fca48c749a060ff8f26f85f9434fcd5ab01 unbound-utils-1.24.2-7.el10_2.4.x86_64.rpm cc47750f6276c467cb0eee645653db14a96f09e563251838f0391bb9c360541f unbound-1.24.2-7.el10_2.4.x86_64.rpm fb9a0ca283bd495fe9f8f52b6dafd3ff5fde0936e77636ce44581696a0ef4173 ALSA-2026:56007 Copyright 2026 AlmaLinux OS 0 1 Important

mysql8.4 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: Performance Schema unspecified vulnerability (CPU Jul 2026) (CVE-2026-61081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47064) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47012) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60331) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60190) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60177) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-60145) * mysql: DDL unspecified vulnerability (CPU Jul 2026) (CVE-2026-46936) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60186) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60315) * mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026) (CVE-2026-61096) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60163) * mysql: InnoDB unspecified vulnerability (CPU Jul 2026) (CVE-2026-47052) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60188) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60184) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60185) * mysql: JSON unspecified vulnerability (CPU Jul 2026) (CVE-2026-61109) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60191) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-61094) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60178) * mysql: Group Replication GCS unspecified vulnerability (CPU Jul 2026) (CVE-2026-60332) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60189) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60747) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-47023) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60183) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60316) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60187) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60585) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60182) Bug Fix(es) and Enhancement(s): * [tracker] Rebase MySQL to 8.4.11 (JIRA:AlmaLinux-188044) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mysql8.4-server-8.4.11-1.el10_2.alma.1.x86_64.rpm 071c968056ba2bb0d7e1639db40e197a9f7137a2cd44ecc8d277e11e127d6858 mysql8.4-errmsg-8.4.11-1.el10_2.alma.1.noarch.rpm 363b90f121ea2698cc9695f9f3309d5ffa0b6afbaa96304878cd6e0f4729dc7e mysql8.4-8.4.11-1.el10_2.alma.1.x86_64.rpm 3875cba88d3ee77c568fcdba097f4ace0f5d36239dad7c0cab7baaaeea88b26c mysql8.4-libs-8.4.11-1.el10_2.alma.1.x86_64.rpm c543e8e9ca4195cf652af1977ed7ec6aa6e2ef638b4744fe1feecb9004288602 mysql8.4-common-8.4.11-1.el10_2.alma.1.noarch.rpm c88645f04b3cebf77c1371c06af54dbc511288a9c7e60b32a1b8566680f797db ALSA-2026:56965 Copyright 2026 AlmaLinux OS 0 1 Moderate

libcupsfilters security update

Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications. Security Fix(es): * libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611) * libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libcupsfilters-2.0.0-13.el10_2.x86_64.rpm fbbe98eb35ed4f0e03eb064f6817501db14e42483f5b61cb93ad5ef78b20a9ef ALSA-2026:56969 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:AlmaLinux-223949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default php8.4-8.4.24-1.el10_2.x86_64.rpm 18bcada98cdff027f375dca990c337aeb056cbeb1f360da90186a572923a56e2 php8.4-devel-8.4.24-1.el10_2.x86_64.rpm 217a6b708b523e03023f0622793e9e53096289d934dc21242b06249ead31dd2d php8.4-pdo-8.4.24-1.el10_2.x86_64.rpm 341c6f38105c442499e9135dfb25c7f6aa6008a88ab71a29f157fc3ca5af3808 php8.4-bcmath-8.4.24-1.el10_2.x86_64.rpm 386271c79e466f81f98bc52b34edee2e83f96fbc43e7ea3ce3c349afeafb7b17 php8.4-snmp-8.4.24-1.el10_2.x86_64.rpm 480e0b4a24ad9e8d425ac43ceaadbb6b4b371adb8e24aea098c2a36be8d70032 php8.4-gmp-8.4.24-1.el10_2.x86_64.rpm 51e58511e1c42b1dc7f247adbc66f3774cce5a79e08e910df6bd795699420c90 php8.4-dbg-8.4.24-1.el10_2.x86_64.rpm 628d884797066dae4251283f564df0852a555e718d5b4b86371c3b7dd7bc3b38 php8.4-intl-8.4.24-1.el10_2.x86_64.rpm 65bd9d5fb7410d66a8333bac78e4b3afee327d3c059573f505852f0e610f6841 php8.4-pgsql-8.4.24-1.el10_2.x86_64.rpm 79839b91ffb4a00a9f29980bccc900f7d76fc14d889a14f102f80536322643ec php8.4-ffi-8.4.24-1.el10_2.x86_64.rpm 7d9d50a6b8148090c526fa48a3501e9d22828a7195e930b9bc23843b754a10c7 php8.4-enchant-8.4.24-1.el10_2.x86_64.rpm 82fe4e4d5f022b45fafaf338af3f17743d6025fcbc6f67529ef206a0a718ed3d php8.4-dba-8.4.24-1.el10_2.x86_64.rpm 879514c4c06fe1dc38d192a2b814590be70d85026e3c4482e57a3c7f24e58c62 php8.4-cli-8.4.24-1.el10_2.x86_64.rpm 8a9240b10e4c8f398c6a7b248cb2fd8cd8a8dccbe78506cee8ff42a642dce2e2 php8.4-ldap-8.4.24-1.el10_2.x86_64.rpm 97ba2293fdbab628f3747d924862c25ea78f413401b33acb4f44ae1b224726db php8.4-gd-8.4.24-1.el10_2.x86_64.rpm a39992859d07023502a11253408b13f1c96999dc9e09bde1d0e1b95c031b2362 php8.4-common-8.4.24-1.el10_2.x86_64.rpm adda00a6ebcf1b621e3d64585a373b3fc1eda17dfdec4748e70c4474bd720b7b php8.4-soap-8.4.24-1.el10_2.x86_64.rpm c3b5f99903ddeaf11fe063439e66c1738f0456f3aa9dc668d78ba861b1ad3c6b php8.4-opcache-8.4.24-1.el10_2.x86_64.rpm cf2e3c4343065ceaaee29e8e2bfd5764c26cf2c7c2a95483c69ff6630f82fe4c php8.4-fpm-8.4.24-1.el10_2.x86_64.rpm d22a63ee738df68551c101c5c9f8b0d7d85402c44975b36561dc51e9c66c66d0 php8.4-xml-8.4.24-1.el10_2.x86_64.rpm d2ec6b0c203a95a525dc1ce8decb1d8f0e1b3ba6fbaed56e7542410d70286b19 php8.4-mysqlnd-8.4.24-1.el10_2.x86_64.rpm de3091bf6f13b7eab64544710f94df355c4aa62d8f16282b7050b4e6ce6e518c php8.4-odbc-8.4.24-1.el10_2.x86_64.rpm e61491c564e53c68baeae342f0df2424ee8313dca1552a2a3d505325fc0cdf25 php8.4-mbstring-8.4.24-1.el10_2.x86_64.rpm ee30514668a65910aeace51f5440c29b9ca0b66f3774cf08167c81a929d98ff6 php8.4-process-8.4.24-1.el10_2.x86_64.rpm f54af068b74042903469dc96e4fe408178097833374cad3598d9e417fe0372d7 php8.4-embedded-8.4.24-1.el10_2.x86_64.rpm fe825dfd5c07c50438a97b4bcdd846896d2c6beddba09e15e33e92bb88451207 ALSA-2026:56971 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Date-Manip security update

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time. Security Fix(es): * perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-Date-Manip-6.94-5.el10_2.1.noarch.rpm 10d103055b714ff49d9c99838b44a6ae39437022daa8f3446516cf8eca19f1d6 ALSA-2026:57015 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010) * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011) * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012) * glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015) * GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering (CVE-2026-15588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.21.x86_64.rpm 59123927ef48f258fc7602f10780579f8bc9166daefa21e71996246d530381f4 glib2-devel-2.80.4-12.el10_2.21.x86_64.rpm f12478a7b0c3e327e1ed0a48ff750316d379c7fd33a402d61f4d926dad6dcf4a ALSA-2026:57126 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.2.x86_64.rpm f7b3d69bb1457d588b7192a2461cc6e1f4648282281281dbca281ac728f2f1ec ALSA-2026:57148 Copyright 2026 AlmaLinux OS 0 1 Important

ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. Security Fix(es): * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ansible-test-2.16.16-2.el10_2.1.noarch.rpm 278ed7a9b385cb985f51b9a6e708b16d47cae71cb98ba0d3c8d13b7c71d3f0de ansible-core-2.16.16-2.el10_2.1.noarch.rpm 9e56e424dbf2c5ad2a45a0dfbe4d711e036865c0a60139679f71bec6f32d2897 ALSA-2026:57251 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878) * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185) * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991) * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379) * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386) * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560) * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388) Bug Fix(es) and Enhancement(s): * CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:AlmaLinux-223954) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z] (JIRA:AlmaLinux-224545) * cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459) * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z] (JIRA:AlmaLinux-235812) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.49.1.el10_2.x86_64.rpm 1b64bbf500ed7559f46ca0fafae11580a64e36040ab2e148da32a30aeabf87fc kernel-doc-6.12.0-211.49.1.el10_2.noarch.rpm 246731a322c2c865a9e626b9c0be133018206f6db8652c48453d46fdc34459d6 rtla-6.12.0-211.49.1.el10_2.x86_64.rpm 27899839d91439d6685e5860e38232f90e557406663fea61bfc035bd6883e44c kernel-debug-devel-6.12.0-211.49.1.el10_2.x86_64.rpm 28f3180cc4fe3d609fa2130810afce005cfe01b528f03d961ec39b3a574acc3d perf-6.12.0-211.49.1.el10_2.x86_64.rpm 6c0d251012a422c98a53f3ab1527eacd99f5524e6676422ece447a6ba8771305 python3-perf-6.12.0-211.49.1.el10_2.x86_64.rpm 782fa0ae6e654ab5f94bbff5f26491ad3fd3d2d49b2772fe12da002bb02d5d33 kernel-debug-devel-matched-6.12.0-211.49.1.el10_2.x86_64.rpm adffc2cf1cff2b0509008880a17b3c5b38059d57d88762ad0be390202a49836f kernel-headers-6.12.0-211.49.1.el10_2.x86_64.rpm d5c3a214be5e682bcc455438accb8e72c14da15ac75f188dd3236fddfaa931e0 rv-6.12.0-211.49.1.el10_2.x86_64.rpm d6fbfa3788caf4af9a12a894f11c8e767cd9111343ba4c19ca030b154654ffda kernel-devel-matched-6.12.0-211.49.1.el10_2.x86_64.rpm ffe3944323ea9dbe4fd355a56958743d6d1b3d4df34851ee5c4defa832a2c787 ALSA-2026:57596 Copyright 2026 AlmaLinux OS 0 1 Important

mrtg security update

The Multi Router Traffic Grapher (MRTG) monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic. Security Fix(es): * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation (CVE-2026-72694) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mrtg-2.17.10-12.el10_2.1.x86_64.rpm 21c5f6e10da605a7de9458938359e03c4e86c97e2749a879163c2a4cc1ae3dbc mrtg-selinux-2.17.10-12.el10_2.1.noarch.rpm d7555e699b1e01e77cb85e1fbe4038f3f7826311959865d40f4c38eed8aa6134 ALSA-2026:58571 Copyright 2026 AlmaLinux OS 0 1 Moderate

qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914) Bug Fix(es) and Enhancement(s): * qemu-kvm hung during drain after double pause [almalinux-10.2.z] (JIRA:AlmaLinux-190702) * qemu-img create/convert fails on target block device with 4k sector size [almalinux-10.2.z] (JIRA:AlmaLinux-207389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default qemu-kvm-block-curl-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 1236821408127bbd2d6f3a3d49f5db58473300a909a4121d5ee9d006b2ae5413 qemu-kvm-docs-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 283592d5fae244cb713314747ea02a9f3ef2b0f4a43ff2ceeb1a3b0523a8d0e0 qemu-kvm-common-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 2f5b93b55745e9563093a15420abc37c79443344363ea05c1028b13b03e3c61c qemu-pr-helper-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 31346edcd9bda3ab9765ceac3e82fe37bec264d19ac77a32d3aa2b73e8bd5eb0 qemu-kvm-ui-egl-headless-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 3cb43f4e40d212cc82d6342758fed1d337a6ace4fd97da2afea4dfbc08da4b12 qemu-kvm-device-usb-host-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 45ad31169fb296a10f22965b6ad010e1c16877bd61b38ddc4ee8406dbca7d26a qemu-kvm-block-blkio-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 61b305e09a8824ad98c06061c5737aee20bffc76ac6662b76ad7a16dacabd9d7 qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 65e47e9f91b6feae93a44a079eb4f3cc26857cb820515babe4e66236323c1a25 qemu-kvm-tools-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 7436b8194ca0f029571828d75ab481ec03b2459f9ee38f82a15f914500e4def6 qemu-guest-agent-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 7c1c0dae7d844840a179c76ca2672391ae62d71f608e2869e94624bf4f75c247 qemu-kvm-audio-pa-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 98e4890bc895bc4107f8c0d1102a3d16676934b07bcb1d632623b10b433597aa qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.5.alma.1.x86_64.rpm 9d803e4b167a1350f94ae30394fcda32169cfcd655d98eda3f1dcd2ae42886b0 qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.5.alma.1.x86_64.rpm a4cca8f9f58eaf145c9bc5d8d48db5ec7da0671ce3391b69cbeb1c6cc43fcc02 qemu-kvm-core-10.1.0-16.el10_2.5.alma.1.x86_64.rpm a9747ca654bb5881d64f7b1f40928239db5458a6c597b180015ad7a8a4024d02 qemu-kvm-ui-opengl-10.1.0-16.el10_2.5.alma.1.x86_64.rpm b318c4ab8e11283746fb9b758b1769f3db17a2db7ac7fbefdee57021ec470309 qemu-kvm-block-rbd-10.1.0-16.el10_2.5.alma.1.x86_64.rpm c2f577523e52d4ad5e3afc1aabfeb1d32ae1aecb6d6b580b01fb2ee9ac838e63 qemu-img-10.1.0-16.el10_2.5.alma.1.x86_64.rpm df4c83874215552d1e730bf992361e688a56385a60b77483b22da87bfbfde18f qemu-kvm-10.1.0-16.el10_2.5.alma.1.x86_64.rpm e94420791e32657a84c15f9d40e71c957f055354c24e1cb1e96a8e6e640746ee qemu-kvm-device-display-virtio-vga-10.1.0-16.el10_2.5.alma.1.x86_64.rpm fceaa0f097013a15888368e3c7ca32aa1c46a08a74299a4422502b5b6a692caf ALSA-2026:58819 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch.rpm 0b5823d155438be9e50559a2b2516af1f168e0c86471037562a2f1a8b8cc92f1 nodejs24-devel-24.18.0-5.el10_2.x86_64.rpm 34f7cad2a2ffec5b68bc403b3d7c28f643a518f1cf8a4a6cd2d46f5ad6918268 nodejs24-24.18.0-5.el10_2.x86_64.rpm 49da1ea61d5aed1a3c78a67b0ee8cef771cc9c3325403f976137ddee5908b533 nodejs24-full-i18n-24.18.0-5.el10_2.x86_64.rpm 6d239c21d03b2447ea8672e1e28729df24938248e48ea97bc5ec0b8ff737428c nodejs24-libs-24.18.0-5.el10_2.x86_64.rpm cb9972ea7fda5f1e770ac7f6faf20ebf392c9b334cb3c0e5ca05f94d6602b428 nodejs24-docs-24.18.0-5.el10_2.noarch.rpm f376c79686cb878dbaf4e4b6b47534b7dad0ad97bbd2d659ad2f239bdb1d023c ALSA-2026:58899 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component (CVE-2026-74983) * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-74943) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component (CVE-2026-74941) * firefox: Privilege escalation in the Shell Integration component (CVE-2026-74965) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-74946) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-74949) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-74940) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-74969) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component (CVE-2026-74967) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-74944) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default firefox-140.14.0-1.el10_2.x86_64.rpm 722c88370a7bc0fc2eef6673c089e7a9db7324bf8f52152bbb29716a34d06d6c ALSA-2026:58902 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-devel-3.12.14-1.el10_2.x86_64.rpm 42e42fa85b751b9ec9e65c13cee68265bcabb65da97b8c546f3b9bc47b354972 python-unversioned-command-3.12.14-1.el10_2.noarch.rpm 432002d2f2d16400a23c31dbfa20b3800372adba8054dfdfcb8877898640e6a9 python3-tkinter-3.12.14-1.el10_2.x86_64.rpm fde239dd3894aa68a07ddd36bc83d80b5f3d234434903696fbb77eb56d3f9eac ALSA-2026:58927 Copyright 2026 AlmaLinux OS 0 1 Important

sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sqlite-3.46.1-6.el10_2.x86_64.rpm 864c27ea1f1337a7bb7572df090467c534f84ba324d708e958b75058f6a93f66 sqlite-devel-3.46.1-6.el10_2.x86_64.rpm a0ee471eab3819dd7573451895d33d2694405d6f7bc6011800e0125f6d4c9c3b ALSA-2026:58928 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3.14-tkinter-3.14.7-2.el10_2.x86_64.rpm 13ed5e5d68fed1d3be6be7790852810a6865ccb7858bd908927826e16515041d python3.14-libs-3.14.7-2.el10_2.x86_64.rpm 275edda095f95dd90a0f59205a1df11d49285df3b05fc3a89e9b666513213706 python3.14-3.14.7-2.el10_2.x86_64.rpm 7a86f2f063112fc02648a52f12e551f074bd96b449b289e064ed5910b0cf687c python3.14-devel-3.14.7-2.el10_2.x86_64.rpm 975225deb13fe8a690876ad8b9d685cec38a41d9ba55fc31446bcde485d0c56c ALSA-2026:59097 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-base-tools-1.26.7-2.el10_2.1.x86_64.rpm 866b6e54ced6fbbfff2f08fd7f27c545a931b14fece2c3ddd0f0c474501bb056 gstreamer1-plugins-base-1.26.7-2.el10_2.1.x86_64.rpm 8cc222ff6fdb077e48777711598846c3928a1e2c631b7456c157f060af00ca68 gstreamer1-plugins-base-devel-1.26.7-2.el10_2.1.x86_64.rpm d28ac1e2d72c6c420538b4dc33e895d7d99c2b77ef3adf7901fdf7ad3c0abb2a ALSA-2026:59133 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296) * gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.7.x86_64.rpm e2c5296fdae500fbd6100a6125dd5d127390eebbec359a74f0d27bbf19b6d539 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.7.x86_64.rpm eabe1030bc14f61c43c9dc8b574182a15b5c76471c9f812049737452260375a6 ALSA-2026:59220 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nginx-mod-http-xslt-filter-1.26.3-6.el10_2.6.x86_64.rpm 0808efc64090171052224cb49954c8883337aa5ab63138a0d26541e8de9ee0db nginx-all-modules-1.26.3-6.el10_2.6.noarch.rpm 0ee1da66b42d7a7309fa3e289c5fb632caccf67d24aeab9708c03be35a50dd93 nginx-mod-stream-1.26.3-6.el10_2.6.x86_64.rpm 1ad1170c1210c1687daa057e774f50f954a385c49870218ecf084c09c301ac51 nginx-mod-http-perl-1.26.3-6.el10_2.6.x86_64.rpm 3e10f861824615855c8f54bb92a0674a2489d411f1781497774d73714afb2c85 nginx-1.26.3-6.el10_2.6.x86_64.rpm 53286c61c223a0e039c4545c2f2992079c0a5c6e9a21cd03ed05bab9a0d197c4 nginx-filesystem-1.26.3-6.el10_2.6.noarch.rpm 6a4302dfb7471b2cc3f0c8e4f7944909387b627464c4efe14fde80d576b946c0 nginx-core-1.26.3-6.el10_2.6.x86_64.rpm 727c3921fd7052ff2bb79c637111e39b9bd3635c9f00ec04cffd7092e968a084 nginx-mod-mail-1.26.3-6.el10_2.6.x86_64.rpm d10ae0f9bde0d7030ce1c95922b068fdaf8519d5e5a5fcb16baa9dae954a6662 nginx-mod-http-image-filter-1.26.3-6.el10_2.6.x86_64.rpm e06ade48e942e2761d888a9a6d2f1d812e0516c29ec5310c870b650c65e211a9 ALSA-2026:59243 Copyright 2026 AlmaLinux OS 0 1 Important

python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-pyasn1-modules-0.6.2-1.el10_2.1.noarch.rpm 05edb19dae2edc37e82548abae6af2808fd01ad0c9fb7d6e914cb343e2182e02 python3-pyasn1-0.6.2-1.el10_2.1.noarch.rpm 5a44c6804ccdde9b93b518b3d47f1187e4ee407ae6a058b986bc2fa52399e8bc ALSA-2026:59372 Copyright 2026 AlmaLinux OS 0 1 Moderate

assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing (either with JUnit or TestNG). Security Fix(es): * assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default assertj-core-3.24.2-9.el10_2.1.noarch.rpm 2001c3bdd1cac076d06f46697038efbcaea5ed8fff25714109166daf9b16ee5c ALSA-2026:59379 Copyright 2026 AlmaLinux OS 0 1 Moderate

pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default pam-devel-1.6.1-9.el10_2.1.x86_64.rpm acd1089f05216ad56391d61eb22f5873cb5b29d795d2c8c9a6d300fcfbfd4792 ALSA-2026:59380 Copyright 2026 AlmaLinux OS 0 1 Moderate

attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fix(es): * attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libattr-devel-2.6.0-1.el10_2.x86_64.rpm 634b886c1bb9fe5de4f7ac1fdb44b14583274da83472f3ffe80290b2dbde2dea ALSA-2026:59972 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.8.x86_64.rpm 537380fddeb7182a87a3f017a7ee8e288e129f21df523d5f881353bc1d51ae93 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.8.x86_64.rpm efad7a765adbaf9b1f092eaf8e9e7a9e602ca24652a87789ad6be4dde14390d2 ALSA-2026:59997 Copyright 2026 AlmaLinux OS 0 1 Moderate

polkit security update

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fix(es): * polkit: Polkit: Denial of Service via unbounded input processing through standard input (CVE-2026-4897) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default polkit-docs-125-4.el10_2.1.noarch.rpm 305e34938bffb0db90d5a6ec9e239162450d0c39bf641873dcc7b0598bf2930e polkit-devel-125-4.el10_2.1.x86_64.rpm b3a40dbc9a5856812aea54ba675dca1e274549be1f49fbdce1670a27e1b31c83 ALSA-2026:60004 Copyright 2026 AlmaLinux OS 0 1 Low

httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default httpd-filesystem-2.4.63-13.el10_2.6.noarch.rpm 2d887c9658de80e5f018347a72ff0e89acbb079bbd7a748b53ca6594ecae718a mod_session-2.4.63-13.el10_2.6.x86_64.rpm 5097b51285d6b4e00d71f154b32d277040c26b0ffe829469478169e450577288 mod_ssl-2.4.63-13.el10_2.6.x86_64.rpm 597fb60fcb05d4b370483899ed1ad3992f71d55b5d1dd688e58afdd833164d64 httpd-manual-2.4.63-13.el10_2.6.noarch.rpm 69567bdd1024b64882fe35313f7a8f2549cab4b9a577ea66ad31608c30f9ff84 mod_proxy_html-2.4.63-13.el10_2.6.x86_64.rpm 80cd77389a74cbcc8933d92c02ca9454181a6da99dc0ef1a218cf14527da9e26 mod_ldap-2.4.63-13.el10_2.6.x86_64.rpm 8aafb883fa7a276a7f45307049c300acc610e1d6ceac026ac960c74ff326f55f httpd-core-2.4.63-13.el10_2.6.x86_64.rpm a9fbe1b51139882dbb1a2a9a7e86053f692c981973f18e221586ab3b0e6d28b9 mod_lua-2.4.63-13.el10_2.6.x86_64.rpm aab0d8e9f08e1747fdac943e28b997039a614cc5a75c49ed10a256edded5a9bf httpd-devel-2.4.63-13.el10_2.6.x86_64.rpm b6ca857ee0d9dbfe7ad9ac04d5c4d184b1ce5ad1737c5866f1cb759ecfbbe565 httpd-2.4.63-13.el10_2.6.x86_64.rpm c4336741283c2b3719a4dd7fa42e7ac633fc8d21c8ce22ee20b2814f35849633 httpd-tools-2.4.63-13.el10_2.6.x86_64.rpm e4c19e5e256dffe1193b037314bd3a1343cdfc19decac9104c34230a318aa062 ALSA-2026:60306 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.7+1 [almalinux-10.2.z] (JIRA:AlmaLinux-246423) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default golang-misc-1.26.7-1.el10_2.alma.1.noarch.rpm 1923dd6592518a5d2f4e4eef0ff7f7bf3b611a49230e03cd40caa092e84f83c5 golang-bin-1.26.7-1.el10_2.alma.1.x86_64.rpm 298d01ff427510db0b1c54740f88ff56cccee7b5e86e228d32a9521f46fea17d golang-tests-1.26.7-1.el10_2.alma.1.noarch.rpm 2cd7fa5d945a940c336d1817cb06f166edf8869a955ca3e7b5638d0f77886aea golang-docs-1.26.7-1.el10_2.alma.1.noarch.rpm 36167694db02b79aff2148f3934c8d4bd287c3615d93d5a40f6356796ff2e299 golang-1.26.7-1.el10_2.alma.1.x86_64.rpm 7892146acf13776d9d73e8d8edc979c21ae3624df6db90b7bb4a4b3e17b4902a go-toolset-1.26.7-1.el10_2.alma.1.x86_64.rpm c3b92180f6c6dc56fa8043fce9d72ca28b4914605d10abcda187088807c813b4 golang-src-1.26.7-1.el10_2.alma.1.noarch.rpm db81e8b2dcb9cce76b60048edd375ec23e8fb6a055cbceb28ee21bb48274cc6e golang-race-1.26.7-1.el10_2.alma.1.x86_64.rpm faf54974441ec3ef91539f16303c9c49c653d67aabeab27ef36c3b9b81abe112 ALSA-2026:60394 Copyright 2026 AlmaLinux OS 0 1 Moderate

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.3.x86_64.rpm 530f9744c95283d8741e1e384c19f99d6f2ac646259f15d6ffd6c49b7a635d75 ALSA-2026:61241 Copyright 2026 AlmaLinux OS 0 1 Moderate

pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: RAOP RTSP NULL Deref (CVE-2026-14324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default pipewire-utils-1.4.11-1.el10_2.1.x86_64.rpm 1e27724c284f1990bdc97f0fee36bc447a9acbb960926cf3445676f5e954176a pipewire-jack-audio-connection-kit-libs-1.4.11-1.el10_2.1.x86_64.rpm 27494033befbb2f837ce805936ed7d352b68e5e288b7b4d7a880e453f1b8e92f pipewire-libs-1.4.11-1.el10_2.1.x86_64.rpm 29d76fa8e6cf72f8c4db8da9fa48f3226db6622706984c4404d7319bd047625c pipewire-jack-audio-connection-kit-devel-1.4.11-1.el10_2.1.x86_64.rpm 2cf6bac23ab881f24f1cd473bdf7d50bb58ff209d3f084e3eaffef8ae93e6136 pipewire-alsa-1.4.11-1.el10_2.1.x86_64.rpm 43f15e8123ac159cc45eb90445d1d8436c131e73cd240b5e187ec216df1b0104 pipewire-gstreamer-1.4.11-1.el10_2.1.x86_64.rpm 4bf3a808df9e76920fc63805bc87efbb2a7ab16b4e186f81978514243280f3e9 pipewire-jack-audio-connection-kit-1.4.11-1.el10_2.1.x86_64.rpm 76b3a44a0140dc0980b67be18fe01af1dde74e0e65c0a53fd7f033a67711de48 pipewire-module-x11-1.4.11-1.el10_2.1.x86_64.rpm 8bff850d907831020a61f03d6ddacfce1234ae69a83e9bc646585195ca9ac03a pipewire-plugin-libcamera-1.4.11-1.el10_2.1.x86_64.rpm a92afb17543b3cc29336f40a4d35891b2b3b738213953fd70b64e0e12b9ccd15 pipewire-pulseaudio-1.4.11-1.el10_2.1.x86_64.rpm c552f7a14a7a1589b1fb85b4e3ea8bfea21dbafb9f818192e9dc2bc4cbe39e9f pipewire-1.4.11-1.el10_2.1.x86_64.rpm c98989be1029fd3097b07ca3af54da1646473e44caa1e16743f85d26eb18d115 pipewire-devel-1.4.11-1.el10_2.1.x86_64.rpm dd1df745d513b2cbf6a425e74cd29ae17caa3b1e49326d9dc368b6a0998d27c8 ALSA-2026:61376 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs-devel-22.23.2-1.el10_2.x86_64.rpm 1c7b4f4ff7712e98509a87f3d9d4f451b59a50124dd44187d3f0bc9bfec225fa nodejs-full-i18n-22.23.2-1.el10_2.x86_64.rpm 89b877e731970bbc521888f580ea8c18acb77ca76bec158c5b87b7024d6ebe3e nodejs-22.23.2-1.el10_2.x86_64.rpm bdf5d005e60f96f54e11b50f08bb2566ede77d81e2c4ab25ec916d9937cb552b nodejs-docs-22.23.2-1.el10_2.noarch.rpm c9f5cc58213b857b0d4326ca1f1f1fd1cda4ecc64776646fcfb759c191300495 nodejs-npm-10.9.8-1.22.23.2.1.el10_2.x86_64.rpm e7b06590b0c48cdcd12f8a36cb775ac39dc1bda6a897b8248585e31b1b102d5a nodejs-libs-22.23.2-1.el10_2.x86_64.rpm efa1729f04db8181e645147d3824cf60af99da893d12d34cf34228f6465e2b01 ALSA-2026:61377 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-220543) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs24-full-i18n-24.19.0-1.el10_2.x86_64.rpm 404cf4c4cf08c5df63e9caadc936b58d046832905cf3f24ae29b633b118a2d27 nodejs24-libs-24.19.0-1.el10_2.x86_64.rpm 4bc27ead833f02a22a04a1042ba9ba141f797e06bf123aa8d68851943cf4a921 nodejs24-24.19.0-1.el10_2.x86_64.rpm 6392de1a5298d8bbd1c9bcd2508fdf9a4035a1001ba12308f979c6414c337d71 nodejs24-devel-24.19.0-1.el10_2.x86_64.rpm 9a0cd0fc0c4a5a09abc903879e50bea7af4a01c66e0f76bf4d22186731542e94 nodejs24-npm-11.17.0-1.24.19.0.1.el10_2.noarch.rpm afa3166dc5e00f1d8df5f85611a54b62dab8bd37e034efff70b640de418fbf6d nodejs24-docs-24.19.0-1.el10_2.noarch.rpm d3d3383f8710db59beae06da2be66237d330acc7d4a195352659f94e3a452149 ALSA-2026:61378 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297) * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301) * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288) * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291) * FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296) * FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304) * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298) * FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242) * FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241) * FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652) * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194) * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633) * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default freerdp-libs-3.10.3-12.el10_2.10.x86_64.rpm 02b593c2ce718108c46dc90e50dc68079812831679c58c85e6544e7900717097 freerdp-3.10.3-12.el10_2.10.x86_64.rpm 1ff7da8398234605de14b37775c8725fb44175bedeea338614c8ef2b3346490d libwinpr-3.10.3-12.el10_2.10.x86_64.rpm 441acdedaa25baa19270d4e34c9566d9ac7d23b9df10dae2147478c2e7cb43c3 ALSA-2026:61680 Copyright 2026 AlmaLinux OS 0 1 Important

iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (CVE-2026-71217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default iperf3-3.17.1-6.el10_2.1.x86_64.rpm ed92fc2ce38ca8a44340d33f8d5047e60c30110830ce05308b456c4605708c96 ALSA-2026:61887 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454) * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) * kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418) * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) * kernel: ceph: give up on paths longer than PATH_MAX (CVE-2024-53685) * kernel: ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419) * kernel: ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408) Bug Fix(es) and Enhancement(s): * AlmaLinux 10: s390: Revert support for DCACHE_WORD_ACCESS [almalinux-10.2.z] (JIRA:AlmaLinux-188180) * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-10.2.z] (JIRA:AlmaLinux-193043) * ss core dumped when there is an SCTP session [almalinux-10.2.z] (JIRA:AlmaLinux-212393) * [AlmaLinux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-218627) * AlmaLinux10.0 - s390/pfault: Fix virtual vs physical address confusion [almalinux-10.2.z] (JIRA:AlmaLinux-222507) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.50.1.el10_2.x86_64.rpm 0f857c0c521a0c612703070c8570e4af2fc5fbddf8307859d6bc90e6e3f09912 rv-6.12.0-211.50.1.el10_2.x86_64.rpm 14e639251c7242986456e8ad7deee1617fc22798132e0289cc088fd417c15fbe python3-perf-6.12.0-211.50.1.el10_2.x86_64.rpm 761bf08728f76ac6e506117e1a5fd79332bf736e0a10f029cfa711bebb0b90b8 kernel-debug-devel-matched-6.12.0-211.50.1.el10_2.x86_64.rpm 8d56352563a18df5bfea98ea5db66d1b67d482e4adb6c94051c51df428ae6431 kernel-devel-matched-6.12.0-211.50.1.el10_2.x86_64.rpm aafa98fe4780d47589817d2386eda5f2d694878af2427331fa75fd03d1c657ff rtla-6.12.0-211.50.1.el10_2.x86_64.rpm eaee116d72e23d9b96a459018aa3b997a97c352874a821d473b0b7407fa26f30 kernel-doc-6.12.0-211.50.1.el10_2.noarch.rpm eb72790272f507b41af75641e41929887bd00929b6c72f25db62b73df90181d8 perf-6.12.0-211.50.1.el10_2.x86_64.rpm f19dda27ce20e03514e6ca852e84062d39feb2f542f50d482c75ba9e5f94fa00 kernel-debug-devel-6.12.0-211.50.1.el10_2.x86_64.rpm f4aae77bd24c582a32ea153fa6bf3dca51c0650897bfc7b407326c50ec31dcf0 kernel-headers-6.12.0-211.50.1.el10_2.x86_64.rpm f71c4d95068edf72bc23fc1635335cf74ef67f6b3962442334afd174bc559f8e ALSA-2026:62142 Copyright 2026 AlmaLinux OS 0 1 Moderate

wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fix(es): * wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption (CVE-2026-58471) * wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute (CVE-2026-58472) Bug Fix(es) and Enhancement(s): * wget async unsafe code in signal handler context [almalinux-10.2.z] (JIRA:AlmaLinux-220498) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default wget-1.24.5-8.el10_2.x86_64.rpm 90fcb1cf158388279656eaabfe883bb51e76001298cea261c1dd23d96aaef2d4 ALSA-2026:62577 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default go-fdo-client-1.0.0-4.el10_2.7.x86_64.rpm 7928582ddb4a7ed969f44779c0be60496ff60d5d4fc69d55bb25e3ba01041abd ALSA-2026:62578 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default go-fdo-server-rendezvous-1.0.1-2.el10_2.4.noarch.rpm 0211aa299091abf4cfdbbe76f87520827c571e8db4a3770fdd0349a146e1d8c0 go-fdo-server-manufacturer-1.0.1-2.el10_2.4.noarch.rpm 84881985faeb5b98d8a5aa9bcdf5c151015a891734684a6dfae3071d412b6e96 go-fdo-server-owner-1.0.1-2.el10_2.4.noarch.rpm df71d99ab263c33a04002cecffd3691380cb99ec2d02cac000f9c35a6af35a83 go-fdo-server-1.0.1-2.el10_2.4.x86_64.rpm fe2a71a6200f1f679ee9f5e7ce34258fc78661c9fe3c625d9ade601bdf2e5c80 ALSA-2026:62614 Copyright 2026 AlmaLinux OS 0 1 Important

php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.3.33 for CVE-2026-17543 and CVE-2026-7260 in 10.2.z (JIRA:AlmaLinux-223946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default php-dba-8.3.33-1.el10_2.x86_64.rpm 04b57e5b76f432327fd0f1250801774ad4fc0038dea9912516ebe054d31d9c91 php-odbc-8.3.33-1.el10_2.x86_64.rpm 0da828bd58ed92dbfb2ab82ab288664ae84705cf3b2e682f01f0c225347acfdb php-soap-8.3.33-1.el10_2.x86_64.rpm 1b14e0fc2283a126519d0f0f974070e9d691ed37e92b987f6f367f6e83e075ae php-gd-8.3.33-1.el10_2.x86_64.rpm 1d712d98491b8e780c6ba4dd700606a5eeb2155dae0c822ad0e684745c9d375c php-embedded-8.3.33-1.el10_2.x86_64.rpm 202a84d79ecf1c1b236bd1e405abfdb5fb556531330cf1e0c530bc008acd7158 php-8.3.33-1.el10_2.x86_64.rpm 253fb22ce2a62a22b0dd14cd3e4913777dcb73229b4651bbc336a34d298cbe1f php-enchant-8.3.33-1.el10_2.x86_64.rpm 2c7a1ca07188e6ab2459a0bc0462b85f3c534e1666698b7050fe1233a3bcb24a php-fpm-8.3.33-1.el10_2.x86_64.rpm 5d3a63400f5e9cbd1c384a4699d36e6eeecc1fad7406f4fd791b5c2a6d93a2ed php-process-8.3.33-1.el10_2.x86_64.rpm 6012055efc22fd7af1b9e30e23c83f1fa0cf748960fb19221154106fdab5d079 php-mbstring-8.3.33-1.el10_2.x86_64.rpm 62a3c63a4b45358714a685bb8be1b70bb0265add7894c6af951edaa05007489a php-bcmath-8.3.33-1.el10_2.x86_64.rpm 6821e4643f5b25759b33ca0f7ec7a73daee6fc42c1a9a0bfec3163f143217d11 php-xml-8.3.33-1.el10_2.x86_64.rpm 945e50f42f25162a037ab5b196cf0c20aa6276fe5fa074c53748af202678838d php-snmp-8.3.33-1.el10_2.x86_64.rpm a303e95e4e893fdb6aa238ca6a8e980fb71c3ec10c4608f39ae9a3b551ee0e26 php-intl-8.3.33-1.el10_2.x86_64.rpm abe1e4e0c3509a0a2d90cbc8c0cdf6ec6ca99a9be46aa64c40446807efb71c8f php-pdo-8.3.33-1.el10_2.x86_64.rpm b5ce6edfe35c07449d6a4fe2745713f7c338f9abefa50c3f985967b8b298efbe php-ffi-8.3.33-1.el10_2.x86_64.rpm b68a8077e2eaa43498b9b56b14c7fa495f9c6c955e5324969e255031051a13d8 php-mysqlnd-8.3.33-1.el10_2.x86_64.rpm c285ae1e32e51e993f2497b723a23543024aef464a2f6df7e84ad5b7c9654414 php-dbg-8.3.33-1.el10_2.x86_64.rpm d066907beb6cf6f1530f916903dca2c17428100d1354c5bd348c05bc0d946e18 php-devel-8.3.33-1.el10_2.x86_64.rpm d5071a8cbd20202afca4ba485e97ed47c34506d009c409bd9932b4b24fab7737 php-opcache-8.3.33-1.el10_2.x86_64.rpm de8fe0613dc4f514ddc939dac89176776e8ff5575d055eb101013051770dca3f php-pgsql-8.3.33-1.el10_2.x86_64.rpm f1238a2729e9990dcdbc5969402075845abed0ca85eb7a9e59b6db9bbbdc8389 php-ldap-8.3.33-1.el10_2.x86_64.rpm f1baf6e7b5ba61ab339eb8740edee3ccded9969fc470adeefaecaac644ed1160 php-cli-8.3.33-1.el10_2.x86_64.rpm f3e42d8594b4a22ea8b74fb53a176c4e91eeb8205495a56f92133a2aafdfc7d7 php-gmp-8.3.33-1.el10_2.x86_64.rpm fa5954cce1231518009b403a0e9cfbf5c47b54a908c7ba6c6daa625d41bbabdd php-common-8.3.33-1.el10_2.x86_64.rpm fb739593d1e44fdabc0e997e4098f83aafc329b9850e15c37d5b109d0c96d12c ALSA-2026:62631 Copyright 2026 AlmaLinux OS 0 1 Important

golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ipp-usb-0.9.27-7.el10_2.3.x86_64.rpm b1745b11d84bd36ac6522cc1225a4f5fad7cccf0d71681dbae418568142f1f36 ALSA-2026:63022 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default grafana-selinux-10.2.6-28.el10_2.5.x86_64.rpm 4bb69e7d7f3a939bfe6c072210b288eef2c413cf1fcc12890f8052c0ee2c6e4c grafana-10.2.6-28.el10_2.5.x86_64.rpm ce286716719c3207341351138103803c02a89d831f2ebd339ea2f16d61fff0b6 ALSA-2026:63119 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default grafana-pcp-5.3.0-8.el10_2.1.x86_64.rpm 16e36c641aa867ee6968f3cebef1f99dd436044267a6771f780746ec8417b135 ALSA-2026:63128 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073) * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808) * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824) * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145) * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-perf-6.12.0-211.51.1.el10_2.x86_64.rpm 18b1c22e2338a203499af26b0c4a020c6a586f3553acf999af4b49dcc8d99be7 rtla-6.12.0-211.51.1.el10_2.x86_64.rpm 20209c82a70d73203612db81e93fde919e52c70c6c2fb283287fb6e6d166d69d kernel-doc-6.12.0-211.51.1.el10_2.noarch.rpm 2e6e4a832d51991724a1696b6c38060e1abc354ca0d461f7a161f2499a8db46f kernel-devel-6.12.0-211.51.1.el10_2.x86_64.rpm 49f2f6c4b73d6db9122b40e9869c076665e46852d91926f1053391368b93d7d5 kernel-debug-devel-6.12.0-211.51.1.el10_2.x86_64.rpm 56125dae36e92cf3f861841491a0cb5338851943276f76e8e53c30aecfd7b628 kernel-devel-matched-6.12.0-211.51.1.el10_2.x86_64.rpm 7544702dc53ba812552731c44319fba84f500827b98944dc0f522f83a94c3412 kernel-debug-devel-matched-6.12.0-211.51.1.el10_2.x86_64.rpm bd47596cdc7e99b5dc597dc8149e8407beef2c0f951b1ff17b3860fc1c34c7f5 kernel-headers-6.12.0-211.51.1.el10_2.x86_64.rpm d29eb9c5e48ceeb3543c7ea44eaa38441f16886dd6bf537d2f4ebccdcfdf34c8 perf-6.12.0-211.51.1.el10_2.x86_64.rpm ee0994663ab6d482d4ac819138d4ea702f042f804911fef8523b1aa6b64657af rv-6.12.0-211.51.1.el10_2.x86_64.rpm ef245948263e53379a126d487bd418c2a54c692ae31802ce3daf2746797417a1 ALSA-2026:63332 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default buildah-tests-1.43.1-5.el10_2.x86_64.rpm 25806580b50c8b7343603ab6b36f92657e16bfc2ad39c4792778ddf2ba2ad3a6 buildah-1.43.1-5.el10_2.x86_64.rpm cebd63f92d338a05f2efed0b2693383da1940d115cedc1b383e9eac9ee97e6ff ALSA-2026:64777 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default buildah-1.43.1-6.el10_2.x86_64.rpm 5dc816f327b8ea80f8d82d4c844373cfd5bc4f6ce728ef62feb9992f98102ad7 buildah-tests-1.43.1-6.el10_2.x86_64.rpm c9a90b64cc2b4da227a9a55c7eeb15454233160de6cd0e64948d8b034ee5e6bc ALSA-2026:64785 Copyright 2026 AlmaLinux OS 0 1 Critical

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) * 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701) Bug Fix(es) and Enhancement(s): * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-10.2.z] (JIRA:AlmaLinux-244470) * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-10.2.z] (JIRA:AlmaLinux-248770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-lib389-3.2.0-10.el10_2.noarch.rpm 307a5e67b7efa8839b6753d9a1070e7d39a56a06e6b646f7e9121a21f6a89d52 389-ds-base-snmp-3.2.0-10.el10_2.x86_64.rpm 3ee2ce92c1076d455c20e5b403fba6a2c364e735e441b979dd3fc90aa52ed214 389-ds-base-3.2.0-10.el10_2.x86_64.rpm 58c71005c982714fe0ea365350a60783636a9cec730d8439269dea27c03e5a0c 389-ds-base-libs-3.2.0-10.el10_2.x86_64.rpm 6e2fa8309f92ffc7532bac952f621a4de3d546d4d962296e88513972dcbc6321 ALSA-2026:64787 Copyright 2026 AlmaLinux OS 0 1 Moderate

xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fix(es): * xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default xz-devel-5.6.2-4.el10_2.1.x86_64.rpm 783c86a645dce0b7878ce7afbf2e29f79cd8146d61152accbc90bc02f3d35d57 xz-lzma-compat-5.6.2-4.el10_2.1.x86_64.rpm dfc2b56d7baf07beff0978c3148bcf777b40f2d4a6c0133dfd6b97384878bd38 ALSA-2026:64788 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.7.x86_64.rpm da9124ff6de216c5bc39749a408a050c01ddcfcbf444a046cbcef4c003c9175b ALSA-2026:64795 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-cryptography security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building (CVE-2026-69249) * python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees (CVE-2026-69248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3.14-cryptography-45.0.4-4.el10_2.5.x86_64.rpm 77debc3844f9fef8f7c321e66cc7d1edd9aa9f72186a0962f05f40b265675eb7 ALSA-2026:64796 Copyright 2026 AlmaLinux OS 0 1 Important

valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373) * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639) * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684) Bug Fix(es) and Enhancement(s): * [Tracker] Rebase valkey to 8.0.10 (JIRA:AlmaLinux-216776) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default valkey-devel-8.0.11-1.el10_2.x86_64.rpm 3f602700b2b25301c44acff3b9afc2c09b4e70eb9f7328c3731ca706e88f8eda valkey-8.0.11-1.el10_2.x86_64.rpm c81c63eb584ef4385459cf04e9634a67bfdcfa8f30356f089b65506c5a788cb8 ALSA-2026:64799 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.22.x86_64.rpm 322e02bcb95e90e91088d98949d68bdab3f759305f9e3fc24a432fb83180c3a1 glib2-devel-2.80.4-12.el10_2.22.x86_64.rpm 3a59b75aee9c7cb2c7e5527c033046c72bbbfdfde7fa4aef62f4f2fbffe22304 ALSA-2026:64810 Copyright 2026 AlmaLinux OS 0 1 Moderate

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking (CVE-2026-50219) * expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow (CVE-2026-56132) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.3.x86_64.rpm 69afe5509f4039c072e070f50cda1ed3ca080fb5bca6a8b8dc4d81298354c1ab ALSA-2026:64818 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default skopeo-1.22.2-5.el10_2.x86_64.rpm 39ed28b8cabbe50a788258d9ce38880e7662ac19237da76c333f9f6b7d0ac828 skopeo-tests-1.22.2-5.el10_2.x86_64.rpm 584da2343656cc9ec80c217f58e15e27dec1a180e1ded93c5e8837b417cd4f7c ALSA-2026:65116 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default opentelemetry-collector-0.152.1-2.el10_2.x86_64.rpm f214244a936aa43eed11c871a903b8ec9884c10353cad8326a44628df78092ad ALSA-2026:65159 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default thunderbird-140.14.0-1.el10_2.alma.1.x86_64.rpm 91379a3f88d196f907f5799a7d663236bc4a7521cc0d601ca8255d908961e28c ALSA-2026:65162 Copyright 2026 AlmaLinux OS 0 1 Important

gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See <https://access.AlmaLinux.com/support/policy/gpsd-support> for more details. Security Fix(es): * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-gpsd-3.26.1-3.el10_2.2.x86_64.rpm 861eb1ec639d46b8762318d0c2d469c57191bbb798bb9d40a185b89a720ed7f4 gpsd-3.26.1-3.el10_2.2.x86_64.rpm b42da7f8e49d33f8611af6d61f9303137bca859cd294cef6df27b507ea247398 gpsd-clients-3.26.1-3.el10_2.2.x86_64.rpm e8d034ce0d3d82f0fb05823f279262d41b9306212f1add030074220907bff882 ALSA-2026:65334 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182) * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947) * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944) * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946) * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117) * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037) * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113) * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042) * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051) * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255) * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515) * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307) * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193) * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) Bug Fix(es) and Enhancement(s): * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [almalinux-10.2.z] (JIRA:AlmaLinux-193027) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.53.1.el10_2.x86_64.rpm 0d35ca5f2601e67c6eddaafdbca07a3bffbf313948922710e519b29655790442 kernel-debug-devel-6.12.0-211.53.1.el10_2.x86_64.rpm 22f742dbb17f958b216683f3fd4c382fde853f5bb17431b4004add71baadc4d6 kernel-headers-6.12.0-211.53.1.el10_2.x86_64.rpm 234b720e4f3a59bce2537e48dabe18e72a17e07a9b57dbc7db9e373dcf71773c rv-6.12.0-211.53.1.el10_2.x86_64.rpm 2ae0b6a0fc3356e0279bf2d7a5ef80fcb2ebdee8c596ec06945d7a37fced2a0e perf-6.12.0-211.53.1.el10_2.x86_64.rpm 3667d68ffbbdf4aab184bb163edbeb838c05c807df5ad30df533d5bcc4c39223 kernel-devel-6.12.0-211.53.1.el10_2.x86_64.rpm 541baa62df6d0fe8813ce0d6dba23e294b3dbfbcfa3e6846d491ca18a1a724b0 kernel-doc-6.12.0-211.53.1.el10_2.noarch.rpm 695853f20bc714f3bd01366c739f95984ef9c54dd00ee1004b69189f11177cf7 kernel-debug-devel-matched-6.12.0-211.53.1.el10_2.x86_64.rpm 7b993d2c74e0ce0213ff7dcb5bd7d9e36f1e8560dcc891096e30070df010d8ed python3-perf-6.12.0-211.53.1.el10_2.x86_64.rpm 8ab6f104f567d2a68029f002b7abebb31f74b0e174c89002f25143f30942e2d9 rtla-6.12.0-211.53.1.el10_2.x86_64.rpm a56c22cd35f9d7be8d5b8ed9a95753060e84ef91dccd05180f616c53a7d37392 ALSA-2026:65816 Copyright 2026 AlmaLinux OS 0 1 Important

qt6-qt5compat security update

Qt6 - Qt 5 Compatibility Libraries. Security Fix(es): * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default qt6-qt5compat-6.10.1-1.el10_2.1.x86_64.rpm 1dd0612a1f7f8bee7d572e1e254164b54d760f46e74c52114ddba2c60bc9435e qt6-qt5compat-devel-6.10.1-1.el10_2.1.x86_64.rpm 5f9f4cbdf8ccab581ac01ecb5efe75df498ce892f6814def0ac60ae7a1982811 ALSA-2026:65887 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-19546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.4.x86_64.rpm 18320c51d264bfa1d2fee9a4877b6cc4b061fab58e71b1f0b34f31f3c23155ea ALSA-2026:65899 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile. Security Fix(es): * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postgis-client-3.5.3-4.el10_2.1.x86_64.rpm 31cc4eec07d032c136c4e6d1c64badfba8fb9e4f44b142f55c6dfa5f1ac1bda7 postgis-upgrade-3.5.3-4.el10_2.1.x86_64.rpm 4640e70cbca155a80033389733d90993dfaee8088a82e5f5d2d5ad69cb54794f postgis-docs-3.5.3-4.el10_2.1.x86_64.rpm 58a2e351a420490951328123d67c2a5b0397c342b989e46cc2b7c16db16f4331 postgis-3.5.3-4.el10_2.1.x86_64.rpm 82b50f97907575c1934705602810902a768ecc3462c2a6bab41c3c4a23613fe0 postgis-utils-3.5.3-4.el10_2.1.x86_64.rpm f6909ec0dd1842efef43a66ca34d3f9108dbad5536a7df3634364e991cea53ed ALSA-2026:66336 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420) * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859) * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892) * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857) * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076) * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072) * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078) * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default vim-X11-9.1.083-9.el10_2.20.x86_64.rpm 05693210c958f5aaeb8bcc116117d46fbb6b577c23273c7cf6cfaccca34aad6d vim-common-9.1.083-9.el10_2.20.x86_64.rpm 152f617a009f93965234283251f80adf016adbd1fd9238f15d145f7159ff1b77 vim-enhanced-9.1.083-9.el10_2.20.x86_64.rpm 1e5e5432f743b2140b376428c6f81158157849a0135623ddd3f5af71c0bfb386 xxd-9.1.083-9.el10_2.20.x86_64.rpm e96429a933e6ffd90ba2b847daaede28f52a4d320302182f642444b492393ba6 ALSA-2026:66355 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rtla-6.12.0-211.54.1.el10_2.x86_64.rpm 0b4d03117c31fff3366412ee5b37f584aef2628bff4976fd08e6512cb48bb880 perf-6.12.0-211.54.1.el10_2.x86_64.rpm 290f3d446629da91adcf7f778c97864567018c912b35bfef8b4da04de13d5164 kernel-headers-6.12.0-211.54.1.el10_2.x86_64.rpm 2c843ea4bc654197cf0b406c1f92b2da41e7bc6fa4c006394c6dcd9c3c240d0c kernel-debug-devel-6.12.0-211.54.1.el10_2.x86_64.rpm 4241cefe84c49c139dcbf147e8321e1076c9f56ad433642687ca10fdaf05d4f1 kernel-debug-devel-matched-6.12.0-211.54.1.el10_2.x86_64.rpm 4359085b492ea241cd1189de718a9359e44a2c02d251403fdb887d8a666be61a kernel-doc-6.12.0-211.54.1.el10_2.noarch.rpm 7211c764f3e75c59e014b6650c3e0ec6f19553aef6819b3853a7c4b27ea7a704 python3-perf-6.12.0-211.54.1.el10_2.x86_64.rpm 94fbb5625b56190ce72d3594261b2efe8ccda87504e5e62e208791eb883b5dc7 kernel-devel-matched-6.12.0-211.54.1.el10_2.x86_64.rpm ac598a9c173b27798c72827493332c38094de4548561871b9d5501cdb56c97ce rv-6.12.0-211.54.1.el10_2.x86_64.rpm b7e0bd8e85132b763edac67596d0ac14e4ccd0daa7b27121bb7ce2da3240cf4f kernel-devel-6.12.0-211.54.1.el10_2.x86_64.rpm d8b1984ff90453188e704463efad4ddb3213b94ab37371739d5b547bbbccd1ab ALSA-2026:66392 Copyright 2026 AlmaLinux OS 0 1 Moderate

apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fix(es): * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501) * apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506) * apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327) * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default apr-util-1.6.3-23.el10_2.1.x86_64.rpm 1eedb37d5884dd39b5a78646f3603638b7792ee0e08d689244e002106b176f62 apr-util-ldap-1.6.3-23.el10_2.1.x86_64.rpm 358c879fa31a91572ee96085d5501d58c16fb753ccd76f3f81842b9c29440da2 apr-util-pgsql-1.6.3-23.el10_2.1.x86_64.rpm 3ab2fe1353f608144e6542054872af188ab02b86ca40f613eacfe5ced178cfde apr-util-openssl-1.6.3-23.el10_2.1.x86_64.rpm 4e0884579cd6dde47e63f97b718cc10c60f014ee23827a02b9ae7397c7c88f98 apr-util-sqlite-1.6.3-23.el10_2.1.x86_64.rpm a2ed5fc3aff530a2ef4c934e2f16dad706291f1a685907f80fc234bb31adbff3 apr-util-odbc-1.6.3-23.el10_2.1.x86_64.rpm ae920f9a43817dd44aa53ac09815b14fbc860780ba3ee2ae20d31dd1090685b1 apr-util-lmdb-1.6.3-23.el10_2.1.x86_64.rpm b5813efc64b6457234e2b1848129e93f1e9444886ce40012e04930d06786938c apr-util-mysql-1.6.3-23.el10_2.1.x86_64.rpm fc99cd4d1bf6bac17791d10e4fb1da6816ed230c9591d257b0a8cbca87b90137 apr-util-devel-1.6.3-23.el10_2.1.x86_64.rpm fd3e816ac53bef6e76c00913fcc9764aeae77b313f1f63ffc1c6bd2beaeb0fcd ALSA-2026:66432 Copyright 2026 AlmaLinux OS 0 1 Important

osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default osbuild-composer-165.1-5.el10_2.alma.1.x86_64.rpm c12f314fce2ed0e5fd0d237eafa6bdcfeaf622cee712cdd8f9ae2485ca814245 osbuild-composer-core-165.1-5.el10_2.alma.1.x86_64.rpm c4b15f55b7b61dd1844442c7fbdfac45524671a6aecf2a16e5664470a04ddb77 osbuild-composer-worker-165.1-5.el10_2.alma.1.x86_64.rpm e1c7fd284f1fce8b539464468e3b2212446d881aebb97cf256e1713054095542 ALSA-2026:66460 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header (CVE-2026-85150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gstreamer1-plugins-base-tools-1.26.7-2.el10_2.2.x86_64.rpm 42ef99144db7308fec0fe868a2dc0feb0f2a03188fe2e7aa3a443d46899da837 gstreamer1-plugins-base-devel-1.26.7-2.el10_2.2.x86_64.rpm aa98077fd7d41975d186d79bf8dfec7ce938c8d6a5d3fbb988bae0ff05e044fe gstreamer1-plugins-base-1.26.7-2.el10_2.2.x86_64.rpm c36e64687c0d8bb064d119abc042e7a6ff3aefba803c5548a9a43db5a6a92d77 ALSA-2026:67129 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default firefox-140.15.0-1.el10_2.x86_64.rpm 1027e1ea69abee1a2b74d1b1ab76f939107e5f8dce61bdc2cb3f89dd523064c6 ALSA-2026:67147 Copyright 2026 AlmaLinux OS 0 1 Important

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853) * tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-tornado-6.5.8-0.el10_2.1.x86_64.rpm 0b17e1446d36a04e6896f2c7673c4d9bdd9ae5025fd0c939a5319cc6baf69410 ALSA-2026:67154 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456) * openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798) * openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072) * openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076) * openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457) * openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874) * openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073) * openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074) * openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075) Bug Fix(es) and Enhancement(s): * openssl: HollowByte remote memory-exhaustion DoS fix may be missing [AlmaLinux 10.2.z] (JIRA:AlmaLinux-212362) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssl-perl-3.5.8-1.el10_2.alma.1.x86_64.rpm 0a4126dc7e7a97f14eb2caf6c5cf3e72704157f742e229398ccff8c45e11e33a openssl-devel-3.5.8-1.el10_2.alma.1.x86_64.rpm ac3c39157d4dc6325b45e0efdd463d8a07f1463d05863c2da6d1905d6ee7c14b ALSA-2026:67156 Copyright 2026 AlmaLinux OS 0 1 Moderate

perl security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es): * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-I18N-LangTags-0.45-515.el10_2.noarch.rpm 069d8a8848580110635885e2c251c7423daaed882265d3fe5c2f4465f09dd325 perl-B-1.89-515.el10_2.x86_64.rpm 0ea87a1ed52e9920d1007a38064b9f023436c4338fdb60539e46332f0cffd183 perl-vmsish-1.04-515.el10_2.noarch.rpm 114d1690b48e176ae300aa8758eb208c31d1b490b24d8ee9e87ba6f5d21cc209 perl-User-pwent-1.05-515.el10_2.noarch.rpm 116856c6ec904a94c4b9e26465c0f24d542f6ac279c1065c986de45686011ec0 perl-interpreter-5.40.2-515.el10_2.x86_64.rpm 178b05e114dd51f7ed632d6381c563ade2c69b4bc5b0329d50068fa3eb96f122 perl-Search-Dict-1.07-515.el10_2.noarch.rpm 1a7a937662f78d99a2dc924c7f668c42980aca692656cf16a5a5d1e21e6a4315 perl-AutoLoader-5.74-515.el10_2.noarch.rpm 1b540d06f1b3584f80113b6c546b8864cd617dffbb8513045b03d7132e826012 perl-File-Basename-2.86-515.el10_2.noarch.rpm 20a9f2b8c608e5b9882e2d7cc64546b067e53ccd2148bbfee2b72c0bfae4b16b perl-mro-1.29-515.el10_2.x86_64.rpm 2570ca7448e8d355eee8b6c565f22b2f478b23b17e8ba20e0b6451a54a047d6d perl-ExtUtils-Miniperl-1.14-515.el10_2.noarch.rpm 2b7283b3c5536e3fd89917266b3465b22de4dfbf604834e918ccc589888a8a26 perl-Thread-Semaphore-2.13-515.el10_2.noarch.rpm 2d138bc731d07a757d3301cd9d65f224ad3c2a96be63b1b60cd24e1c3ddfd0e5 perl-IPC-Open3-1.22-515.el10_2.noarch.rpm 2fe04d10b167fa28ece32046dc240d5132475190736ac8dda602198c8b51e0ae perl-FileCache-1.10-515.el10_2.noarch.rpm 30820f41d03438df0a89b8dea91241e253b67eacf1cf81d8fff01551dd83ab5e perl-Net-1.04-515.el10_2.noarch.rpm 32c8b627ee7e2970b1dabfa3c1024adbd59dd604b26059aa8c2dd768f3843337 perl-Thread-3.05-515.el10_2.noarch.rpm 342387b69d0d36619df2041b925e664c5a207142020f6c17137a4ef5e7f9f184 perl-ODBM_File-1.18-515.el10_2.x86_64.rpm 3adbf59c804408db6459130f7d7f373afdcca76cd68333b050c664f62e8deea2 perl-Term-ReadLine-1.17-515.el10_2.noarch.rpm 41bde263dee0557bb68f9f1d2baa8d57c8d3df3fba08a5d94ecdde225220d3b2 perl-Unicode-UCD-0.78-515.el10_2.noarch.rpm 4307fa601ecd6edee189194d08a35b90113a9dc2e1e1c6a6a66195ec18e8d8ce perl-Text-Abbrev-1.02-515.el10_2.noarch.rpm 43665b451f519dbeb4b8a05f066cc6481f8b6c143cf3e594852598a3a6b222ee perl-NDBM_File-1.17-515.el10_2.x86_64.rpm 44f9f5a873a53e7cbf56110bf07e5735522a5377940fdf369cb5e89c4e934736 perl-I18N-Langinfo-0.24-515.el10_2.x86_64.rpm 468102e2d484ce95a10c5a6a927ee33a25f2eb8c5a2370e78a5b2a1c1c83b872 perl-File-Compare-1.100.800-515.el10_2.noarch.rpm 4812e8816160f70feaec391bd210415bca4a44a5155b126c3fb1ef14674b80d2 perl-Getopt-Std-1.14-515.el10_2.noarch.rpm 49e8e4357d64fff7c22f72bda9bbab91c9393e87d6b40473e2f3e03a651d79ad perl-SelfLoader-1.27-515.el10_2.noarch.rpm 4d9f02c0fedb9b29b19bc90d97045e6d723657d1f214c7e2f2490390a781c3a3 perl-File-Copy-2.41-515.el10_2.noarch.rpm 52be131ea7d5f9df8f083bcaadde9c8b8cf8165b5dbba326c37eee56e9525871 perl-FindBin-1.54-515.el10_2.noarch.rpm 541141d26cff39e511d41ad2e104dbedff7ae004eb7b60a75f1d264f0da639e7 perl-Time-Piece-1.3401-515.el10_2.x86_64.rpm 5437703e2f0a0fa0a2660a19d1188c5a7bf0ac879fa4890d1a9b4750072ff35e perl-Memoize-1.16-515.el10_2.noarch.rpm 568f92b74173236bcdb6ffd602c20f30d5ce36ddc15a9ef60bdd9531791e5d38 perl-Dumpvalue-2.27-515.el10_2.noarch.rpm 5c387af29496631904e0e4512b0042204cdfe1760561da0a1a7779cd1b9432c1 perl-filetest-1.03-515.el10_2.noarch.rpm 5ea84443d067654a9188b0fbdea88de0a413a87cca469418d8a7a2c81a63eb47 perl-Module-Loaded-0.08-515.el10_2.noarch.rpm 5ec1d001a8904f13be93731dc3ee10d52fea7b19718e01dde887e892f9d59e9b perl-Time-1.04-515.el10_2.noarch.rpm 648dff6e0b21d2c42534adf498ff6f73ddc53f26c65c64ad56180a18d42fc119 perl-I18N-Collate-1.02-515.el10_2.noarch.rpm 680f8b26caf1903d88f8d96263ad903bc239369406b6895e6bc27ed923fbae59 perl-Symbol-1.09-515.el10_2.noarch.rpm 6812dec84019716837e33bae8700473e5b2e874091c1a288a8dbb1726153c5c2 perl-ExtUtils-Embed-1.35-515.el10_2.noarch.rpm 68dcc2966462f39ae38c5ebcae4c337dc9e0b06c3ea981844a143d3995c06753 perl-AutoSplit-5.74-515.el10_2.noarch.rpm 6b59cf08fb7286fb3f4198e45cd3d4f5006406267051a10617fb5304cd5266d1 perl-doc-5.40.2-515.el10_2.noarch.rpm 6cad19426ac95604a5cd8d62f8a8ffb5a38b8e8d807a982102a412825683beb8 perl-Safe-2.46-515.el10_2.noarch.rpm 72689b14d3ed67db6d8a591e812f40b77b791b19725266586057351632e00fd1 perl-Config-Extensions-0.03-515.el10_2.noarch.rpm 735ba0cc433b5cf1e24d38cde1b3370a929cb3d7e9d19a4191862d988e7e06f2 perl-devel-5.40.2-515.el10_2.x86_64.rpm 744ff48a6813b6e1dce94593435dfc3779a05f8192d4f8c7cc889a5471dca48a perl-overloading-0.02-515.el10_2.noarch.rpm 7696783c9ba2e5642cd1a30e303621daf02bf97a44f97abb2711b7d17befd20b perl-Attribute-Handlers-1.03-515.el10_2.noarch.rpm 77b3940fa81302f640a8fc18a554e27c5a3788da8a3c05b1f3e1bc3d75795a37 perl-SelectSaver-1.02-515.el10_2.noarch.rpm 7b99d763a3936e28b58fa9304fed7b558d8c71ad7e808a5751f3969dac867a76 perl-GDBM_File-1.24-515.el10_2.x86_64.rpm 840bc3480de5a886e27c473ad7b9b0ef3f0f35b29dff27ab9a633cd62dbc0050 perl-ExtUtils-Constant-0.25-515.el10_2.noarch.rpm 873bb09b54d407b9bf5ff9c9e00e0c0053f12ca3a38e094acf6fe08c2101501e perl-Tie-File-1.09-515.el10_2.noarch.rpm 8a33b58207a8349608b744f83eb4dc94995c8d4315559c15ba26bfd0793fac03 perl-Math-Complex-1.62-515.el10_2.noarch.rpm 8dc64964e85a19776cd9190076559c2f76282a5d55cc10f9dcdfe14dae924e30 perl-5.40.2-515.el10_2.x86_64.rpm 91f7da3c0d252bd4d27452fd8489cea59c4f5a97188aaaf6268e8ca74ec6df70 perl-vars-1.05-515.el10_2.noarch.rpm 93da3932faa665745d14ccf5a9ddd860f562d08fbe184619cd4a7b8b274fe012 perl-Errno-1.38-515.el10_2.x86_64.rpm 992ebfec13202bb641bfe67bd8995a59cabbe857f84a980f089e887f4041ca02 perl-base-2.27-515.el10_2.noarch.rpm 9be41847f8862fdbf8b1e5c6e81cd416a80f62bffde4ab2cddf02837e9ce25ff perl-Devel-SelfStubber-1.06-515.el10_2.noarch.rpm 9bf0cebe98e3c5d7c7391fc556d152673f3f4ac637e62559e72f00322c9665ae perl-DBM_Filter-0.06-515.el10_2.noarch.rpm 9c44ff926043c1465c2b3f769f5d460af437848027936af2885671f71c45b6c3 perl-utils-5.40.2-515.el10_2.noarch.rpm 9cf990e411b795dac07fb0e455ab88d72d70095974d3606451d554b1a89ed148 perl-Devel-Peek-1.34-515.el10_2.x86_64.rpm a1041449bca03d326f00e9dde5b91258b60d0551562b541096a6836fc10cfb3b perl-subs-1.04-515.el10_2.noarch.rpm a45bb41b5f9be010da79ffbb237a445e115026b6a66594ff029d7993071754f8 perl-Tie-Memoize-1.1-515.el10_2.noarch.rpm a59eb6b1ae8899f296df3fcf49cd61046571493289821a2c792002f2a31c4027 perl-File-DosGlob-1.12-515.el10_2.x86_64.rpm a60f0213cd0f302100ab09683e256e005dbfc6501dc565781ccf9a24c77e9639 perl-English-1.11-515.el10_2.noarch.rpm a81d60d0b8acf592731701a57479d115867187afff5573bd5a82fe8b130972a1 perl-ph-5.40.2-515.el10_2.x86_64.rpm a9e4441d2fa0aed00bec3dcb037ac0e3949b5cd6d64b27061a89950ccf3587e2 perl-Pod-Functions-1.14-515.el10_2.noarch.rpm ac655c5595560dcb46f735702ea26b21b12051be8238ba0d5e0a38ab6f6b598d perl-Locale-Maketext-Simple-0.21-515.el10_2.noarch.rpm ae46f3e2dc6318944c86ec74827ce3532cdb6a197c6944b69e880923c4c65136 perl-less-0.03-515.el10_2.noarch.rpm aff27fa71a37ec8dd7133ac6cfe955671da4baaa92fd1ce496e7930d188a4556 perl-Sys-Hostname-1.25-515.el10_2.x86_64.rpm b0a46c230c847d20f398b9814f5d57255d326b9b127183e53f090febf2324bfc perl-Fcntl-1.18-515.el10_2.x86_64.rpm b4853b345959695a05eb2674f286bd0bd1dfc473ea270e719f8d79ceffa4bb99 perl-libnetcfg-5.40.2-515.el10_2.noarch.rpm b6dd427dc290c38944e15a0c841f529374558fd9cc21cdb584dd0c8fe7bf32f7 perl-Benchmark-1.25-515.el10_2.noarch.rpm b7973b40a45771d3dfd56138ebae057d2fbaf20fda1998e379b0210fd9be01a1 perl-encoding-warnings-0.14-515.el10_2.noarch.rpm b8ecd57b3ebe7a0915a2932be16e7cefb2daa9d9c21ab1bc51e41bc4b14f252f perl-NEXT-0.69-515.el10_2.noarch.rpm b9d74ebb73608e7ae8a41f1845f6ddffbde82b348053bf57d772c4cf1298e2f4 perl-DynaLoader-1.56-515.el10_2.x86_64.rpm bb93b0d66ab6f14f9c86349f4ecba2b87b1a3585157f91b6a0ad6ab705033cc6 perl-POSIX-2.20-515.el10_2.x86_64.rpm bbad35d8b0d0ac807ba101284cf2f8d6f76e304dda34cf5763a2d8c47de628d0 perl-Opcode-1.65-515.el10_2.x86_64.rpm bbcdd691a1c82d4d4d6fa3a619de413cc3071c625adfaf75eabf96865a9ae017 perl-deprecate-0.04-515.el10_2.noarch.rpm c05f4aa40a78c4f09380639cbcbbbd486d773026ea9acccf16495fcdb03be30f perl-Test-1.31-515.el10_2.noarch.rpm c070ca356ba1f71ae941a4b48c70eb6eea140fb8851e89fe70b444e7c15c5a25 perl-locale-1.12-515.el10_2.noarch.rpm c17fc22826e6adf2289f1e63d4d28f43d7938df26a23fabca9f891cd7a93313e perl-sigtrap-1.10-515.el10_2.noarch.rpm c4a150e1b3c392d2bb8602ece64c0a1216c248abcea67c2a9379cb46a1911ce8 perl-DirHandle-1.05-515.el10_2.noarch.rpm c74ec5ab698006562d3ebd6b4dcbd879c336390d3e5cca29cb4cce85b85b5a7d perl-diagnostics-1.40-515.el10_2.noarch.rpm c8f1dc682cb1f2bf17efbda24578b0e02926b13a3e818a6d145dd4265d6ece39 perl-autouse-1.11-515.el10_2.noarch.rpm c92493fe5c4a3219b4b5313325c3ff68fc3d174cbe86b442e42cb89e470aac60 perl-blib-1.07-515.el10_2.noarch.rpm cc2a05ecd7afe0c7472aafc23a4ebe0fc7d88f744f8db7f22c533cb55779d38a perl-Pod-Html-1.35-515.el10_2.noarch.rpm cde6d99dc6bedf83080168ce89ab7278dbae79370c09def2315c05a847acf9dc perl-File-Find-1.44-515.el10_2.noarch.rpm d2938662e54a406e838d0dd5c4ea5832760add3e33b8ef1251185069975d53a6 perl-overload-1.37-515.el10_2.noarch.rpm d3c7074b151fa50dc7404bf110e451f8a9847525e8e29fd17009086ae4ebb2e4 perl-IO-1.55-515.el10_2.x86_64.rpm d76cdc5474b8412934b06c7d938beb9355e1cc2967e38eb77ad8e106eb5945ca perl-if-0.61.000-515.el10_2.noarch.rpm d81719bd35a08f147b531c2c7251abb2fdd658f32d157ad322f18d5db317b398 perl-Hash-Util-0.32-515.el10_2.x86_64.rpm da7bbede5ba9d45845f205bca56b99cdfe6b7e8410896fd3cb0ae575a90aa03c perl-fields-2.27-515.el10_2.noarch.rpm e70d012a4965534f70adb38c3bada5c20cbb42fc8ab2e8b685cba1d6ae51ac75 perl-Tie-4.6-515.el10_2.noarch.rpm e7694d6af15a4e0a27f0f2619e94bf0671e47509e7b2fadd52f4f6e193ada11c perl-open-1.13-515.el10_2.noarch.rpm ef32423ccb9fb8aadb65d75956ca93b17f2d48ad869a00265d5b18e074f9e67d perl-sort-2.05-515.el10_2.noarch.rpm f00ca350e4e5d6843b1ed839dabd26abfce7f303dffa9b76559b86b7160eef9c perl-lib-0.65-515.el10_2.x86_64.rpm f1d6ac4ccce329994e2b461b649772fc8b369d7fc014acffad79c38380068d06 perl-File-stat-1.14-515.el10_2.noarch.rpm f31ab167489a383653e674718b8132503908c89658587c11e60a45911165c658 perl-libs-5.40.2-515.el10_2.x86_64.rpm f45408b3fecf258f0eacb9bc7b282a204a87a2731f66c5a0ccd70e27feb26a0c perl-Class-Struct-0.68-515.el10_2.noarch.rpm f67705171349b9de0f487263220dbf6cb9e59eb628540da756ce686222c81324 perl-Term-Complete-1.403-515.el10_2.noarch.rpm f79ccfdef83bcc3d0425411387915ed8065e98f2ceb6fe02965034b5ade87dbc perl-debugger-1.60-515.el10_2.noarch.rpm fb02e587b5524c489f54e76bb0796c696e9a08765198c33a0f44aa81847457a2 perl-FileHandle-2.05-515.el10_2.noarch.rpm fb1ce05e33fb4e041f6807b80f5895d12700cc578bc662ee3681533d04d61e27 perl-Hash-Util-FieldHash-1.27-515.el10_2.x86_64.rpm fbc8be84f913f6379b1067b6dab7f66c199daffda4295d20fabb54542cb5d1c6 perl-macros-5.40.2-515.el10_2.noarch.rpm fc7b48c861b581799e1c2bfb69697896fbacdd6dc84be691b3671b469cbd76bc perl-meta-notation-5.40.2-515.el10_2.noarch.rpm fe5a31ee08cb8e227798d7a83e589736648047ac72ce10ce68043d70bf3bd8f0 ALSA-2026:67166 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile. Security Fix(es): * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postgresql18-postgis-docs-3.5.3-1.el10_2.1.x86_64.rpm 28ae48d712bfbf94a728e1be3736f786b38b2952ecdb6f51345decf0776c6879 postgresql18-postgis-utils-3.5.3-1.el10_2.1.x86_64.rpm 5da5905e0c416eab9e37216236dec020a0b9a83a9c6670ed1b209f485be2f7bb postgresql18-postgis-upgrade-3.5.3-1.el10_2.1.x86_64.rpm a214e6023858637d4616f4a888da2a688858590698bdb764f77046f193054f70 postgresql18-postgis-3.5.3-1.el10_2.1.x86_64.rpm bda649169a4f8f8f1d03c9e656c6038b53133ca3cba12e5ffcf1b17da9a1d027 postgresql18-postgis-client-3.5.3-1.el10_2.1.x86_64.rpm ed86e263fa87a6b49f6ac6c8d517d9c948b629c6169dec84865ad2ac21955d45 ALSA-2026:67280 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476) * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postgresql18-private-devel-18.6-1.el10_2.x86_64.rpm 188d6e183fa8fa0d791daffeeac120d0afc11190ef5747b270b097f8e25c859b postgresql18-static-18.6-1.el10_2.x86_64.rpm 451c6f1159a676447f88a60b3d914aed2b8780cc67d3197c5d885afc9e26e1b0 postgresql18-server-18.6-1.el10_2.x86_64.rpm 6265a5c1728c1ced15fbbf5073bb8432a0c85239d7ce3e177d09e1e0359e2057 postgresql18-private-libs-18.6-1.el10_2.x86_64.rpm 6c9894b50fae9d93531e72cf1279be3e62840a58175c0c4b39dc23a1b43302b0 postgresql18-contrib-18.6-1.el10_2.x86_64.rpm 7680b2be4863dd462c68b903984a3b340f036f2130e1fde9c2464412f8467ff1 postgresql18-test-18.6-1.el10_2.x86_64.rpm 7a20f2a63afdc51f46bf784ce25632b6106a1906318fcd5aede489747b67707b postgresql18-plperl-18.6-1.el10_2.x86_64.rpm 7d1e46356bd948fa2a9a0c3f889f341e368a02d4037add1553d6b673fb6f4934 postgresql18-upgrade-devel-18.6-1.el10_2.x86_64.rpm 85c79757c37e2f5bd7b7b4f0279015b64980fa126162582d176f18f514f76b0a postgresql18-docs-18.6-1.el10_2.x86_64.rpm b40a795f27ba8c3dc0267cf9c3df01f9bdb609e00f1c8d145131f49e63ec1101 postgresql18-server-devel-18.6-1.el10_2.x86_64.rpm cad944d92fcb83d17628483ee430863835c49191b5b2368a61fc2dead8d167e8 postgresql18-18.6-1.el10_2.x86_64.rpm e73d2baebc2408006f6786ca9f930008d6f86ec1c85af1caf0e87a5bb6da7457 postgresql18-upgrade-18.6-1.el10_2.x86_64.rpm ec6db99e5f335b45ec2effc68c105af61152897eb55213dea40939cfc23cbdbc postgresql18-plpython3-18.6-1.el10_2.x86_64.rpm fa22a6ed0e32db7b017ed936fb0da932f5df1551e6fbf15d0b26aaa03ed652ee ALSA-2026:67286 Copyright 2026 AlmaLinux OS 0 1 Important

rust security update

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator. Security Fix(es): * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server (CVE-2026-53587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rust-std-static-wasm32-unknown-unknown-1.92.0-2.el10_2.alma.1.noarch.rpm 0138e6cca138e3a8bd6140d713af45cad285722fdf927f02ee745a5170eaaf11 rust-debugger-common-1.92.0-2.el10_2.alma.1.noarch.rpm 066364c3cf81426f4483e19c67d727520f30fb4946106f8163cb8d7ef1b57c3e rust-toolset-1.92.0-2.el10_2.alma.1.noarch.rpm 076c2a9168005bc63f127403b7ba6ed47e6888351515f4e711c7257770e7a693 rust-toolset-srpm-macros-1.92.0-2.el10_2.alma.1.noarch.rpm 0ceeb326c7211eeb9140d0ea6d45b8d21a41469f24b87463f3b664fe7fd67c4d rust-1.92.0-2.el10_2.alma.1.x86_64.rpm 0f1856d745b4589b965f24b337e3b54137f1a17ae39a0bc7ee6501819d50b41d rust-gdb-1.92.0-2.el10_2.alma.1.noarch.rpm 36416c11e35f5a7ed2f73b8fd1e17ac9c268d87e61a02b736141c00f43e837d0 rust-src-1.92.0-2.el10_2.alma.1.noarch.rpm 3a191c97568b6ef7689a8161ad1e6f84a2c0b0d8d589b9b2c435126799f2afce cargo-1.92.0-2.el10_2.alma.1.x86_64.rpm 4f88f881029fdd44909a3b18998ff88ebb0ff29c5552fe1d2b2b4c8006d66230 rust-analyzer-1.92.0-2.el10_2.alma.1.x86_64.rpm 629b834262bf0c1cc952526a6e2df9b8a42c03c87272f220de3431f0e77c7915 clippy-1.92.0-2.el10_2.alma.1.x86_64.rpm 656f038ccf3213464a28d46971bd314ca43ebe551b22ac3777e011189d7a35e5 rust-std-static-wasm32-wasip1-1.92.0-2.el10_2.alma.1.noarch.rpm 6b59c9879cc5f8495b5c0dd0629cda1e72584f6b770fba245605007f4c8b070b rust-std-static-1.92.0-2.el10_2.alma.1.x86_64.rpm 6fb3ee297fba8cea623787c53b859de51f653d6f3b648995de4821ae11321425 rustfmt-1.92.0-2.el10_2.alma.1.x86_64.rpm 8a426087b77058bdab80e80207640de4a39defac11141e1e0f4d405cedca0c28 rust-lldb-1.92.0-2.el10_2.alma.1.noarch.rpm b5fd5f65f431e4ce5bf5b35b1763ab998bd818db537d321ba792bf0a1f0ed29c rust-doc-1.92.0-2.el10_2.alma.1.x86_64.rpm bf09a8f570501686ddefa0363d6e794ab6102307ae6a06ce68b5bfa5e950b54f ALSA-2026:67314 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nginx-mod-http-image-filter-1.26.3-6.el10_2.7.x86_64.rpm 433373615ad1ccef633ed61e7b6668964c26a2a24b48018befa939fcd7763cfc nginx-mod-http-xslt-filter-1.26.3-6.el10_2.7.x86_64.rpm 4f3ceb2d35b05725d202c75701e82ff9520a89fa3fdeeda0ee6f4ddebc0aa46e nginx-mod-stream-1.26.3-6.el10_2.7.x86_64.rpm 6f8bdca9bb043ae6b6589676d44af9ffb04d39855d7976012040cf8620ad7100 nginx-mod-mail-1.26.3-6.el10_2.7.x86_64.rpm 7288c73f55ba8f3804d4a661cfe3939c46aba1884cb942f53088cce7735f8d61 nginx-core-1.26.3-6.el10_2.7.x86_64.rpm 7ad204f331b4cf248ae54d50290561fd971bee603b99255b4f24567c9f4eaa4e nginx-mod-http-perl-1.26.3-6.el10_2.7.x86_64.rpm 7bc3293c07a92530ca227d72ad2d41d6461ae3db104e6facb44327f867f454a0 nginx-1.26.3-6.el10_2.7.x86_64.rpm 89bca8bd97e21d7dedd771e68bbb3438c8a14896ad796c5bdc7a3df8e9f3a064 nginx-filesystem-1.26.3-6.el10_2.7.noarch.rpm 9e02356ee55819abf5dd9f44929c35a20fae932d02ce8934f7cf4b184f83edfa nginx-all-modules-1.26.3-6.el10_2.7.noarch.rpm c401bf9f42c3bc11357a0635ba27b08076df988c187958490043e82bcf9ca248 ALSA-2026:67463 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460) * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454) * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789) * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790) * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458) * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464) * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803) * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784) * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463) * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452) * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791) * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795) * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456) * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793) * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453) * rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455) * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457) * rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461) * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802) * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785) * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783) Bug Fix(es) and Enhancement(s): * Rebase rsync to version 3.5.0 in AlmaLinux10 (JIRA:AlmaLinux-246094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rsync-daemon-3.5.0-3.el10_2.noarch.rpm d9eeb4e538648566b7bc50ebdf47325f2158a1f110be3d5a1451d1dbf7b786e9 rsync-rrsync-3.5.0-3.el10_2.noarch.rpm f379c5d18d7e720110d224d854c2e2796f7af861e7e3c5b78903eaadc9caa299 ALSA-2026:67471 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149) * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539) * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131) * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361) * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111) * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) Bug Fix(es) and Enhancement(s): * [almalinux-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:AlmaLinux-245035) * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:AlmaLinux-255233) * [AlmaLinux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255348) * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [AlmaLinux-10.2.z] (JIRA:AlmaLinux-256731) * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:AlmaLinux-256890) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.55.1.el10_2.x86_64.rpm 2763e5fb18627e3616952f44cdd9fe903bda8e710a7b94408badfeba1b13a393 kernel-headers-6.12.0-211.55.1.el10_2.x86_64.rpm 33e8f5eeed03ae01da761f79ddee32c0807b89f13aaf96797c379f469f5c8ce3 python3-perf-6.12.0-211.55.1.el10_2.x86_64.rpm 3cac2271eb243b6c30b668ea6ae70a19f0a0f9d89a15d4c3422129f7b9dfa896 kernel-doc-6.12.0-211.55.1.el10_2.noarch.rpm 417f2ca88de88049f750692aed24d02c1aae2bdedac4761c6e14342603e41806 kernel-devel-matched-6.12.0-211.55.1.el10_2.x86_64.rpm 5174c498ed54dd35431210973a5ee3e58fc4b1151ab233edaf3796eb2c1ea6c1 kernel-debug-devel-matched-6.12.0-211.55.1.el10_2.x86_64.rpm 7492e4676597956dc4fe2cdfcedb09aaf9abfadcf15599623398439baa6d082b rv-6.12.0-211.55.1.el10_2.x86_64.rpm 74b5ca7d05e36056c1bba866f11a80bae9a9b75c3eb14c6a8256c41b32e3540a rtla-6.12.0-211.55.1.el10_2.x86_64.rpm 81a59364f8cd65d7210044a0a728d845f6084c00ecba2dc7af4f02c1b74bad5a kernel-devel-6.12.0-211.55.1.el10_2.x86_64.rpm 979b1560eed699265c9bc7e2506c49af402b8050aab0b6583e9e07c1c5c71e66 perf-6.12.0-211.55.1.el10_2.x86_64.rpm a2c6f134d47c8e30fea0e6004c83738c2abb1549487d09ffac6b34186c2c4ecb ALSA-2026:67525 Copyright 2026 AlmaLinux OS 0 1 Moderate

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.131 Runtime version: 8.0.31 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.131 and Runtime 8.0.31 [almalinux-10.2.z] (JIRA:AlmaLinux-252248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-runtime-dbg-8.0-8.0.31-1.el10_2.x86_64.rpm 1088d15377c9dfd642a439358ea1c925c4f95bdc56acb758f5ae89f2132d9761 aspnetcore-targeting-pack-8.0-8.0.31-1.el10_2.x86_64.rpm 1e0f2a4ee2cbc0d11018506907245d9cbd8e5eb014ebd075cc444490573327ce aspnetcore-runtime-8.0-8.0.31-1.el10_2.x86_64.rpm 3f88b3877752bdf3754fdf1496185dcff78ab3194b33985349a4c3cf0869207c dotnet-templates-8.0-8.0.131-1.el10_2.x86_64.rpm 501ca35c78e816404d80f350680e6b25ce0445330b5a198fcf1578c511f2dc72 dotnet-targeting-pack-8.0-8.0.31-1.el10_2.x86_64.rpm 8104ddcdc8ef7d51fd94efe19a25b05b27e7fe47f46fd6de551a65b74dc400a6 dotnet-sdk-dbg-8.0-8.0.131-1.el10_2.x86_64.rpm d584725c08ad1e044c381ece78d2686b839fdca9ee99a64e67c3a611ed718454 dotnet-sdk-8.0-8.0.131-1.el10_2.x86_64.rpm da537f25b967525baa32ac578725ff07a6ef71eaf42e9cf8aa8db1806cca1ebb dotnet-hostfxr-8.0-8.0.31-1.el10_2.x86_64.rpm edec8625ba41fdbd380259a314a086afef35e897aa8dd2f1119cba2a0c9d9ca4 dotnet-apphost-pack-8.0-8.0.31-1.el10_2.x86_64.rpm f0974f15033f138115d121c6e6cbfad4d39166e810182f9cc1b466a3025a05d1 dotnet-runtime-8.0-8.0.31-1.el10_2.x86_64.rpm f6801176716b47f9f50dd24cf5a6c2fdda56fffc91802b65e2fc1a790667ac4d aspnetcore-runtime-dbg-8.0-8.0.31-1.el10_2.x86_64.rpm fff569f15046054bb824fd8c5bb9c55df406ca8b6d138aebab82678ee9439dff ALSA-2026:67528 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.121 Runtime version: 9.0.20 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.121 and Runtime 9.0.20 [almalinux-10.2.z] (JIRA:AlmaLinux-252279) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-sdk-9.0-9.0.121-1.el10_2.x86_64.rpm 016778bb71f557c6b236bc2e57515b7bf785831d42567d0e8541361b5f520f0f dotnet-templates-9.0-9.0.121-1.el10_2.x86_64.rpm 0ef91f7f4b57a3fa8ee54ab2fd6d959583d2e2368989490b78cd03c096fdc5d5 dotnet-runtime-dbg-9.0-9.0.20-1.el10_2.x86_64.rpm 482b08b1dad83edfd6a0e1d0e800ce2b03b0ac6efb7572ae0852c997fbc801f2 aspnetcore-runtime-9.0-9.0.20-1.el10_2.x86_64.rpm 4d85df4e2d83950680843ac2e997eabc497908e06e0890a92b7f9fac21edd23e dotnet-runtime-9.0-9.0.20-1.el10_2.x86_64.rpm 5ce28a1da0830e0ed8db4300a2a60b440473b16c4a0c036e4c818d172322b581 netstandard-targeting-pack-2.1-9.0.121-1.el10_2.x86_64.rpm 651b47b1ec36882994d4833dbab148aa78a92aaacc00e832f030a9f74f97a8ce aspnetcore-targeting-pack-9.0-9.0.20-1.el10_2.x86_64.rpm 8c4274a4590885863e2f7174543f19eb5531587b5e0f2ad94c18fe7b2fa757b2 dotnet-sdk-dbg-9.0-9.0.121-1.el10_2.x86_64.rpm a18a65e4de867b69560d59c1a44f705747ea7e7a53933f2bb16d77815bb0a780 dotnet-sdk-aot-9.0-9.0.121-1.el10_2.x86_64.rpm b8bb4500e1915e7698769959902baa2d92195cd75056e4fe61fa174dcfe4cf25 dotnet-targeting-pack-9.0-9.0.20-1.el10_2.x86_64.rpm bcb1e37115bdf02848e62069c7136d2b3494b87457b1de190bb95df53b578cc5 dotnet-hostfxr-9.0-9.0.20-1.el10_2.x86_64.rpm c0f994656f0c97ec663cee113154ebe46449901b3b52cdb4b0023c155f8e165f dotnet-apphost-pack-9.0-9.0.20-1.el10_2.x86_64.rpm d828641ffdbe713ab70e86485755004c80bc4940574c99ad1be86c0d3f486a0b aspnetcore-runtime-dbg-9.0-9.0.20-1.el10_2.x86_64.rpm dfa688e0d08b6e16694455ee08d054c0a72d4d40f2c537cb76e8fba950b97232 ALSA-2026:67530 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.112 Runtime version: 10.0.12 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.112 and Runtime 10.0.12 [almalinux-10.2.z] (JIRA:AlmaLinux-252320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default aspnetcore-targeting-pack-10.0-10.0.12-1.el10_2.x86_64.rpm 04a822aaf2c04bce6468137269fb5d2cc49c12b0c5f7c3e59dd6ebbb855478f6 dotnet-sdk-aot-10.0-10.0.112-1.el10_2.x86_64.rpm 10fee825890ae988686e342954abf3e3eb330a436951e6b496364b214b854207 dotnet-hostfxr-10.0-10.0.12-1.el10_2.x86_64.rpm 1938227a48457ee310a8c8fc6bbcd40e729b197a495dea0181ef3c4552c97977 aspnetcore-runtime-dbg-10.0-10.0.12-1.el10_2.x86_64.rpm 1998589a84b2298b03dac25898a4ba0323b02f3675089ce2fe2facd2d455c0d3 dotnet-sdk-10.0-10.0.112-1.el10_2.x86_64.rpm 3323ca365ae3547635c9663f11639ee07faed24457614e1df8b41ba5432455da dotnet-templates-10.0-10.0.112-1.el10_2.x86_64.rpm 41457da116581ffe52dca3a231f1e00da266b44db4a24d4ade7e2b00b8a1b009 dotnet-apphost-pack-10.0-10.0.12-1.el10_2.x86_64.rpm 4be77b045b1502790d5fc2ee467aa9ab1487d40b73a2cee1e575392bb8d1da82 dotnet-runtime-10.0-10.0.12-1.el10_2.x86_64.rpm 4e9a510eeb0c1a65d83f3102cf2ac42e4ad36637673d33607060fe2ca6ed589b dotnet-runtime-dbg-10.0-10.0.12-1.el10_2.x86_64.rpm 50cbbf994c6b0bdcb1655ddb339252c7fb78c7f74780b507a9767f72f9103297 aspnetcore-runtime-10.0-10.0.12-1.el10_2.x86_64.rpm 759fa7fd89cfe05e9d1a9faa64721904fd61def1fc7a9e5ff3a0c804868d23d4 dotnet-host-10.0.12-1.el10_2.x86_64.rpm 96c185ab67167a07bd0f05976863fb46b33b151240133739b168ab792600b1ae dotnet-targeting-pack-10.0-10.0.12-1.el10_2.x86_64.rpm 9924a3e1d03b6f5133f8decdf039466928e7c8dea632a5e007e040c3e7be121a dotnet-sdk-dbg-10.0-10.0.112-1.el10_2.x86_64.rpm d97890d498f49d8bc30b6aa8382567c50662b6dcc80dfc5b2591698565d04f66 ALSA-2026:67584 Copyright 2026 AlmaLinux OS 0 1 Moderate

rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rsyslog-udpspoof-8.2510.0-5.el10_2.1.x86_64.rpm 0fd29ff6110e9576d6dae434bd2091fd740d57b47910f37666dd3bfa110a80ad rsyslog-gssapi-8.2510.0-5.el10_2.1.x86_64.rpm 39ad80f8fe3aa844b3b543c9d005f21ddd9add9e6bc424576c28b59c3a7b5285 rsyslog-mmaudit-8.2510.0-5.el10_2.1.x86_64.rpm 3d4e49c7840dd1dc33105ddd58cb90bee8ea4aee6840df533810f654d152722d rsyslog-mmkubernetes-8.2510.0-5.el10_2.1.x86_64.rpm 3d81f5e35c589853466bc6b6b77915f3be318554d2d2153d5c5d1be028357edb rsyslog-omamqp1-8.2510.0-5.el10_2.1.x86_64.rpm 47a5993547c8895fc79e1d750dcd414331c9d95b719d33e8f9aa81f63b637890 rsyslog-mmjsonparse-8.2510.0-5.el10_2.1.x86_64.rpm 5520f194f3e204c5c5d382123b7c6368fcc0867a17c168bd5f38934d89edd4fd rsyslog-mysql-8.2510.0-5.el10_2.1.x86_64.rpm 558b176d7219f4bafd777bf7f6f88ec6c073723ced28958267a2ce349747c5ec rsyslog-pgsql-8.2510.0-5.el10_2.1.x86_64.rpm 5b1ed3d83094cfb3d212a716c71c229d48291f48c544f8dc2932031fdc650c33 rsyslog-doc-8.2510.0-5.el10_2.1.noarch.rpm 5eb376ccbd5574465d95f79c551faadf1b77b055b2e397074abdf8290145b706 rsyslog-relp-8.2510.0-5.el10_2.1.x86_64.rpm 63657235e3f5ecf953926d11a13f0c706b2bfc595632535451fe2c0e874bb39b rsyslog-mmnormalize-8.2510.0-5.el10_2.1.x86_64.rpm 6a85f1261c7d9251589b467abe460cea064c01b6852e8d6ca86cec73defdb11e rsyslog-openssl-8.2510.0-5.el10_2.1.x86_64.rpm 7b46d5cbc1fa731e1c254f4165cfb51f4417db59ad990a6dc5d01d75703f76e4 rsyslog-8.2510.0-5.el10_2.1.x86_64.rpm 7fe19c86a561420870ee3dd7d5154570e72e9519d1a1954ed090ee3b06a6c35a rsyslog-elasticsearch-8.2510.0-5.el10_2.1.x86_64.rpm 83e8f6290597268afd71aced5b2aca5db41b121bbb48942e804c3081d82fc964 rsyslog-mmsnmptrapd-8.2510.0-5.el10_2.1.x86_64.rpm 8cd38cb94ed8dde85cdf1c2ea6a2354c2f575fec993e345434423dfe87f025af rsyslog-gnutls-8.2510.0-5.el10_2.1.x86_64.rpm 952f6b6e850cf77d973150ac12cd25a8af606ab1ecfb0285e7cc60762ff823df rsyslog-snmp-8.2510.0-5.el10_2.1.x86_64.rpm 9e4402eb19c2e25210667a0747f104624f122b67ae6f5a672c6afad9235ea388 rsyslog-crypto-8.2510.0-5.el10_2.1.x86_64.rpm b0296f9c564bdbc9c51fb99662de5277146d190b0e373ee1e8ae5d859b696938 rsyslog-kafka-8.2510.0-5.el10_2.1.x86_64.rpm b39bd6543aadb1571ee860740affa1012557b1fd40c5a6062e954531a84ab456 rsyslog-mmfields-8.2510.0-5.el10_2.1.x86_64.rpm fadd763b7cf3f095e83b5322382039b0182f4845482982bf0034f6a214478715 ALSA-2026:67872 Copyright 2026 AlmaLinux OS 0 1 Important

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default corosynclib-3.1.10-1.el10_2.2.x86_64.rpm 3340086cdba2e7c54da0824bd58d7ff8bbe7f52f6596b9037f02fe28bf3cb689 ALSA-2026:67909 Copyright 2026 AlmaLinux OS 0 1 Important

libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fix(es): * libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383) * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387) * libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381) * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384) * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382) * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388) * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385) * libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libevent-devel-2.1.13-1.el10_2.x86_64.rpm 07cc35369cbb21b033ba25e20dafeb96034d7e48bca715eca48db7eda751e07d libevent-doc-2.1.13-1.el10_2.noarch.rpm 8f97e5ea7d9bd2f38f36ae5c546a1143c2438ea22193be05cfb08d3a9e3159b3 ALSA-2026:68235 Copyright 2026 AlmaLinux OS 0 1 Important

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service (CVE-2026-15709) * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation (CVE-2026-15711) * libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body upload (CVE-2026-85197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libsoup3-devel-3.6.5-3.el10_2.14.x86_64.rpm 93755f51395355a11709fa71032be7df0079607f1435bbafd22c15527964a7a6 libsoup3-3.6.5-3.el10_2.14.x86_64.rpm e43c61afd2cec9b094b5cd3551aee1fc724eeaa359a9830ad4ca6ffda7302920 ALSA-2026:68291 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default unbound-libs-1.24.2-7.el10_2.5.x86_64.rpm 14388b2b144fa7f0a3ea153a030b61b5e7791f60bd611b9c6dbc5c734a29fe2b python3-unbound-1.24.2-7.el10_2.5.x86_64.rpm 292f191ae71c72f2cd1676f9e8c84c0fd0e79685832811bc8e3ba2bbb203bdc1 unbound-dracut-1.24.2-7.el10_2.5.x86_64.rpm 34541b262ec6692c9c8a733a9aac3517c4b006f4d6959b6b4e7f0c6267648205 unbound-1.24.2-7.el10_2.5.x86_64.rpm a49b17e28529dcf560e514d6d8baf3d9fa9b232f0ba814ef060ba2b1453db273 unbound-anchor-1.24.2-7.el10_2.5.x86_64.rpm bae4913c478b12adc139ce4955c4cef10d23c82d579abb12b404d46a2adc5000 unbound-utils-1.24.2-7.el10_2.5.x86_64.rpm bb511df2b592489811100760542b4087bb34d0077df894e7f9f0e299e836aa87 ALSA-2026:68507 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007) * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923) * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176) * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175) * kernel: netfilter: handle unreadable frags (CVE-2026-64414) * kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456) * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200) * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143) * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128) * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102) Bug Fix(es) and Enhancement(s): * nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0) returns EBUSY [almalinux-10.2.z] (JIRA:AlmaLinux-239776) * AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-10.2.z] (JIRA:AlmaLinux-254105) * RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:AlmaLinux-255225) * RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:AlmaLinux-255516) * RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:AlmaLinux-255518) * RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:AlmaLinux-255519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.56.1.el10_2.x86_64.rpm 139e24933fefde62d3c24b00ebe450beb76fe94f5b32e48d1e3d116009b668e3 kernel-debug-devel-6.12.0-211.56.1.el10_2.x86_64.rpm 280148f2f7f57db22fcdd116420c607d261695acbf151992b1cdd78d1b512f84 rtla-6.12.0-211.56.1.el10_2.x86_64.rpm 755d590f16fdcd265200852b54e4a8fe2aa9f09a19dac89f2b84bb662b89b82b kernel-debug-devel-matched-6.12.0-211.56.1.el10_2.x86_64.rpm 787524fdf1303188f929424f96990311d1e96d18a25d54b237d9db01fa50013c python3-perf-6.12.0-211.56.1.el10_2.x86_64.rpm 7b74e46995e01318ad4480b712235ec27b10522da2cf59d79785cb9f1e5d39a0 kernel-headers-6.12.0-211.56.1.el10_2.x86_64.rpm 7e95466b9587ec8679a8ecec7c5e118c916b7948e0a7395d1465dbc18b92d246 kernel-doc-6.12.0-211.56.1.el10_2.noarch.rpm 9ac495690b0f89bc57aec2d253ec27914f0238abd009f57c498b6a2668c73807 kernel-devel-6.12.0-211.56.1.el10_2.x86_64.rpm b693d1360b29a6111c21604a4d9cce8f2114e49fcb543d456adde79e261cf16b perf-6.12.0-211.56.1.el10_2.x86_64.rpm d96aebd7b844272d48433ec65b93f1f1eee4f6af96b04953b18fda88598be91b rv-6.12.0-211.56.1.el10_2.x86_64.rpm fa0cf21547ac13251b749956b1e42f24d8f752b610cad79edbdfb034d1403004 ALSA-2026:68651 Copyright 2026 AlmaLinux OS 0 1 Moderate

tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default tomcat9-jsp-2.3-api-9.0.120-1.el10_2.alma.1.noarch.rpm 079235eb90790724bd53fa760599c4fabc2ca146f0df04dc03b825473f6929f0 tomcat9-el-3.0-api-9.0.120-1.el10_2.alma.1.noarch.rpm 127036aa147028de0c591c915f5913b3c80dbbbb60b91558081f3842befb9deb tomcat9-9.0.120-1.el10_2.alma.1.noarch.rpm 4345bedf4762f697d7820e4c40e33db6d512fbb7bb3aa1bb1736a9517eb26bb1 tomcat9-webapps-9.0.120-1.el10_2.alma.1.noarch.rpm 5438a76184cee45e329a47afa3263e09dfcd6150cbd0ff81c9aa64f29718fbaf tomcat9-admin-webapps-9.0.120-1.el10_2.alma.1.noarch.rpm 5abf8cce64844d9b8d793f656ee9059ff88d5778b36b2132610327becea70b50 tomcat9-docs-webapp-9.0.120-1.el10_2.alma.1.noarch.rpm 8f39945c344abb46ae48edaeeb08c9422248d21b0fa78a5168faae09fb3f81ef tomcat9-lib-9.0.120-1.el10_2.alma.1.noarch.rpm c47704f2da56adf112c8a1acc1d7fe27bb3e7896bbfcbcdff7dcc0673fda1877 tomcat9-servlet-4.0-api-9.0.120-1.el10_2.alma.1.noarch.rpm ddabae1dd27c35dd4cee5c1eae2a7f3dd9d8d1aa22810be1c19a7df07b7d56ed ALSA-2026:68692 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security, bug fix, and enhancement update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Policy bypass allows unauthorized program execution via execveat (CVE-2026-82474) Bug Fix(es) and Enhancement(s): * Use canonicalized path if user path contains ".." (JIRA:AlmaLinux-212546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-10.p2.el10_2.6.x86_64.rpm 9c9dd2e748b3205af1a515deb18cfd26aae08ce795c296b5be49ad228e2a75dd ALSA-2026:69099 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-7.el10_2.8.x86_64.rpm 7a4700489b1dc4497a77a448adabf48fbb1da4e2d58a9d1ce70a82ecc79df942 ALSA-2026:69125 Copyright 2026 AlmaLinux OS 0 1 Important

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926) * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.6.x86_64.rpm 5738e1a01089c33fca250c44e15a32f1a778dde3140c71024951327d491ec2de ALSA-2026:69129 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995) * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999) * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283) * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281) * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssh-askpass-9.9p1-27.el10_2.alma.1.x86_64.rpm 3784c463548420f41ec3ad67a0d6d18c42c07c1e4c3ada27c9fde04f19ccf7ad openssh-keysign-9.9p1-27.el10_2.alma.1.x86_64.rpm 89d38736e3ff574d15887e47b2e7c416f22b4c60862069cd599b027125f731b0 ALSA-2026:69259 Copyright 2026 AlmaLinux OS 0 1 Moderate

tomcat update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default tomcat-10.1.49-4.el10_2.alma.1.noarch.rpm 05f66cc8b41b005142502d651ba514eded6e74fadebc4bdc6c0d92950d6879df tomcat-lib-10.1.49-4.el10_2.alma.1.noarch.rpm 1ef407ca747b0004e12dfb23f976be66e723a1e587ab0958cba13bdb751f2505 tomcat-webapps-10.1.49-4.el10_2.alma.1.noarch.rpm 3039facea1830d6007abf1fdc9482c06d32fcb2fb13da8d1c71963066f81e351 tomcat-servlet-6.0-api-10.1.49-4.el10_2.alma.1.noarch.rpm 3b705c8b7203a1082a75a9137b187f792afaaf227daf36911e2dbeccf5e0f1b1 tomcat-el-5.0-api-10.1.49-4.el10_2.alma.1.noarch.rpm 4df179b81ca2db0f43fec568ccc75a8679fffe363fec2fb6561e4f02955b8ae7 tomcat-admin-webapps-10.1.49-4.el10_2.alma.1.noarch.rpm 7c7acfc2c6790f4c32d6cdaf0b0ebdfa664f793a282af54ec03f3852621bb52f tomcat-jsp-3.1-api-10.1.49-4.el10_2.alma.1.noarch.rpm a6fc4fb2bc554f7fe792d34fef93212e54a6708c02ec0a9ef3f40adf76158df1 tomcat-docs-webapp-10.1.49-4.el10_2.alma.1.noarch.rpm d77aa50850c7291ba9872ee696549bcb39f63510d6dcf156bfa5d47ae3113c12 ALSA-2026:69308 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.3.x86_64.rpm dee0f5b0b234c9cb8b37dd30572e2b581df80f45f1c30924a7ddee4e038c5812 ALSA-2026:69461 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031) * firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011) * firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028) * firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013) * firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012) * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014) * firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) * firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021) * firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008) * firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007) * firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029) * firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default firefox-140.16.0-1.el10_2.x86_64.rpm 82655c4f97cbb3524fac7dc82a822a3af8d5e7b6ac6d49fe8960d81491cad5fc ALSA-2026:69541 Copyright 2026 AlmaLinux OS 0 1 Important

rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rsyslog-snmp-8.2510.0-5.el10_2.2.x86_64.rpm 0106f079cf09beb7aadf2a1e41ad405a28f50fc1f2a963df8082efa7fa3cfc63 rsyslog-pgsql-8.2510.0-5.el10_2.2.x86_64.rpm 0e4dcafd5a140c10f04c39b24c1b4de2d8a8a6c86d14f41411bfead194a038fe rsyslog-udpspoof-8.2510.0-5.el10_2.2.x86_64.rpm 1d93cd40c01ab77d451fbfd14794747c57b9bb2a9d89f444356db9948dcfcca3 rsyslog-relp-8.2510.0-5.el10_2.2.x86_64.rpm 208ffd19727075ba90eb4476d7c12f38ef56348d09d07a37f956917a7aa1951d rsyslog-mmkubernetes-8.2510.0-5.el10_2.2.x86_64.rpm 235ec63a2b456d1e34df5514deb731f8d45030f60716333dd282fe4140b47e5d rsyslog-openssl-8.2510.0-5.el10_2.2.x86_64.rpm 2ea0787095382b37592ce95103061bf466805381c9f2345acb3814652d4198e4 rsyslog-omamqp1-8.2510.0-5.el10_2.2.x86_64.rpm 3851d2a89926a91f8c574f115b056b1de8831bc808bf327b43369b53afa8830c rsyslog-gnutls-8.2510.0-5.el10_2.2.x86_64.rpm 4d1c50a77edf5bc220145e88d7e1aa53b20d04f14b2ddfd13cbbfa18966ff1f9 rsyslog-crypto-8.2510.0-5.el10_2.2.x86_64.rpm 8b041407e976bc7a9251103c59ed264f946d514883e504aec113b8e9b7e7874f rsyslog-mysql-8.2510.0-5.el10_2.2.x86_64.rpm 9865c4b3cccadd07e4c737e5f6689638ea4ab633f86edb9c8d9d3ad1d8165362 rsyslog-mmaudit-8.2510.0-5.el10_2.2.x86_64.rpm a129663d88c8e4276ffb27aab3ab902e9ea2af6a5e5529a49db1a8aae201a366 rsyslog-mmjsonparse-8.2510.0-5.el10_2.2.x86_64.rpm a7f6003aac30196d7674d7e63ef98444214bb37a04e064644cdf4f600ae63b41 rsyslog-mmsnmptrapd-8.2510.0-5.el10_2.2.x86_64.rpm bc0e24b72c37374faf20fda0f7f1b3d3238571d9beb2165ccfce18ee496f003c rsyslog-elasticsearch-8.2510.0-5.el10_2.2.x86_64.rpm c1cd207ec5859d0c0c1212fdcb54cdfb67e6e0b14fd9a4d3f19169ec2e54707b rsyslog-doc-8.2510.0-5.el10_2.2.noarch.rpm d0db75ed47fc8d888cb8c7c423f927c07b67ef296633a799feaa348cac1a5e74 rsyslog-gssapi-8.2510.0-5.el10_2.2.x86_64.rpm daf29fca11ad2493707d42d82a670ddf1091ea3c6fea5606233267f578180368 rsyslog-8.2510.0-5.el10_2.2.x86_64.rpm e0ccf84d37b1d1463bb5b549fa6302694e7ee4914af85c443750464e1c0aa936 rsyslog-mmfields-8.2510.0-5.el10_2.2.x86_64.rpm f86b77fcf469d8a813c89f75f7615f5811767566b1894013f0e5e34d72980fee rsyslog-kafka-8.2510.0-5.el10_2.2.x86_64.rpm fd524b72cfc34404b76725371994e3ccc011075d69b913631bd3f58a91cbe4b2 rsyslog-mmnormalize-8.2510.0-5.el10_2.2.x86_64.rpm fdabb442684271742d219517248f02205e8d5f3658130a973179d7841e201043 ALSA-2026:69553 Copyright 2026 AlmaLinux OS 0 1 Low

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header (CVE-2026-15028) * libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default bsdtar-3.7.7-11.el10_2.x86_64.rpm 43586c14e199e38d03bc4e92e2c4f156cfe54fdd135b29635232c72f0f2bcec8 libarchive-devel-3.7.7-11.el10_2.x86_64.rpm c7709890fd26b59788343b81361993a6d3242074a465d641779196821fc6c3e1 ALSA-2026:70186 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default postgresql-upgrade-devel-16.15-1.el10_2.x86_64.rpm 0ea816ec22c96377848108e9f75d2ea5331bc027470624232bf4419d03127267 postgresql-static-16.15-1.el10_2.x86_64.rpm 39413d66a3452b4303d5426c57d981a339bea615dde18519220dc6bcaa5a45cb postgresql-server-16.15-1.el10_2.x86_64.rpm 3ffea9848a549471b6dbf6180f4c5959ee6d89cf3de08501e89fb3ab27ea78f2 postgresql-server-devel-16.15-1.el10_2.x86_64.rpm 5fe632a7c9db6c5a1d5868562df360c1f69eb09c94685315351b210d2c36a4ad postgresql-upgrade-16.15-1.el10_2.x86_64.rpm 77a57cc244d54c62e178e3b2ca23d31fef23725f02f4d362a033e946b9f68883 postgresql-16.15-1.el10_2.x86_64.rpm 78839f8f0f59149848cf0f9f8948176288f6467dc6b1167d69a06907cdb59e0e postgresql-plperl-16.15-1.el10_2.x86_64.rpm 7fdfe2825e5d4c9f825ad06c576a8a4346022844cf8e4d223a7ff4dbb8dade2f postgresql-contrib-16.15-1.el10_2.x86_64.rpm 936905cf51e7323339f40dbc7c8d655e0923ecb4358d98fde573813f4504acab postgresql-test-16.15-1.el10_2.x86_64.rpm 9eaa9d84b15d2bf0403b722c8a31b0ac544d01450f4f7b2df1e1698304b416c5 postgresql-plpython3-16.15-1.el10_2.x86_64.rpm abfb7110a627804e8969441f1d379c2fd75347a62622e000ad42842a8125cbce postgresql-private-libs-16.15-1.el10_2.x86_64.rpm ca7e817848bd85c00081963c75c0160bc736f80d500bbc2b805eabec4f163c05 postgresql-pltcl-16.15-1.el10_2.x86_64.rpm cb246d2c110051cd2adab5e5c71e7537096eb88eca4c71398bae03ff0b73450d postgresql-private-devel-16.15-1.el10_2.x86_64.rpm da09251947e6fbfc4d3d23c530579857be5c626b5ce48a30e710124dbc78dcf8 postgresql-docs-16.15-1.el10_2.x86_64.rpm dfabea15e2d15f79be35cbdc52dfcc770dfc5213a777fdaf52a7372e46b50b20 ALSA-2026:70201 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * podman: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852) * podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730) * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default podman-5.8.2-9.el10_2.alma.1.x86_64.rpm 2ed70839a899a405681e59dc9b68ea1b6f7a9a2331913edaad0f1890fbc185b1 podman-remote-5.8.2-9.el10_2.alma.1.x86_64.rpm 9a4267f0ef0ed21e13d32d96732b90f2e3e3518692218d0541f5dd94802b7601 podman-docker-5.8.2-9.el10_2.alma.1.noarch.rpm f46c4a2f1c8d19490236bd31637b67ed406bf45d03eeaf0ed986334693a23e6a ALSA-2026:70498 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518) Bug Fix(es) and Enhancement(s): * Update kernel to use new certificate paths [almalinux-10.2.z] (JIRA:AlmaLinux-169478) * RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:AlmaLinux-255517) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perf-6.12.0-211.58.1.el10_2.x86_64.rpm 0d3460387bf88ad706415c1ff5ade4d19000b4de6979b064eca293cfa88cef68 kernel-doc-6.12.0-211.58.1.el10_2.noarch.rpm 2759cf0eebab0e931daf54293a7fa911cfd7d55cdb55ae2d2ad8d9f0fc021217 kernel-devel-6.12.0-211.58.1.el10_2.x86_64.rpm 3781b045489e7281dbe416db0064038853d1efa499efd5f90d0a26a489b58e66 kernel-debug-devel-matched-6.12.0-211.58.1.el10_2.x86_64.rpm 539f6042f8a5b331b2729423cefe238162f4aef356a7a4b9ec0def2cca0bc827 kernel-headers-6.12.0-211.58.1.el10_2.x86_64.rpm 817832c30129513f092525b652f3c79d3f0a2656638a9a2acb0c670cdba7f38b kernel-debug-devel-6.12.0-211.58.1.el10_2.x86_64.rpm 90e0831d24d804440838b473f40c5f613c73ab2b984580ff0729d04718516bbe kernel-devel-matched-6.12.0-211.58.1.el10_2.x86_64.rpm a37bab3567631a07240dd1a961073204ca1df052e8f8a92406e42c0f633746d6 python3-perf-6.12.0-211.58.1.el10_2.x86_64.rpm be680d4d4708f6ef9dd979416f4aba51a28a6ca10b3448b8ce9fbbb4a5ca34fb rtla-6.12.0-211.58.1.el10_2.x86_64.rpm d9df9844290d9f2df4d5896d6ebf23fa4e79361a3ad22cb02b64636aa615e427 rv-6.12.0-211.58.1.el10_2.x86_64.rpm f5cc58c542c3a36ed8a09bb9a58de116618028aaf822eed3a547a8a22395679f ALSA-2026:70753 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder (CVE-2026-73194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.6.x86_64.rpm 6631627a056f8e4a7ef40304fefa81eba7fddf6a21e145741c8a1541e325dafc ALSA-2026:71233 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007) * kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) * kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831) * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802) * kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053) * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383) * kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564) * kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569) * kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844) * kernel: net: tun: bound receive headroom (CVE-2026-81000) * kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846) Bug Fix(es) and Enhancement(s): * kernel module .ko ELF files with non-zero sh_addr section addresses [almalinux-10.2.z] (JIRA:AlmaLinux-159298) * sctp: prevent peer transport count overflow [almalinux-10.2.z] (JIRA:AlmaLinux-216247) * [AlmaLinux 10] bnxt_en: RX queue restart failed: err=-95 [almalinux-10.2.z] (JIRA:AlmaLinux-247283) * RHIVOS - S32G: backport missing fixes to 10.2 (JIRA:AlmaLinux-259788) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.59.1.el10_2.x86_64.rpm 30dad25c4bb3ea06bd37ed52efb447357666ab0216c92e41d7d60dab7bf25c1e kernel-headers-6.12.0-211.59.1.el10_2.x86_64.rpm 3c83fd158fdf5ecbb69cff5ff4a7290bf8e4cfdb23538359388e765de3664457 kernel-doc-6.12.0-211.59.1.el10_2.noarch.rpm 570136fba25a6b0e607b32762ab0b5f9a1bf9803cf7c18d367189ed301f9afbc kernel-debug-devel-matched-6.12.0-211.59.1.el10_2.x86_64.rpm 965d7a6651b369889dbb536bae2565706d0f0822edc018bc997032c6ba1e9b60 perf-6.12.0-211.59.1.el10_2.x86_64.rpm b2a5f2ef0948382eb78735976720c4b57d7dc27cf59b65448e5da8025e12f655 kernel-debug-devel-6.12.0-211.59.1.el10_2.x86_64.rpm bdfbf7bc1811197f5dd70dfe8e90a4a5feb65d2928a54cd5aebc9c0e673a38fc python3-perf-6.12.0-211.59.1.el10_2.x86_64.rpm c602689889a5c6868ff1c654c81c0690ee520ecadb26d8ecf3c4182b81095a70 kernel-devel-matched-6.12.0-211.59.1.el10_2.x86_64.rpm f2a6ed105f9ee33a546b759f1ad57a4baccc480aefa78dbec06b2d590a827286 ALSA-2026:71419 Copyright 2026 AlmaLinux OS 0 1 Critical

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717) * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634) * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default unbound-utils-1.24.2-7.el10_2.6.x86_64.rpm 1bcde7131cf59ce3d955601060df383b55aae284d405642f554ac99bbe2f91e1 unbound-dracut-1.24.2-7.el10_2.6.x86_64.rpm 2cece6c920eae28903e1735b6951ae18b2d12b663e72eaf0bff23f5b292fff45 unbound-libs-1.24.2-7.el10_2.6.x86_64.rpm 8e412b4168a7c6a43b32f1613d334f4c9a695249a95c8481f68a2d251f9f5987 unbound-1.24.2-7.el10_2.6.x86_64.rpm 93ed0a91ce682ad15262a001059f7b41ea645840bac9b3ee7c2918af16346b22 python3-unbound-1.24.2-7.el10_2.6.x86_64.rpm decd6586562f13405af6391bf8d611585dc6e32da6760e01e80c756dc50d96a5 unbound-anchor-1.24.2-7.el10_2.6.x86_64.rpm f5d59e5f399f8e235450eec4087929ba29b9fd88ca4ba6e8c9755b90a6c0d23a ALSA-2026:71543 Copyright 2026 AlmaLinux OS 0 1 Important

cockpit-image-builder security update

The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild. Security Fix(es): * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899) * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975) * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172) * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default cockpit-image-builder-94.4-1.el10_2.noarch.rpm 6d46bc65678588738897e9833c8b0821f6f410eb59d37f70469150a20636cb8a ALSA-2026:71586 Copyright 2026 AlmaLinux OS 0 1 Important

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138) * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143) * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140) * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142) * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144) * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.4.x86_64.rpm 41218c2e0c1004e63c3418737065f06af4e1cfdeb5623a868e3208e48fc471e1 ALSA-2026:71602 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323) * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285) * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984) * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990) * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199) * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311) * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005) * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203) * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290) * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098) * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121) * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108) * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257) * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267) * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266) * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273) * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714) * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481) Bug Fix(es) and Enhancement(s): * Bypass DMA APIs for coherent allocations for pre-mapped memory [almalinux-10.2.z] (JIRA:AlmaLinux-252331) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.60.1.el10_2.x86_64.rpm 076fa6f182dac224483a8457d5365671382cd613c496fc8f6c3884b0f18a9efc rtla-6.12.0-211.60.1.el10_2.x86_64.rpm 26b6322c51f93efd4949d59788d6a00f818cfd95454cb563de3d7eaf65bacefb perf-6.12.0-211.60.1.el10_2.x86_64.rpm 4b8425ce3c1b9caed721c443e711498e93bcfe4d5c6e0767ca3c7dc4e0fe70d6 rv-6.12.0-211.60.1.el10_2.x86_64.rpm 57d2a6a93e6b4f16d6f63685e8dd5bf159de7002c77b411c2936ab8e7cfb2e87 python3-perf-6.12.0-211.60.1.el10_2.x86_64.rpm ae5cd51a084dcc89b6eb94e3d872e512d8170b5dda6df4e7e13ad290a4e15023 kernel-debug-devel-6.12.0-211.60.1.el10_2.x86_64.rpm b130ead9992f99ad2a9609cf02ce6cb154de8e44ec4cbedf0d8d584de9e8a639 kernel-doc-6.12.0-211.60.1.el10_2.noarch.rpm bbbe1ee1c8c000232e1f59ed8256dab96ac04d67ae9d73b4bf3a15fc22954391 kernel-devel-6.12.0-211.60.1.el10_2.x86_64.rpm d1b0a93842bfb76e9e0e95ee954573d7c11ccac6404838d22d0b113a291e18db kernel-headers-6.12.0-211.60.1.el10_2.x86_64.rpm d7d38fecee3dbdaa6c89af7e670f01562f9d286b90bc1b22e80af51790bf38dd kernel-devel-matched-6.12.0-211.60.1.el10_2.x86_64.rpm d8123e2f293379ad09ef44cf59ca160f5172192c45f87164e3788c1642d6e823 ALSA-2026:72279 Copyright 2026 AlmaLinux OS 0 1 Critical

ipa security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux10.2] (JIRA:AlmaLinux-173375) * WebUI Hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238510) * ipa-otptoken-import hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238518) * host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-10.2.z] (JIRA:AlmaLinux-238522) * ipa env: support only simple * wildcard [almalinux-10.2.z] (JIRA:AlmaLinux-238526) * ipa-epn: drop_privileges method is mixing uid and gid [almalinux-10.2.z] (JIRA:AlmaLinux-238673) * ipa-migrate: require Replication Administrator privilege [almalinux-10.2.z] (JIRA:AlmaLinux-238676) * ipa-migrate tool is renaming host records & host info in automount information [almalinux-10.2.z] (JIRA:AlmaLinux-240768) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ipa-client-encrypted-dns-4.13.4-1.el10_2.x86_64.rpm 0e0da58be7c01ddf896e3abc0fd373f8e5c096b0071a57e4a57e9ccab6e942f4 python3-ipaserver-4.13.4-1.el10_2.noarch.rpm 0fd7500513d74955796c1d0fee7ecba945a8e28ace17bbdab27b6aaa886ae8c1 ipa-selinux-4.13.4-1.el10_2.noarch.rpm 3bbaaa21c4182fda1a5241bb0f5fc945b4dd8f1295609aea9cabfc4dc827688a ipa-server-encrypted-dns-4.13.4-1.el10_2.x86_64.rpm 3e14776a70378a7191b0ed24593f5dd1d93b5a0630f5456867c7cb28798797f6 ipa-client-samba-4.13.4-1.el10_2.x86_64.rpm 3fd033103fb37ef56915f8835c1684d83782de90365d85a38bf113d60b5f9137 ipa-common-4.13.4-1.el10_2.noarch.rpm 4144c11a83aecac08226230567deedacef7facf17ce0a31efefe1a2ad9aaa0a1 ipa-client-epn-4.13.4-1.el10_2.x86_64.rpm 4988abec871190e994bb72749cab1cab0647233fced71240805629d3d9db36a2 python3-ipalib-4.13.4-1.el10_2.noarch.rpm 4becc4f5c6c2c8d32741a3600b8b75f350754d326439bba74ab74eec92cbbde3 python3-ipaclient-4.13.4-1.el10_2.noarch.rpm 75d3397f9faa033046ebf837c3173a3b93b02cb7b7be5d66ee746e74cea35086 ipa-selinux-nfast-4.13.4-1.el10_2.noarch.rpm 898e7d3623722553f2ba1cd2b4a473f852a3e0790749aa320403d269e7a0a24a ipa-client-common-4.13.4-1.el10_2.noarch.rpm 99ad0482c8eaf5ea6a943447eaac1ba10950f97cd551e3ce6c2793f1832e41a8 ipa-server-trust-ad-4.13.4-1.el10_2.x86_64.rpm a4de845124293c01b2d2f0d342c5ca298538bcb65e440be418f84ecc21b55b5b ipa-server-dns-4.13.4-1.el10_2.noarch.rpm b51948fbd1e5414a345dd9a8a33d2f5c4e174fa72168bdc2518a48180e3894e1 ipa-selinux-luna-4.13.4-1.el10_2.noarch.rpm d6c79b60b49a1f8f4c6f9bdf660fa53d2910a7593dbace5e93e486cb87b288ea ipa-server-4.13.4-1.el10_2.x86_64.rpm d8e1964440cc224c9a5660ca55681ceb8e0d6df5e5cd713fa8194e5428f7e1c1 ipa-server-common-4.13.4-1.el10_2.noarch.rpm e77c01557668023ac072b330d723c4dd1555495797742ca39c2e7fef063bc959 ipa-client-4.13.4-1.el10_2.x86_64.rpm f9676a47e00bb9dc710c1e92c0d8339df7b96199eb6afd46fad908475023dd91 ALSA-2026:72427 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ruby4.0-rubygem-pg-1.6.3-37.el10_2.x86_64.rpm 6cdd051ae3eaf600f7a10c04163401f5dacdc1408914dd47a51bfff57a3c7dfe ruby4.0-4.0.6-37.el10_2.x86_64.rpm 7d65e5bbc271405f0466ddd2bb394f0679ee2a5fd45a4e23ad8a69321c62c027 ruby4.0-devel-4.0.6-37.el10_2.x86_64.rpm 8d16a179a1ee9fe0300fd5e275a5a1b7c1f1f81acbc31e4afc3a82c31edd2aa9 ruby4.0-rubygem-mysql2-0.5.7-37.el10_2.x86_64.rpm ff78bcf84b00ad1603cc908c2b7dcaf9df82bb34ebd5ee6380a03d6e10634d9c ALSA-2026:72624 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076) * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942) * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317) * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341) * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522) * kernel: perf: Reject exited events as group leaders (CVE-2026-74753) * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480) * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775) Bug Fix(es) and Enhancement(s): * KVM: s390: Limit adapter indicator access to mapped page [almalinux-10.2.z] (JIRA:AlmaLinux-188661) * crypto: xxhash64 should not be fips approved [almalinux-10.2.z] (JIRA:AlmaLinux-254943) * kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ? guest never executes. (10.2.z) (JIRA:AlmaLinux-260402) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.61.1.el10_2.x86_64.rpm 051edf56c06038cde020cde987b66a6f2afb5e25ff43ad08814435c50c89bcfc kernel-devel-6.12.0-211.61.1.el10_2.x86_64.rpm 318d632925aca12f1fd725d1127683746c504ae5f8d19c14031c4e321e2d2773 kernel-devel-matched-6.12.0-211.61.1.el10_2.x86_64.rpm 4a70226274aa1ed8d42972d7e9c344dc7e858440e8c9267bcdfdbdbaf86a7233 kernel-doc-6.12.0-211.61.1.el10_2.noarch.rpm 6d745d7d315fc5f6d99298e2a1473d86795b33684aeb63850538eb9f248208c2 perf-6.12.0-211.61.1.el10_2.x86_64.rpm 835cf3ca8ba13bb5a36b2005abfa7cdfeddc584df3015c2e9225e87e72d2d514 kernel-headers-6.12.0-211.61.1.el10_2.x86_64.rpm c69acba8e1bfc09e992b694790baed31de922df5b9be9b283b088cfeae5c0fc9 kernel-debug-devel-6.12.0-211.61.1.el10_2.x86_64.rpm cbe32632bcec817953e1fe1d763091b65486aa23faa733259c888027ad2b2185 rv-6.12.0-211.61.1.el10_2.x86_64.rpm eac026227fb9db833098325bc4de6d0100d75abce887835121514f4cbd87072f python3-perf-6.12.0-211.61.1.el10_2.x86_64.rpm ec4b395eaa4dc11d38bdfc94a572e17b0c43a9999e84a5b222549fdcd6e6fc96 rtla-6.12.0-211.61.1.el10_2.x86_64.rpm f94f00af698ab8f64a96d585cae74a3b6a887dbfca3981c47cfe1b87978d8ee1 ALSA-2026:72785 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rubygem-irb-1.13.1-15.el10_2.noarch.rpm 109ed4ad1eaa45bf5dd31e4d43f1ae7d8d990a2c4d7eb7d161005b447b9cfc31 rubygems-3.5.22-15.el10_2.noarch.rpm 11349eba9345d9f2cc94bf421e58373e1d5458cbb9114f92d6b98d8207922418 ruby-3.3.12-15.el10_2.x86_64.rpm 204928709f3de35aab5a36a7ebdeb693f344c1e689075803db1c4f2db855f73f rubygem-rbs-3.4.0-15.el10_2.x86_64.rpm 2507bb0ff9b9d7917d5f2b68994d29f862fccfe79f1a6031eceb6e8a6346c7f3 ruby-devel-3.3.12-15.el10_2.x86_64.rpm 287c046b109da02b16dc1d694db67eeab16128cd1b25597fa3b943d844fba122 rubygem-racc-1.7.3-15.el10_2.x86_64.rpm 401b603c34daf5a62c86ec1c8426dce14ca4e03a67a15b888c1db12e452f7b2b rubygems-devel-3.5.22-15.el10_2.noarch.rpm 492612048da0e57f477983879982cb57b3eada4308202c6d3fee92d24838f1e5 rubygem-bigdecimal-3.1.5-15.el10_2.x86_64.rpm 550e23c213ffdf32e820f19414448ad98b03e16287e534e553a9e733bfad4770 rubygem-rake-13.1.0-15.el10_2.noarch.rpm 6c4b9241ff9efa450aa5d3329a216aa37da225de270e1a5fe3f5f832b872e5ad rubygem-power_assert-2.0.3-15.el10_2.noarch.rpm 854289d012a71949ba1daef7ada1a60911e03ba7ba8676153267c548b6ad62e4 rubygem-psych-5.1.2-15.el10_2.x86_64.rpm 8e7222b479005c4ecbe1158e1e1ab0d3a5f910279846b015522f7b54cda4aee8 ruby-default-gems-3.3.12-15.el10_2.noarch.rpm 9155f150b9f91e2dafb16414991ca13c36df3f4aee6ca777ca785c0180a1f86e ruby-bundled-gems-3.3.12-15.el10_2.x86_64.rpm 936b8d645a54bfb94ae1ce1f0064a868e898bf8132ba29bd4019b1e79d289c92 rubygem-minitest-5.20.0-15.el10_2.noarch.rpm 981707b75742760cc5c109ab99fa4285d4062bb296b498d5b21eb4ff7869c5fd rubygem-test-unit-3.6.1-15.el10_2.noarch.rpm 982aad6d4f946198793b11b68f74cc897cad5306f4398bac99c666a1c85bdf92 rubygem-io-console-0.7.1-15.el10_2.x86_64.rpm 9991c514c27920b84cdb429b22e37dcd602c6580eb19994f6e7456ebc2c3cef1 rubygem-typeprof-0.21.9-15.el10_2.noarch.rpm a685c24c2adbb428ee0cbfe323eb4e6a3c6c342892b6be21a0290944b16acf89 rubygem-rdoc-6.6.3.1-15.el10_2.noarch.rpm da102fb3c095a3ec1f34f5f5a2ac9fd136e78f9fb8ae0ed3b5f70b5e93856125 rubygem-rexml-3.4.4-15.el10_2.noarch.rpm e05b865f8e326502a6561acbfe24e18752a7487792d727bb1f7154f70d471abb rubygem-json-2.7.2-15.el10_2.x86_64.rpm e8ff684e2e9abdf9742c65e1218d6c3a38012e9340be71a299ece922f7b66401 rubygem-rss-0.3.1-15.el10_2.noarch.rpm f72093880d7151f2ac3049b0131eef30043c09b0a89c1ef075bae97585e288eb ruby-libs-3.3.12-15.el10_2.x86_64.rpm fbdd6f345da06715d8b60d35a6eea2fe71940517cd04d1797a672ea3a9c94047 rubygem-bundler-2.5.22-15.el10_2.noarch.rpm ff78ada1e367ca1dff09e79265bf4cff6a89438532915087f337c77c7cd2923f ALSA-2026:73130 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) * thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639) * thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641) * thunderbird: One byte overflow read in mail parser (CVE-2026-84640) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031) * firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011) * firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028) * firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013) * firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012) * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014) * firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) * firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021) * firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008) * firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007) * firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029) * firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023) * thunderbird: Out-of-bounds read in IMAP response parser (CVE-2026-92240) * thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line (CVE-2026-92239) * thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers (CVE-2026-92238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default thunderbird-140.16.0-1.el10_2.alma.1.x86_64.rpm eff5b5b8764305e048aedeb33eb284370b2a35942da09d6a0b19148fab739c50 ALSA-2026:73427 Copyright 2026 AlmaLinux OS 0 1 Important

gdb security update

The GNU Debugger (GDB) allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion and printing their data. Security Fix(es): * gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF (CVE-2026-13732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gdb-gdbserver-16.3-3.1.el10_2.x86_64.rpm 187bbdde44cca16364c3432492322ded5954fc060ab1fa15a43c647ddad3c9de gdb-16.3-3.1.el10_2.x86_64.rpm 336e84deda15fa41d4809ae93a89fc97227284345340c288c25acee499de11c8 gdb-doc-16.3-3.1.el10_2.noarch.rpm 39dce27fc5099ec9272403ef4efccf67f2543fb0057041caf17d6dd68cc06eb9 gdb-minimal-16.3-3.1.el10_2.x86_64.rpm 555edd52f9720200845eff8e65f0a670d13f73bd9e74ecc6e06fcd11c10e1197 gdb-headless-16.3-3.1.el10_2.x86_64.rpm a41a8918a4b4565edb43be477a8dd354239d25a38063a51941bc7afb3872a264 ALSA-2026:73428 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs24-devel-24.21.0-1.el10_2.x86_64.rpm 24dc4b4bf6ce8903f0f7dd9c75543771c88eec54a5a39c323032692392cc9687 nodejs24-libs-24.21.0-1.el10_2.x86_64.rpm 2d5b5442ce8c087b8dc1b45d7b3fc4a60c9c1d9f4d686ce0a997855d38cbf469 nodejs24-docs-24.21.0-1.el10_2.noarch.rpm 3c0582da0fa349b5c85a8671a5ccff46d1d89830e1e263672e2e93e4eb5161c5 nodejs24-full-i18n-24.21.0-1.el10_2.x86_64.rpm 744334b4c60b7ceab18129dc88974c37a0461cdd2ad25ad21c0ccaba114c3273 nodejs24-npm-11.19.0-1.24.21.0.1.el10_2.noarch.rpm c33582aee585c85053bce7f5822e3f7bccd46c315de9ed48e5522daeeeec7080 nodejs24-24.21.0-1.el10_2.x86_64.rpm e904397d02bff79dacd50c5dca92f3e42f098f543c98e2d1ca8e77d2cf591b84 ALSA-2026:73429 Copyright 2026 AlmaLinux OS 0 1 Moderate

gawk security update

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs. Security Fix(es): * gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468) * gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service (CVE-2026-40553) * gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gawk-all-langpacks-5.3.0-6.el10_2.1.x86_64.rpm 0b5a5afc89125796bcd210f4cc5fbc4368a9a96437e14104c57f1bc6ee788eac ALSA-2026:73765 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561) * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default idm-pki-java-11.9.0-5.el10_2.alma.1.noarch.rpm 0cdf052ebc4a0c8e950bbeca80d0f2c7c6760d139c66043c04ced088658411e4 idm-pki-ca-11.9.0-5.el10_2.alma.1.noarch.rpm 222cd95d6a7904a983de39241895dd9acb151c45c8a7491e9550adc37bd65352 idm-pki-base-11.9.0-5.el10_2.alma.1.noarch.rpm 582d387b6396d8e4e698857b48390f3d102d7ac512738e3cc874874c5c912711 idm-pki-server-11.9.0-5.el10_2.alma.1.noarch.rpm b0f00e34f7b8789bf4cf070694a5cd3513616af2667ab61700b8c68820ad419c idm-pki-acme-11.9.0-5.el10_2.alma.1.noarch.rpm b5bef02548113c0fa533f73999506eb0f9f5ed8060cc5870f5a024cfe04b38f8 idm-pki-tools-11.9.0-5.el10_2.alma.1.x86_64.rpm c7a5b5626c46a78bb8aaa8b1440ce2a696ff1cedad0a563d216b0a51a973c589 python3-idm-pki-11.9.0-5.el10_2.alma.1.noarch.rpm df55263895dce79bb1709226dd320f18f208f120a85e935cfa2ab9bc787fdda0 idm-pki-kra-11.9.0-5.el10_2.alma.1.noarch.rpm e5fda389acc85e9115f766d485557babdcf49b10683904f1114a8015fcfe0ae7 ALSA-2026:73954 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay (CVE-2026-60001) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssh-keysign-9.9p1-28.el10_2.alma.1.x86_64.rpm 4e511754bb353498e24c34ce5d903f9b2538f316161adf9e9efb8195d5e5a2ec openssh-askpass-9.9p1-28.el10_2.alma.1.x86_64.rpm 9aa56f5210d12c792c66be91955d46f076de6d10b6c3bb8b787edebf29dc1934 ALSA-2026:73979 Copyright 2026 AlmaLinux OS 0 1 Critical

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.13.x86_64.rpm 2d5921c6ddf347cb5321d9894fced2577fd905b3b12f28bdf8319ffab77a5e94 freerdp-libs-3.10.3-12.el10_2.13.x86_64.rpm 4c8c7b95b08f60d58a9e0743cf7ee14a78f75733b1013500df89df5be55406bc libwinpr-3.10.3-12.el10_2.13.x86_64.rpm ebc55fb1d50896964c065fdfcf6ba314e6c490b6b852e09025e2b846d735c001 ALSA-2026:73998 Copyright 2026 AlmaLinux OS 0 1 Important

gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer. Security Fix(es): * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268) * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gvfs-smb-1.54.4-4.el10_2.1.x86_64.rpm 008f875727080d5aa37252f31c83bb6105f770965e7c005dbc5c0c9ba7894256 gvfs-1.54.4-4.el10_2.1.x86_64.rpm 3ae6abf85911c2dd3992af3024d438ad4aba08f73f0e1fb1ddcd5ef061f3a9d4 gvfs-goa-1.54.4-4.el10_2.1.x86_64.rpm 69b1c753b81e0ccca40674467dd29c66346bcbc355c67654dfae4b37d6d7893e gvfs-fuse-1.54.4-4.el10_2.1.x86_64.rpm a3b1903b644b37aacf3faf4c10f58d8f7e7ebfcc70ed82f49c0ed09ba16b2e53 gvfs-gphoto2-1.54.4-4.el10_2.1.x86_64.rpm b76d0f459f552a8da92bcf48705f43dcd8a2b0815b8f481f9ad7ce11c447b5f4 gvfs-client-1.54.4-4.el10_2.1.x86_64.rpm be2c2f4206e3094316321027867d33309ad2108aef797bb6d1dc9ca22882da35 gvfs-mtp-1.54.4-4.el10_2.1.x86_64.rpm ea69fbfb9a1289f7ca3bb126160810db1b5de2d65dce2cc792c3b10a2cc867f4 ALSA-2026:74001 Copyright 2026 AlmaLinux OS 0 1 Important

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046) * expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.5.x86_64.rpm 6e4f7bd028c902425cb58bf2b365cf98d79da24078e92815d32c027d8df6103f ALSA-2026:74464 Copyright 2026 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ghostscript-doc-10.02.1-16.el10_2.1.noarch.rpm 617175f855bb442ae2b330cea4f12398f5b091a7d462994c072769221b20c59e ghostscript-10.02.1-16.el10_2.1.x86_64.rpm a20e64fc407c45c2fa84e35026bd3a6328f19d022b3fcd80b395cfacc4621e3f ghostscript-tools-fonts-10.02.1-16.el10_2.1.noarch.rpm afeee0186e3b8fc2a1465593bc73b907e5983363ee869023e04bdc397fa74493 ghostscript-tools-printing-10.02.1-16.el10_2.1.noarch.rpm c49fc8445ae5065659355a423f7eff2b5067e08b45ae02b7062620618b3b5cb2 libgs-10.02.1-16.el10_2.1.x86_64.rpm e3981ee49fb6733221ccd1abed413f47e07b2a43def3b44eaf04c877489b3fa3 ALSA-2026:75570 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089) * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) * FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) * FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947) * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950) * FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960) * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libwinpr-3.10.3-12.el10_2.14.x86_64.rpm 0c8d5b8e75b30dda950b634e4a5d104b3f8e2a4804ae5e43ebb9f8ca1121a04c freerdp-libs-3.10.3-12.el10_2.14.x86_64.rpm 10a4f2b8cef0299d81da5c289628a44a6aebfe4e5f0b46fb3eaf82ca49fb505e freerdp-3.10.3-12.el10_2.14.x86_64.rpm 7f151291cfc15103e0ad0fc9962aa66386b9102e88f94c9d4bd389f30f3b0dce ALSA-2026:75576 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099) Bug Fix(es) and Enhancement(s): * gve: backport large queue depth patches [almalinux-10.2.z] (JIRA:AlmaLinux-219261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perf-6.12.0-211.62.1.el10_2.x86_64.rpm 1c50bdba46a46a78e0d6f9781a0f8d62140f003b73140f323560fda491a14345 python3-perf-6.12.0-211.62.1.el10_2.x86_64.rpm 1d8d9dccc16e369314e534d595d878fbd6283dba321fe2cc1993267c5a08c2a9 kernel-doc-6.12.0-211.62.1.el10_2.noarch.rpm 4651096af1f2c0d1dadca18c541eee91d0617eff4471a68b40d10def0058f9c3 rtla-6.12.0-211.62.1.el10_2.x86_64.rpm 9b418165ce47f3cbf17a1d7dd30d1763cba280988ac2ab2c2b24d051612ee2cc kernel-devel-matched-6.12.0-211.62.1.el10_2.x86_64.rpm 9f35f2eeab3ec1ee99cb81a2584eb721c7fa9183588235d10ab270ef3d4bbded kernel-devel-6.12.0-211.62.1.el10_2.x86_64.rpm acf21f0c24e5d5b757bdae73ebbc16c9dd0356f9d34bf01344ecae26e2b1871c kernel-debug-devel-6.12.0-211.62.1.el10_2.x86_64.rpm b3e00837246dd3fd3dffa24fd4933142535f640350143c8431653aac909b86cb kernel-headers-6.12.0-211.62.1.el10_2.x86_64.rpm d60ee432070522935f2f2de3db68e720a7fbc127165f0443ef7cd2f0820d9d7c rv-6.12.0-211.62.1.el10_2.x86_64.rpm dba3d6de19f4768bee3e743a3c4850d6179caad7c3210ad664333368325a0bd4 kernel-debug-devel-matched-6.12.0-211.62.1.el10_2.x86_64.rpm f5ce1995f45280002be5a6539026e04d30ff20f0cda92f866b0a9b97ffc7387a ALSA-2026:75577 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736) * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default bind-dnssec-utils-9.18.33-15.el10_2.12.x86_64.rpm 2d9e8c8ccf174ebc441e08523d50a871fb39593ad506abc3999e84add71e3eda bind-chroot-9.18.33-15.el10_2.12.x86_64.rpm 2e0c7cd0a96f05db17809642fe6f2e0a4ca4e851c0fd7fc914792237f2138a9f bind-utils-9.18.33-15.el10_2.12.x86_64.rpm 353b8c7b1931a72d5cd39e87e1ed784e43b1eb8f4e701eeb141ead023559db94 bind-9.18.33-15.el10_2.12.x86_64.rpm 450ee77fd0ec828867c1795fa2d4e3e164adbb34b1803ad17d37031517b076ad bind-libs-9.18.33-15.el10_2.12.x86_64.rpm b2b971f98461005f0400291b2f6e8b997d9a8575774d4b5bdd47f1d5335c6fad bind-license-9.18.33-15.el10_2.12.noarch.rpm cf3c504a9857ffd2222e1db77e1c60344ac788c5662696ad6ef92bbac52bdf0b ALSA-2026:75579 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-10.p2.el10_2.7.x86_64.rpm b26fad75a54b7fa89821a0f218e4f62c865220d375ce635f192abb6ed3dc22f6 ALSA-2026:75581 Copyright 2026 AlmaLinux OS 0 1 Important

mod_auth_openidc security update

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mod_auth_openidc-2.4.16.11-1.el10_2.1.x86_64.rpm 79c04f6326c5e6c332b4c40962009cf20a1c8590e1c3634776615844cdc28d8a ALSA-2026:75583 Copyright 2026 AlmaLinux OS 0 1 Important

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622) * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917) Bug Fix(es) and Enhancement(s): * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-10.2.z] (JIRA:AlmaLinux-186019) * virsh dumpxml missing one SCSI disk when VMware VM has 64 disks per controller [almalinux-10.2.z] (JIRA:AlmaLinux-191267) * libvirt-guests does not work together with virtlockd on shutdown [almalinux-10.2.z] (JIRA:AlmaLinux-224982) * Expose guest-get-devices in libvirt-api [almalinux-10.2.z] (JIRA:AlmaLinux-243305) * allow hyperv pvpanic "device" to process Windows crash dump [almalinux-10.2.z] (JIRA:AlmaLinux-242547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libvirt-daemon-driver-secret-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 17bb6a05a951f1063dcebe2fbee11d1fcd6445f8cb7bdc50c51fb54c970b8896 libvirt-daemon-driver-storage-scsi-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 1c023521bad889d441c515264b31d9976a9f751dbb027b777421ff990e29c833 libvirt-libs-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 2678abd6316a6e69a514fa00de299008ac796409a7430eec9beff0c40d4a0139 libvirt-client-qemu-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 38930357ecdaf62003db9c4ebd18a4b749a60d649636d75b09b9aecba4dbe9f8 libvirt-daemon-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 3a3bfd353aac1ab0e4a5c6547729cdaafe4fc637cd3c835b9528204c5996d106 libvirt-daemon-config-nwfilter-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 41781b09717b59fc8d18f049eb1f58ae4d1e7f08f3a853f1c14053c55e7735c3 libvirt-daemon-driver-interface-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 53a69097012d2d55dc3959bdab2ccf4bc9c33466dbc99b5413781ddd9e04e5aa libvirt-daemon-driver-qemu-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 6031a89699321f290d9681c8c735d4b8a6ff211b87af1bc8af2b3e49340372b4 libvirt-nss-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 65cf22a4c2bcb9bb8f7e19cf8f843afda02b1e3ed0955961053ae0fcecb3014c libvirt-daemon-driver-storage-logical-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 6a7e7173d1f6ac08121a4b678301221777bb036c0a41c34d48b5f2cd95cfd093 libvirt-daemon-driver-storage-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 772aa027324e077b7dc61fc9bc36065ef69ce9823c9c35fb343e86d9ee6e9c62 libvirt-daemon-driver-storage-disk-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 7a59fb337b6141d5ac1d723ecd7ba0c58860a823685ad46f4b1f95a15d944e1f libvirt-daemon-plugin-lockd-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 84b0218b71a4484bba781aceb68f6f9ea654eace76861813b312c437492c168b libvirt-daemon-log-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 98c1630e77a98b794ad7303f7038e7d8468f8c707fd9565213622f8a06315d17 libvirt-daemon-driver-network-11.10.0-12.9.el10_2.alma.1.x86_64.rpm 9fc697d4589b6afadeacf45c7701dfed9707a413b9a7e4b99555804d615f31a3 libvirt-daemon-driver-storage-core-11.10.0-12.9.el10_2.alma.1.x86_64.rpm a4f6ab5a7f7e76274e5f8f616cb6b1e9e7dc20084f6c9471e85813f0a18a0f65 libvirt-ssh-proxy-11.10.0-12.9.el10_2.alma.1.x86_64.rpm aa0886f0712bcd542267cb691e0996fb8ea175884544049ea8873c7f624e2693 libvirt-daemon-driver-storage-iscsi-11.10.0-12.9.el10_2.alma.1.x86_64.rpm afb8f9a9cdb93595406ab73de3e5e3958fe93ae27f8bbaf29d032f216d591302 libvirt-daemon-config-network-11.10.0-12.9.el10_2.alma.1.x86_64.rpm b19737ba8a333bc9013b928674ae875f7e865bf4224261a86208da93d686e765 libvirt-daemon-driver-nodedev-11.10.0-12.9.el10_2.alma.1.x86_64.rpm bbafea634ae538c7435e9e10eae7955eaa3228f201cd20a5e6289096445c9249 libvirt-daemon-driver-storage-rbd-11.10.0-12.9.el10_2.alma.1.x86_64.rpm bfeb8ad8614253e7b5b8f6a30ac0d04bb0a3a7e331abb4b34e1edda692de9484 libvirt-daemon-common-11.10.0-12.9.el10_2.alma.1.x86_64.rpm caaf1765b444fc869eb66675a776f95d188c9cc5164a09c03dfa46faf88e983a libvirt-daemon-proxy-11.10.0-12.9.el10_2.alma.1.x86_64.rpm e49c5f5e3b7f75849ea6ad5e2628cf43c7320308d9c84f2d26f014cf5ee3df88 libvirt-daemon-driver-storage-mpath-11.10.0-12.9.el10_2.alma.1.x86_64.rpm e75bc322fe31d953acf8dbef2ebbfa4fe84e782c3ba3a98a74082f9a4ef055ac libvirt-client-11.10.0-12.9.el10_2.alma.1.x86_64.rpm e86b5169c80abd8a632027a1cf2d149de10f77f709454a9040e5bf1458553056 libvirt-daemon-kvm-11.10.0-12.9.el10_2.alma.1.x86_64.rpm eb8dd89d5ca54ebd655c8932f7ada9264f3ddfd155fb2d9d2b5942ec36bc6422 libvirt-daemon-driver-nwfilter-11.10.0-12.9.el10_2.alma.1.x86_64.rpm ec555bfead0ce6da6afdce18479e348c8d0a01e43457766afd1b425c1381df30 libvirt-11.10.0-12.9.el10_2.alma.1.x86_64.rpm f36ed36f7d4d73bdbd7e24d88d4f42b86ec63bab15c7789176c0d0b117ecf08b libvirt-daemon-lock-11.10.0-12.9.el10_2.alma.1.x86_64.rpm f41786c70886f6ea5f7035d73c980a3c8f819aac0e940430f2049a9535c57a7f ALSA-2026:75769 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-73073) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default xxd-9.1.083-9.el10_2.22.x86_64.rpm 8984e275faa7534050165e23107fbd0496c0219c1ff5ad89ec6057e2f9544925 vim-enhanced-9.1.083-9.el10_2.22.x86_64.rpm abc76d8128bc261434cf86de28b210960356b4a28913a3d7b52c3f68151d7055 vim-X11-9.1.083-9.el10_2.22.x86_64.rpm b31c90c21d7a5db5d32b610e3196f78a6aa792d04ae1be7354b736ec838d9c4f vim-common-9.1.083-9.el10_2.22.x86_64.rpm da6fc73915d1f50b23998b60f445b51a520678588e0e613a73349778e8030f1a ALSA-2026:75864 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default nodejs-libs-22.23.2-3.el10_2.x86_64.rpm 05a1e4ad67463a1e57321eb8faea8532de85f8046e1ad4ee4ffec271b3970f7b nodejs-npm-10.9.8-1.22.23.2.3.el10_2.x86_64.rpm 1020b90562993a44933da4bcd1b39c37e869f145b3bfeda0c206bb534b1d308e nodejs-docs-22.23.2-3.el10_2.noarch.rpm 214fba9be3d9a6ef94f9450d61364b06af4c6aa7e8bf11fcc46229596bed6a07 nodejs-devel-22.23.2-3.el10_2.x86_64.rpm 79543284e1db16ea4ce23e07eb6abdf11ea66e4c0931bb241ef114e72ddf7a62 nodejs-full-i18n-22.23.2-3.el10_2.x86_64.rpm daa11c110a86d2b9a4035749896dedb01775d60ee2e7ecf474c48f3089dc150b nodejs-22.23.2-3.el10_2.x86_64.rpm f10e0e238bef28fc92c2666ac83fc70a2577d219dd6113287ac0f651717a236d ALSA-2026:76735 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sqv security update

A simple OpenPGP signature verification program. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sequoia-sqv-1.3.0.2-1.el10_2.x86_64.rpm 68bcd4c214e5088a8eb920ff233ccf24d5b2607327985fcc038c86ef2295ac12 ALSA-2026:76737 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sq security, bug fix, and enhancement update

Command-line frontends for Sequoia. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) Bug Fix(es) and Enhancement(s): * Unbundle capnproto from sequoia-sq [almalinux-10.2.z] (JIRA:AlmaLinux-177547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sequoia-sq-1.4.0.1-2.el10_2.x86_64.rpm c81355ec555a93882acad1355d4ba99545cf88b1581cd4bd41dd28250b251e96 ALSA-2026:76738 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860) * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270) * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357) * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992) * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994) * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078) * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132) * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557) * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255) * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516) * kernel: packet: use consistent hard_header_len in non-ring send paths () * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582) * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775) * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921) * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972) * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227) * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) Bug Fix(es) and Enhancement(s): * wifi card breaks using FIPS (JIRA:AlmaLinux-257457) * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.63.1.el10_2.x86_64.rpm 273d2ca939a029cd2cbb90b7874d1c501a417661a7ada361a20146fac03cd1a3 kernel-doc-6.12.0-211.63.1.el10_2.noarch.rpm 4e40163bf75706368e25c8afc3979c308c7fb0ca59fb79c24d6c10fe3130f8f9 kernel-debug-devel-matched-6.12.0-211.63.1.el10_2.x86_64.rpm 6848e974670d03c3423477409db67e8ec4ebca8aa73a07b10c0489775e3436f8 rtla-6.12.0-211.63.1.el10_2.x86_64.rpm 7d48042c2d29c69aa5496f73313a7ffbe1934e13f6e3a79bd08c759a12233fe7 python3-perf-6.12.0-211.63.1.el10_2.x86_64.rpm 8e8730fb72e3523c22947757e288bfb071ddf296e70df90a7872c9c3bc5d0516 kernel-headers-6.12.0-211.63.1.el10_2.x86_64.rpm a4de10eb6c97f2e5a65229f937b0242eb843869dae6aedfdd85a5a6943552f50 kernel-devel-6.12.0-211.63.1.el10_2.x86_64.rpm a52d064514f31fdc9248764c086b93fb596ac45edd341af764d9d15d7dc3e569 perf-6.12.0-211.63.1.el10_2.x86_64.rpm b2a42e17b47452da757238dcb9f401bfb982e354b44781c95a00f994401b122e rv-6.12.0-211.63.1.el10_2.x86_64.rpm c13cf803dd31d3231482a5aa0857c0e9b81d1147cc6a15d32f24500368f84571 kernel-debug-devel-6.12.0-211.63.1.el10_2.x86_64.rpm ecc90f7bc21a6af9fc37fae701f3d823f9429c69fb1895abbfc308f1a198776c ALSA-2026:76743 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests (CVE-2026-84445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default opentelemetry-collector-0.158.0-1.el10_2.x86_64.rpm df3a69daf9678493827ff8e3dc5ebfc27e9edd64fea7c032d0524486edd05fca ALSA-2026:76762 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.7.x86_64.rpm dc017e24ff704250afdd688c3b9c585e304fcda07ced06f561dcdfbf504a427f ALSA-2026:76781 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368) * glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791) * glibc: Buffer Overflow in strfmon right-justification padding (CVE-2026-19499) * glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542) Bug Fix(es) and Enhancement(s): * The iconv utility no longer returns exit status 1 after a successful //TRANSLIT transliteration * A counter overflow in __wcsmbs_clone_conv that occurred when setlocale was called has been fixed * A fcntl.h header conflict when compiling on AlmaLinux 10 has been resolved * Minor documentation improvements have been picked up from upstream For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glibc-locale-source-2.39-142.el10_2.alma.1.x86_64.rpm 5a68624f64b2b79d4b218cb4fec935d62a6bbbeff9f5ec9cc5dd299913cec3a1 glibc-devel-2.39-142.el10_2.alma.1.x86_64.rpm 719f2f026e77c91b166ac61959b4ce969a8bdcf18b62eef945bc7bb39f1ca83c glibc-doc-2.39-142.el10_2.alma.1.noarch.rpm 9ff671a257df14b19f73a58d114b8b73bcc77d16d5944e412b42babfd68bffd5 glibc-utils-2.39-142.el10_2.alma.1.x86_64.rpm bb8ddc919cfe88552fca9828c0b231cdf5a826f574c89cdd820e454921d8fe5c ALSA-2026:76918 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssl-perl-3.5.8-2.el10_2.alma.1.x86_64.rpm 92af2db7e68254576eff8cffd4b01c2358cf925607a6de2cd36cd0b2dc09853f openssl-devel-3.5.8-2.el10_2.alma.1.x86_64.rpm f19e0d910d935bc7bad19f833e0e8adc43474c28cd6eb8a005f816397469a34e ALSA-2026:77018 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3.14-devel-3.14.8-1.el10_2.x86_64.rpm 14ce9f5e263e36f7dfca1faa256e4e67d6e8c926890b609e0fac4e5f92269511 python3.14-tkinter-3.14.8-1.el10_2.x86_64.rpm 72702bc39ae92e94c6439d55acf35111ed4c654cd284431584518e05c3603a0f python3.14-libs-3.14.8-1.el10_2.x86_64.rpm 9f52a2fed621163800eb7041204cbc01db1abde48b8947f1c198fce3d47e2cc3 python3.14-3.14.8-1.el10_2.x86_64.rpm a58bad5066da8a4255c2ebd0a70d18b648da4e9d88ddca8e4f18b5f6e1211411 ALSA-2026:77020 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-devel-3.12.15-1.el10_2.x86_64.rpm 88bfe6157b464887f032d828071309d21286a450124818b503db11d06528e116 python-unversioned-command-3.12.15-1.el10_2.noarch.rpm 8c7ff57dbefad31a537c80cf34212f88d1136e20c2922150444565e58eb8d223 python3-tkinter-3.12.15-1.el10_2.x86_64.rpm d8f5048e80c67f11122af6e688fbec8f8736bfd13335aaba3f41eff2ee353b29 ALSA-2026:77534 Copyright 2026 AlmaLinux OS 0 1 Moderate

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation (CVE-2026-87853) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sssd-idp-2.12.0-3.el10_2.2.x86_64.rpm 4082e9965c51dbbac5e2560bf7a6e0d6880d931806f1b7b971a31a0d5671451f ALSA-2026:77648 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default idm-pki-base-11.9.0-6.el10_2.alma.1.noarch.rpm 08cad358e01aeaea12f186ece0391cb7e0364ef41ceeff79643cc2483d3f898a idm-pki-ca-11.9.0-6.el10_2.alma.1.noarch.rpm 29d3862dababdb52efd6b9b8d0372dc5651d36ee8ddf03be663bce826f8057f7 idm-pki-tools-11.9.0-6.el10_2.alma.1.x86_64.rpm 67abed3af16db0db1a763e2b101500bb27e28d5121ed8f7b65d88f31f164d6b6 idm-pki-acme-11.9.0-6.el10_2.alma.1.noarch.rpm 7f0b192b8db647fca321e71a6b228288db085e67440a44ed2a3b091c5afc2756 idm-pki-kra-11.9.0-6.el10_2.alma.1.noarch.rpm 980108ca4a2ba723015accc088c6d78c8156b9f1376730f10dcb357a939fa7b6 python3-idm-pki-11.9.0-6.el10_2.alma.1.noarch.rpm d22e7c708f2b9d42c11a0567e3ec0d29b0d6c46728b35bb961574ffc6c76b8d2 idm-pki-java-11.9.0-6.el10_2.alma.1.noarch.rpm e127ae2fe0297a6c06dbbd9e5f26fe945b6221de37834b8e268f77e123acb422 idm-pki-server-11.9.0-6.el10_2.alma.1.noarch.rpm e3e12ed856ec63faff76d4dccd1667fa768ec21c075cca9878222449ea115cbc ALSA-2026:77690 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103) * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360) * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365) * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398) * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970) * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035) * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115) * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744) * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690) * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669) * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530) * kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (CVE-2026-89676) * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663) * kernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675) Bug Fix(es) and Enhancement(s): * mlxbf_bootctl: driver update to Linux v6.16 [Nvidia 10.2.z FEAT] (JIRA:AlmaLinux-212709) * [GNR-D] missing interfaces tspll_cfg [almalinux-10.2] (JIRA:AlmaLinux-273805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perf-6.12.0-211.64.1.el10_2.x86_64.rpm 0b2147ebede5d5ebe0051a66785d81bb935d903a7874c6cf22f8996f2b8bd5fb kernel-debug-devel-6.12.0-211.64.1.el10_2.x86_64.rpm 13705afc31c700d978a4cdd3205d30f33c0de05cc74bcb927ad790f4a7eaf083 rv-6.12.0-211.64.1.el10_2.x86_64.rpm 3f48817a8963874c221791800dc80c4b22bd0f7bb9626054aa08666e536fc700 kernel-devel-matched-6.12.0-211.64.1.el10_2.x86_64.rpm 4fc257af22a2e586d9fbb4d572491a2d17a29fc8cbbfbaa9152b1f6b6c2ce5c9 kernel-debug-devel-matched-6.12.0-211.64.1.el10_2.x86_64.rpm 652786142286dbd2ec6f5419d704ce3278ebf4543e616770d692ea2eae928c1b python3-perf-6.12.0-211.64.1.el10_2.x86_64.rpm 94f45537d18ad8165a8f9502614cc5ef9c4776970e622c08a46f3961d10ff508 kernel-doc-6.12.0-211.64.1.el10_2.noarch.rpm acf673cac34caad11b9a79021df322d42655a2b4d8c23977bfc8bd93706609ff kernel-headers-6.12.0-211.64.1.el10_2.x86_64.rpm b2f685dd0e680dc097655407346391b52f30864b4dfffceef3020133fea9f1fc kernel-devel-6.12.0-211.64.1.el10_2.x86_64.rpm ca65cf10cc0edb20741e6c7b33b1ac465404131c0356d093f9c3b05b5340feef rtla-6.12.0-211.64.1.el10_2.x86_64.rpm e412274e8f0ad79a4ff366ee391ed90a393420a2c6cf38576fae4678d8f6dce7 ALSA-2026:79122 Copyright 2026 AlmaLinux OS 0 1 Important

cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default cjose-0.6.2.2-7.el10_2.1.x86_64.rpm d6fcaf92389d5517fad8283ab0bf2b0f7edc6ce999b285975d0d06a1a40e8117 ALSA-2026:79371 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dovecot-mysql-2.3.21-19.el10_2.8.x86_64.rpm 539fc0903595c1ac2908d1b7bc9124c54d3ac6c134fc1b899e72a326af7558af dovecot-2.3.21-19.el10_2.8.x86_64.rpm a0da375d5feaa8e62fd5caa6c49ff31d8a9ec152014af79e0412913d678dc211 dovecot-pigeonhole-2.3.21-19.el10_2.8.x86_64.rpm ad5c2245da1c84fef4a623d2a646adae50ab0bac6fe7e3849993cfa2d5ba67a4 dovecot-pgsql-2.3.21-19.el10_2.8.x86_64.rpm d81df5b22a55efb92a71ad03401f3477b2d79f1647faac6a905ade642efa26cb ALSA-2026:80495 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es): * flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default flatpak-builder-1.4.4-1.el10_2.1.x86_64.rpm 505d79d411b5a903b0e273aacf3cb6336fb048b98e567d2f857630b0807ae189 ALSA-2026:80498 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275) * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default flatpak-selinux-1.16.0-9.el10_2.4.noarch.rpm 172e1711504e739522ae1206e914d28afb7a6412e2819c17a2f06a084ed5aec3 flatpak-1.16.0-9.el10_2.4.x86_64.rpm 2dd8417b1fdeb5de549774c97c4116e4a33ad86520e799d9988ef8bf8e2c9c2d flatpak-libs-1.16.0-9.el10_2.4.x86_64.rpm df0847e84459ad73b05cf29ca33b1e0a591d94dc93cf1b1ed510a717e90a96c7 flatpak-session-helper-1.16.0-9.el10_2.4.x86_64.rpm f2f21dcfacc1af558d7ebeb85b0890ad6468c8b53089444860acdee6866a5dfc ALSA-2026:80512 Copyright 2026 AlmaLinux OS 0 1 Moderate

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253) * curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545) * curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429) * curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168) * libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.7.x86_64.rpm b5d9ee2c25b857a61eb8615bbab4e5ff12181a7735079e6b5250120d5accfa52 ALSA-2026:80605 Copyright 2026 AlmaLinux OS 0 1 Critical

cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default cjose-0.6.2.2-7.el10_2.2.x86_64.rpm 3bfdb14153a7cfda04f716b7c3d6ac468e910acb1024d7c137cf82277d47d796 ALSA-2026:81406 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332) * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385) * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508) * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507) * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123) * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521) * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970) Bug Fix(es) and Enhancement(s): * net/tls backports for 10.2 (JIRA:AlmaLinux-275027) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default kernel-devel-6.12.0-211.65.1.el10_2.x86_64.rpm 48ff608dbcefa64e7e61248eefa7946f9bb38cf5360bc632783f0a9a63262954 rv-6.12.0-211.65.1.el10_2.x86_64.rpm 4cfa1666fbb3817f437313d257d6b167761266b9d08c28fdcab6e47f93a2c83e kernel-headers-6.12.0-211.65.1.el10_2.x86_64.rpm 61e97185d11407c2b7d0f70ee400b05fa5680362512ec8c42c783435ffb45cf3 kernel-doc-6.12.0-211.65.1.el10_2.noarch.rpm b35f6a677826f22ce14c1a40eace7076869d953b08049e8332f8de56535432ee kernel-devel-matched-6.12.0-211.65.1.el10_2.x86_64.rpm b404ed16903e294ed0e8926ec3d84178f3c976f7d4208bbef93038ca458d92de perf-6.12.0-211.65.1.el10_2.x86_64.rpm d028a54fe124782d485f3b9ecd43c45b0aa9fa8b29dbdaa0b7e73c75bf686782 python3-perf-6.12.0-211.65.1.el10_2.x86_64.rpm d8ece75a0f6be8b153d0d87492727aebd883a09be9b361c36ede003d40b35bbb rtla-6.12.0-211.65.1.el10_2.x86_64.rpm e2967e0804bfe00d763628acb6adeb430828ee7f7051c8f4316b553881b1dc91 kernel-debug-devel-6.12.0-211.65.1.el10_2.x86_64.rpm e8d9653aff38b78a6920245069602c156509325b1b2c3b41ba382100cfb5e972 kernel-debug-devel-matched-6.12.0-211.65.1.el10_2.x86_64.rpm f7e48d66561ec85f5d61129c717bf2bfe11463fe266a907199084948f67cd733 ALSA-2026:81518 Copyright 2026 AlmaLinux OS 0 1 Important

gd security update

GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats. Security Fix(es): * libgd: buffer overflow when processing specially crafted GIF file (CVE-2026-9672) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default gd-2.3.3-20.el10_2.1.x86_64.rpm 0dd6f7e7ce435648871613cad2ccae2615658dda2358bf0ec15af46e9894d407 gd-devel-2.3.3-20.el10_2.1.x86_64.rpm 21398a46c98cfa37b6e6ca9ea090d0f165b7e364f2cc94b5f209faa0dcfc7799 ALSA-2026:81522 Copyright 2026 AlmaLinux OS 0 1 Important

pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback (CVE-2026-89156) * pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157) * pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching (CVE-2026-89160) * PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default pcre2-utf16-10.44-1.5.el10_2.x86_64.rpm 21b45306df77ebe6080350d1ba25c97365d1ff5601c6a0b7e6986c17604f1841 pcre2-devel-10.44-1.5.el10_2.x86_64.rpm 4de16cdfd7092a83244b4cd6fba149f38a39fe26b9fd1848d176bc78c2404573 pcre2-utf32-10.44-1.5.el10_2.x86_64.rpm 9e0df9da171ec9773cc4f750764eaaf38d3189cb61794758dd0a441070bdcadc ALSA-2026:82041 Copyright 2026 AlmaLinux OS 0 1 Important

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient (CVE-2026-103262) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3-tornado-6.5.10-1.el10_2.1.x86_64.rpm a29505179ac5ac9808dc172d3ae884b160d30d86756e6ed02a696b3467e362f4 ALSA-2026:82280 Copyright 2026 AlmaLinux OS 0 1 Moderate

tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine. Security Fix(es): * tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default tftp-5.2-50.el10_2.x86_64.rpm 0b9bde2ded3f28dfaefa48bac481f050b6499bc701d6e01d05981849aab4fc03 tftp-server-5.2-50.el10_2.x86_64.rpm 3acc405a96d03ece6ef9803117db3e82f7c0d91e76a7d18752e076c9161a4135 ALSA-2026:82883 Copyright 2026 AlmaLinux OS 0 1 Important

hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023) * hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098) * hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097) * hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100) * hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104) * hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105) * HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102) Bug Fix(es) and Enhancement(s): * [IMAGE-MODE] missing /var/lib/hp on image-mode [almalinux-10] (JIRA:AlmaLinux-266547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libsane-hpaio-3.26.6-1.el10_2.3.x86_64.rpm 124f3e4b3da8955bf909926431a3b1d715655f72a0f1800d1646bde034c292c1 hplip-3.26.6-1.el10_2.3.x86_64.rpm 15704917e4e2a760fed1d41204c3304c605855ae1da2bda75083b839da215fb1 hplip-common-3.26.6-1.el10_2.3.x86_64.rpm b4e8b4ffaab52978a2a4936064672036e4d946d2155970178ef3f74e8dcf552e hplip-libs-3.26.6-1.el10_2.3.x86_64.rpm dd58b081a1476561974db4f39ceda645ca5895f3351b287075d82b16b25e5509 ALSA-2026:83207 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859) * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319) * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030) * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974) * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162) * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262) * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574) * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641) * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985) * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526) * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689) * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036) * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894) * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207) * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228) Bug Fix(es) and Enhancement(s): * cannot use VFs of i40e/ice NIC in bond device (JIRA:AlmaLinux-143410) * ionic: commit backported to 9.8 missing in 10.2 (JIRA:AlmaLinux-165657) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perf-6.12.0-211.66.1.el10_2.x86_64.rpm 09bc87562cf9dd69f056e5d6954e029fb7d2fdbefb67465a13aeba756dfd7be6 python3-perf-6.12.0-211.66.1.el10_2.x86_64.rpm 40aa48b9c954f4dea4102ee1c7e3c10ac735a156aa5af39b41ca2a31ccf9062c rv-6.12.0-211.66.1.el10_2.x86_64.rpm 585f54f51a9b6bced338baa26bb22f885e31d5b0e5c243754e8a30cc23f4a568 kernel-doc-6.12.0-211.66.1.el10_2.noarch.rpm 6f301a5976e15068aa2b07d6ae8075aff2544160af41ef58a535c64c538e8b53 kernel-devel-6.12.0-211.66.1.el10_2.x86_64.rpm 7571b17d59b3a9fa1dc79c36fc918eff41d3e180a48985cc6cf7e7601be4e0be kernel-debug-devel-6.12.0-211.66.1.el10_2.x86_64.rpm a6122d6b7f32d3feb48000e488bcce4317e32059e20aab3cbd5326dc6f9cd882 kernel-headers-6.12.0-211.66.1.el10_2.x86_64.rpm b1184526d8450c218e7f4f6674b34bb0bd6d34f80330667836898adb74d8fc1f kernel-devel-matched-6.12.0-211.66.1.el10_2.x86_64.rpm b71e8e94c22228fd8e5ded388981f6f44cd639b0d26dbedee038732badaf08cb rtla-6.12.0-211.66.1.el10_2.x86_64.rpm bc7835941387b953323d1c6e5676bbbcc6544bcc3f036cdf739f328106b230e6 kernel-debug-devel-matched-6.12.0-211.66.1.el10_2.x86_64.rpm dcc5f80b3242e379af0980636ae01ee2465d6e8c911f408fa279822754c1eefe ALSA-2026:83551 Copyright 2026 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258) * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default ghostscript-tools-fonts-10.02.1-16.el10_2.3.noarch.rpm 2f11201ed712d8c66100867af2653f448d74381381908688fdc39f52910b7722 ghostscript-doc-10.02.1-16.el10_2.3.noarch.rpm 31dd0cac798502cb49a1a9259e5c0dcebf08e0e8ea0f2a893da972d2c6ca75d3 ghostscript-tools-printing-10.02.1-16.el10_2.3.noarch.rpm 6dad220e750d8b49fbcb9d4ba86f2c36b7071dd78d13d0856dff27d76ac4cf46 ghostscript-10.02.1-16.el10_2.3.x86_64.rpm 983a66b05af015541d7b8d60fac54ce2ca3d21a4651873915513e234a08f45b9 libgs-10.02.1-16.el10_2.3.x86_64.rpm ef7b54237b0071728c65e82bad18a2f9bfd64e318228c85755a4ad81422e923e ALSA-2026:83618 Copyright 2026 AlmaLinux OS 0 1 Important

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding (CVE-2026-102555) * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556) * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557) * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558) * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559) * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth (CVE-2026-102560) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default libsoup3-devel-3.6.5-3.el10_2.20.x86_64.rpm 0c99a73c7a8014cde2d0335ce054f30091086b75ba8432ff46699001f1827b35 libsoup3-3.6.5-3.el10_2.20.x86_64.rpm 7934f68a4136ab8848740b047d86e009869a61bfc0a28fcdceb34aedb0f7077f ALSA-2026:84578 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default python3.14-urllib3-2.6.3-2.el10_2.6.noarch.rpm f85520901dd8eaee108473d77b0f023b36fd8cbd327d8e82e253a0e60f981482 ALSA-2026:84587 Copyright 2026 AlmaLinux OS 0 1 Moderate

perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default perl-URI-5.27-3.el10_2.1.noarch.rpm 611eb7e29299e3e8f52bb171d6d8f6443251979af86b7d673d597c26e07700b3 ALSA-2026:84591 Copyright 2026 AlmaLinux OS 0 1 Important

emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219) * emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992) * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default emacs-common-29.4-14.el10_2.3.x86_64.rpm 0b393edbb360e7f425a285b4cfd50209695b0ab615be26d7f1ccab703910371c emacs-nw-29.4-14.el10_2.3.x86_64.rpm 52f4943a3600f4c2587219916ce4f27f861104c340bd36273bfeccf6ee02697a emacs-lucid-29.4-14.el10_2.3.x86_64.rpm 6d2583521c64991b4db8b316186dcf1d4017c7af56f2a92a115f451846297bd7 emacs-29.4-14.el10_2.3.x86_64.rpm c3a0e955fed401d731ce971e44077731ffa88d78486b80ea7a7a1879d7d752fd ALSA-2026:84721 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886) * wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880) * wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919) * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76879) * wireshark: Wireshark: Denial of Service via X.509IF protocol dissector crash (CVE-2026-76928) * wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927) * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-95389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default wireshark-cli-4.4.2-10.el10_2.8.x86_64.rpm b072eb4d66011dafe5aa6078d2558b410d0beaf709a6ce1920b2c53161dce1aa wireshark-4.4.2-10.el10_2.8.x86_64.rpm c2eb324ac6c44aaa6c8e5c94675fcc872658f0f59905227df2bd4c5652b818e6 ALSA-2026:84753 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117) * glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489) * glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374) * glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glibc-devel-2.39-145.el10_2.alma.1.x86_64.rpm 3302ea2ecc149a5f1a771bc998581c7ff3a1f833f741ce49275fe2ed1ad42970 glibc-doc-2.39-145.el10_2.alma.1.noarch.rpm c1c6d8b798e7e9695a6bc003ad236d37961e0f8401f3349a7e892ca0785f46f8 glibc-locale-source-2.39-145.el10_2.alma.1.x86_64.rpm daf518d38dc20fb82f029d10022a64aadc3a81e91812acb202758fa725299044 glibc-utils-2.39-145.el10_2.alma.1.x86_64.rpm fc0a0e813f8e8b316df15e8ce00cfab604b814c0e640c09a5741a2081905f1a8 ALSA-2026:84795 Copyright 2026 AlmaLinux OS 0 1 Important

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default librabbitmq-tools-0.14.0-3.el10_2.1.x86_64.rpm 19e92205322b7875fa90f3fd8f70704d152c2f734a3129f970e4891d58150608 librabbitmq-0.14.0-3.el10_2.1.x86_64.rpm 72cac914a6229d4a20584b46d11f8743f4d08a9ab96735b4e743707d22ea0563 ALSA-2026:84796 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) * OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) * OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) * OpenEXR: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) * OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openexr-3.1.10-8.el10_2.5.x86_64.rpm 0821c2033c840661012cf450688f6395f6537473dee5692984ed84abec26e4dd openexr-libs-3.1.10-8.el10_2.5.x86_64.rpm a4366cfb69beab488036f93a4c95c1a8d3d6ad5f4292b5c73c899bf678c71e11 ALSA-2026:84799 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb11.8 security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default mariadb11.8-embedded-11.8.8-2.el10_2.alma.2.x86_64.rpm 0b0e65973a44062975d7cb09e9651756bb81289151fadeffa5b0fc463abe3b37 mariadb11.8-client-utils-11.8.8-2.el10_2.alma.2.noarch.rpm 12129a48fbf0bf75af7db9ec51b44577a01a5f68033e0afc2926050dfbd4b09a mariadb11.8-server-11.8.8-2.el10_2.alma.2.x86_64.rpm 48ab84f97ff1daf14d9b0e7710b2f3e041be0feb62967063612490b1a48948a3 mariadb11.8-server-galera-11.8.8-2.el10_2.alma.2.x86_64.rpm 49534a1cf04ac13c9d86c64135398cafdb0b96d4088126dfacfbfa4d96c2be09 mariadb11.8-pam-11.8.8-2.el10_2.alma.2.x86_64.rpm 6fc875bc608bc643e8231f6ff49df62a0646af5a82b4907761e88347b53cfbe6 mariadb11.8-oqgraph-engine-11.8.8-2.el10_2.alma.2.x86_64.rpm 7735c79436de78da00a496e910962c56ccfe009f03a859e4bbd80dd278f6a847 mariadb11.8-errmsg-11.8.8-2.el10_2.alma.2.noarch.rpm 8d642bace1bba11ccca8ea2c8a11a03bd79c79e1f8e1bb0d1c61760ee1505e1b mariadb11.8-11.8.8-2.el10_2.alma.2.x86_64.rpm 8d7d7a9eb19e9625371e87e1ad2be778bff4982dd9731ddbe47cb18af1132ac2 mariadb11.8-devel-11.8.8-2.el10_2.alma.2.x86_64.rpm 95622a92fda6c93b6b41733ca8872dbd42db940592ace883d7b9652e058e1ea6 mariadb11.8-backup-11.8.8-2.el10_2.alma.2.x86_64.rpm ab6138d0f1abbfae64b507e3f7eaacf43388253a96e32518ed41d4e29419f2d9 mariadb11.8-test-11.8.8-2.el10_2.alma.2.x86_64.rpm ac3faf7decfd84b7a2636dcd9e87a459aab3efef3cf0abe712ed565219901090 mariadb11.8-gssapi-server-11.8.8-2.el10_2.alma.2.x86_64.rpm b7440a83238163be9d9976459507544f126235d09206b52eca19d86a01c4ac3f mariadb11.8-embedded-devel-11.8.8-2.el10_2.alma.2.x86_64.rpm c5a952b539441a8293b63827183c4840795bd6fc660e0e9254209eb549c4458d mariadb11.8-server-utils-11.8.8-2.el10_2.alma.2.noarch.rpm eab081636282b63c450ea09a5a2d58ccd71c89eeef2705c6dc97af3c8ebe9c55 mariadb11.8-common-11.8.8-2.el10_2.alma.2.noarch.rpm fad75cb8cb6a19b23db136f4f44c4038fddc3718e190afa3a73c8f04192d30ba ALSA-2026:85191 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.4.x86_64.rpm c3e9b97aca5492cd10e01d0d4395ec4eb249456ef9cc4c3d4fe48e249850cff5 ALSA-2026:85276 Copyright 2026 AlmaLinux OS 0 1 Moderate

hostapd security update

hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd. Security Fix(es): * hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default hostapd-2.11-3.el10_2.x86_64.rpm b108158b38d51db03aee53b08cfb64df56d60aa58af34294e29055dbba4c4de5 ALSA-2026:85321 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801) * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162) * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117) * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300) * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: signal: Prevent exec() race (CVE-2026-98256) * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) Bug Fix(es) and Enhancement(s): * [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded (JIRA:AlmaLinux-181987) * [IBM 10.3 FEAT] zcrypt driver overwrite function - kernel part [almalinux-10.2.z] (JIRA:AlmaLinux-245336) * Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:AlmaLinux-256678) * RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:AlmaLinux-257228) * Fix pending kernel issues for L1VH GA - Kernel (JIRA:AlmaLinux-267038) * Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [almalinux-10.2.z] (JIRA:AlmaLinux-280590) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default rv-6.12.0-211.67.1.el10_2.x86_64.rpm 1537ac00ae3a68450c6cf6841d843e39e36dcbbaf50c9287c053c4239834ba2a kernel-headers-6.12.0-211.67.1.el10_2.x86_64.rpm 19e4c66f22ca9d48f4e0174a4f2fc22813bd81009d4cda220890e2141afaf0aa python3-perf-6.12.0-211.67.1.el10_2.x86_64.rpm 27664f128acf5668cffb38e2b6cc178462db1ac6958926e46ca4f0ea39ed5959 perf-6.12.0-211.67.1.el10_2.x86_64.rpm 5901df8dbd19302d911cd130ae9ded29bc4c4528f5a27f01978c201ef24f948b kernel-doc-6.12.0-211.67.1.el10_2.noarch.rpm 9caff7cead81e13e3372f4e55e542a9d645c00d414b73c690cfe3a97d7add266 kernel-debug-devel-matched-6.12.0-211.67.1.el10_2.x86_64.rpm 9cbce4809c684e53db28ef707fa4a4ddd67fa190e2a6b4b7b2b47af08d2be6e0 kernel-debug-devel-6.12.0-211.67.1.el10_2.x86_64.rpm a851a1ab3bb91e17635741980554dba4efb4c32438a0b81ed01cd07d0906f510 kernel-devel-matched-6.12.0-211.67.1.el10_2.x86_64.rpm bb106f7849e9b66744707c7ea72510b124e00f0e5a8c477e528869861b1526ce kernel-devel-6.12.0-211.67.1.el10_2.x86_64.rpm c050a3de7e5786846a853c5be1c580281397c088f5d446c8d3419e8f0d881952 rtla-6.12.0-211.67.1.el10_2.x86_64.rpm d8fcf0db8c13799485e7f8674d14770c7f6f253e2e358803b29ffa794a63b8d7 ALSA-2026:85847 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997) * openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998) * openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default openssh-askpass-9.9p1-29.el10_2.alma.1.x86_64.rpm 223105a750bc538fb68f1b767a4f28b37c8fa7cfdc98a03deb8542472be9d2e0 openssh-keysign-9.9p1-29.el10_2.alma.1.x86_64.rpm d90290fd1411fe25cf8a1f3f307e22a92f1c854aeeeb5df26e99bef6f8489b8c ALSA-2026:85848 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sq security update

Command-line frontends for Sequoia. Security Fix(es): * hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657) * rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default sequoia-sq-1.4.0.1-4.el10_2.x86_64.rpm 0242b50d3efd92bc73aefaabcb5a342a79701b4d9d9679f9f116635d7324a791 ALSA-2026:85959 Copyright 2026 AlmaLinux OS 0 1 Moderate

fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client. Security Fix(es): * fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default fetchmail-6.4.38-3.el10_2.1.x86_64.rpm 7a2ab18cd6e67e8314fd423a57e921d23bcd863289fbce8cb0c3173d80da2749 ALSA-2026:86093 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default go-toolset-1.26.10-1.el10_2.alma.1.x86_64.rpm 0c2a6828a4449706a3f1127846c6f09aeb0f2dc0ca27327296b1f67707b2b65a golang-docs-1.26.10-1.el10_2.alma.1.noarch.rpm 2d79e769efee24206777297d81950a59cd8f92825199a4b095bd00a11b65fe72 golang-src-1.26.10-1.el10_2.alma.1.noarch.rpm 43d81a2ae0e8050075f42624aeeb87c9923f73d9eff287c06c6f5161f582dddc golang-race-1.26.10-1.el10_2.alma.1.x86_64.rpm 4a5a42bcba5ae2e0602c1839ce6885db4ad773da6b02da3f004e27f1677f54a1 golang-1.26.10-1.el10_2.alma.1.x86_64.rpm 774d98b72e7ad22223d78dfb1317848b0f7d94ae4a9c0f431db625a6111c7134 golang-tests-1.26.10-1.el10_2.alma.1.noarch.rpm 8564845c95e3ad9ae431701bfc86844c9f231174349f09fa3bf96764c9e304bb golang-misc-1.26.10-1.el10_2.alma.1.noarch.rpm 9cca556f68ec191e90e65a5ff40a7482d60e4866fea7a72fa75649b2f73a01f7 golang-bin-1.26.10-1.el10_2.alma.1.x86_64.rpm e6a2675092b6ad6a7e7ffe961b309b6b88889c20bbbde2ee17abe934b98fa68b ALSA-2026:86168 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-10.2.z] (JIRA:AlmaLinux-277794) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-runtime-dbg-8.0-8.0.32-1.el10_2.x86_64.rpm 152b4b17cb520d2760fc8cae56475e16fbd29b0dff7c0701be7b1d0c4b982b87 dotnet-targeting-pack-8.0-8.0.32-1.el10_2.x86_64.rpm 18a82ad8e11790262bb2592f693e83d19d114c38632aadb73ce7fabe32b34f04 dotnet-apphost-pack-8.0-8.0.32-1.el10_2.x86_64.rpm 221cdd3bd73e5b74b5d9311eace10553abdcdbe909bc3e7ef453d44e96bc2f8e dotnet-runtime-8.0-8.0.32-1.el10_2.x86_64.rpm 3f13929e93d1457dd57bb4cf826c5ac1c6d3aafcc8d7181c12fe4f3bfbfaa12d dotnet-sdk-dbg-8.0-8.0.132-1.el10_2.x86_64.rpm 5329a178d1118d666f77a874eb294e2ebab88bcf835556c1fead43bdb4aa1932 dotnet-hostfxr-8.0-8.0.32-1.el10_2.x86_64.rpm 6057e63f298ea6a049d9dfb7c52791f3a91d17b23ebd36b260e66cccad71214c aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2.x86_64.rpm 6ce84a578b93d138019ee9815adb022613c3e1bbf818bab4dabe85b3fd902517 aspnetcore-runtime-8.0-8.0.32-1.el10_2.x86_64.rpm b00cdfe3bae3fb4eee30aa3da638d50923a8398bf82ad3e422ae18695120089d dotnet-sdk-8.0-8.0.132-1.el10_2.x86_64.rpm beb56643cc958969e2546032fbe96a8f7fda7925bb144af5b897d8284b4bddd1 dotnet-templates-8.0-8.0.132-1.el10_2.x86_64.rpm c940e253b7989b85bf34a6c2b3eee93ce891b050107c2bc6b4ee7e362db7cb5a aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2.x86_64.rpm e0ceedcd4e739e9649b041425e4b961d269a21c5c2927467d61d352915df7fcc ALSA-2026:86172 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-10.2.z] (JIRA:AlmaLinux-277801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-hostfxr-9.0-9.0.21-1.el10_2.x86_64.rpm 263a6cd681f18a16b56e224067851fdcf1ea1db347c2239992d7c76301d6e148 dotnet-sdk-aot-9.0-9.0.122-1.el10_2.x86_64.rpm 2ab1f646270f4e0edf5d5838005d76638b20a993be9c234ac9779943a97bcb31 dotnet-apphost-pack-9.0-9.0.21-1.el10_2.x86_64.rpm 2ff6b0d70b8d1af14aec253b95ae9a4d4cc13ef37acd3f37a085ce7aa638479a aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2.x86_64.rpm 34c46d7d546db915dd2f6b286d85fb3583d93a61fb38cbba07973adeaf6fbc8b dotnet-sdk-9.0-9.0.122-1.el10_2.x86_64.rpm 4530d1d2918d0827eb3c000067cace12e71ca44a359c7073c69815fe0942bf57 dotnet-runtime-9.0-9.0.21-1.el10_2.x86_64.rpm 4ce832d025c1bcd8216fe8a0ab88c43eb30ee4a4305afb9aa9fcc8024b7a47e2 aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2.x86_64.rpm 808a7959144a68de56a97978d4b07795e83f87fcc20bb9782e351881e2400d87 netstandard-targeting-pack-2.1-9.0.122-1.el10_2.x86_64.rpm b754605f5b6862bb3b7f3037766b6f49b4bbd34711f4bc29e97aaa56887d91e4 dotnet-sdk-dbg-9.0-9.0.122-1.el10_2.x86_64.rpm c5858c555318fbc99525ee87c7925369d1ead0006431df895dc7dc9e79ef429c dotnet-runtime-dbg-9.0-9.0.21-1.el10_2.x86_64.rpm c5c7b6c4777f749823d0ef02fb886ef1d5ffa6c8da3c245550db133cbce31494 aspnetcore-runtime-9.0-9.0.21-1.el10_2.x86_64.rpm cd500ae2a4ead92f026a9dc56178bb27df2aea73d83919a89c66d4489d0d4d37 dotnet-targeting-pack-9.0-9.0.21-1.el10_2.x86_64.rpm d46b313fc50f8d315a359689780ab98f39d0c6e48fa3e0ffaeb3eb20c5955b32 dotnet-templates-9.0-9.0.122-1.el10_2.x86_64.rpm db30cb8bbcc001bdd4a26fecf46354862b959f3cc7115fdfaedbf1983f951ff8 ALSA-2026:86195 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-10.2.z] (JIRA:AlmaLinux-277809) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default dotnet-hostfxr-10.0-10.0.13-1.el10_2.x86_64.rpm 079b28370f6d954311eb2a3be6b7464bc5de7eb656520a0cf0db2dc4f110afd3 dotnet-apphost-pack-10.0-10.0.13-1.el10_2.x86_64.rpm 0f0d1a7961fe23002fe7f55b0d5e863584c7df88526962cb8598d73bb6798e23 dotnet-sdk-10.0-10.0.113-1.el10_2.x86_64.rpm 2e295a1e20a812e530135ce5b1a774880ba0c9a4aa42ed35df2e82ebd21fd9d1 dotnet-targeting-pack-10.0-10.0.13-1.el10_2.x86_64.rpm 4036c7adfbf394a5952831218215dc4d8309c7a368301b587f7c5091d421ba9e dotnet-sdk-aot-10.0-10.0.113-1.el10_2.x86_64.rpm 7be68c16eb9d1b609a908bbc1477d90caca2e1280be86e715068a96db53c583e aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2.x86_64.rpm 8999fc2cf2062b3813f1204ff87a0b3b99e8f185b2465323e2ba890e5f11d890 dotnet-templates-10.0-10.0.113-1.el10_2.x86_64.rpm c567ecbe1440f011cb1fea9a7544a0499b4e69ade7acbb9ff533c1e7e602c9c3 dotnet-host-10.0.13-1.el10_2.x86_64.rpm cd14bc15485073831dde24c0b3fbbdc2af5343966de8896962ef9f7a6d8671a2 dotnet-sdk-dbg-10.0-10.0.113-1.el10_2.x86_64.rpm d9b3e1856a709ac20cdbe623e59369ed4e19160b76cc92d0188e9a87237c2de8 dotnet-runtime-dbg-10.0-10.0.13-1.el10_2.x86_64.rpm df23dd7ba2b2514abde8f266b293e8e49679ff8074fcc36491c9bf9b291de70d aspnetcore-runtime-10.0-10.0.13-1.el10_2.x86_64.rpm dff8735847920cfb6d3cd476170fb8855c32f346a2e261bcc698a120fbb89245 aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2.x86_64.rpm e2f0fa70f92a969cec0f692074f117f055ff6043ad41952a9d4df617edca9e47 dotnet-runtime-10.0-10.0.13-1.el10_2.x86_64.rpm f336ad0903ccd2991ca3b1d0e052ddbd7425ef84f5e6db92d3d2197412e4b4c5 ALSA-2026:86331 Copyright 2026 AlmaLinux OS 0 1 Important

glycin-loaders security update

Sandboxed and extendable image decoding. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default glycin-loaders-1.0.1-1.el10_2.2.x86_64.rpm 11ef5e2ffcd9a93ecbbed7cbb8066605915593feb027de50fc78b6830bfdb2f7 ALSA-2026:86841 Copyright 2026 AlmaLinux OS 0 1 Important

librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default librsvg2-2.57.1-9.el10_2.10.x86_64.rpm 2aed083dbfaa68be172c0208f1489efc478060aa2b3ca5acf6ab45a71d43209b librsvg2-devel-2.57.1-9.el10_2.10.x86_64.rpm 54aba4a7a5d6e09c4dc4277b8d61fc40cdd48d443df940e073f6ee5503a4d1a7 librsvg2-tools-2.57.1-9.el10_2.10.x86_64.rpm 5abda6d96256ca874ed0af8191f458c62bfc9e9ac519eda0d860fc1097b7ec7f rsvg-pixbuf-loader-2.57.1-9.el10_2.10.x86_64.rpm 6fe7d8e8890e637f8e789e565fb4f173dc872146379f1b928d3328e26b5188e2 ALSA-2026:86971 Copyright 2026 AlmaLinux OS 0 1 Moderate

cockpit-machines security update

Cockpit component for managing libvirt virtual machines. Security Fix(es): * cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768) * cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747) * cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default cockpit-machines-348.1-1.el10_2.noarch.rpm f07522ae8bce2750b2d0a9b32d8b9b159a43988af1d1d59a1c3ed9655cf017a5 ALSA-2026:87070 Copyright 2026 AlmaLinux OS 0 1 Important

php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default php-ldap-8.3.36-1.el10_2.x86_64.rpm 12578c34bbb8395e21fea68847432165def314f8d33c7004370c3fafc27fff1a php-pgsql-8.3.36-1.el10_2.x86_64.rpm 23e985ebbccad98e75f1527cbecc3374aa6be5c7620dfe39ce12c2576b834383 php-opcache-8.3.36-1.el10_2.x86_64.rpm 28bb9f4c5d1190c60d8f70e153716c733778af4477c2b5d3cdd7f6e9bef7fba9 php-8.3.36-1.el10_2.x86_64.rpm 364244af06da4d9ffd50b774114710e327ed6a9bd23eef3e29f51a2ecd43bf88 php-intl-8.3.36-1.el10_2.x86_64.rpm 38feaf96cde13bb0eded0dd0e22ac1c894a3984facb746f2c7afe9b21b20c5aa php-ffi-8.3.36-1.el10_2.x86_64.rpm 39a6c8128068e658f0ccbe93d5a9240d783eca513e7b0ecd1c9f39eb3e82b738 php-process-8.3.36-1.el10_2.x86_64.rpm 4c7efe320170c219dd63885f50670ba0e37b89b9c9634f02fc53d0542f50f0db php-soap-8.3.36-1.el10_2.x86_64.rpm 4c82bae9f8330652f51697493851cc08e7c0706abfcc4df4bfe995083d453fb5 php-fpm-8.3.36-1.el10_2.x86_64.rpm 6010ccd9b630ce25369fccf2a092e8ee6bb5ce0d104f4248516e669d9ab05da6 php-pdo-8.3.36-1.el10_2.x86_64.rpm 61793577d62bb5abc6c68146bb36a49e0fc734e3953974624b7ad2133c7edd9a php-odbc-8.3.36-1.el10_2.x86_64.rpm 6a30c89ef9c59b72095526ed09d200da9973bd72e57d798a89b7ffdd1dfd8848 php-snmp-8.3.36-1.el10_2.x86_64.rpm 6e276d893ccf7a32defc30980052a953c3ebe1e43776805228d0514dcb5a79dd php-gd-8.3.36-1.el10_2.x86_64.rpm 6e35b669c23db4cc5c43d71941fd88d9a1c960434ed0d56f7cc2d192a8ffd675 php-enchant-8.3.36-1.el10_2.x86_64.rpm 81fde3c87c049ac12c13643f49207d3814eb39af02bf299d8cef305b6af85a85 php-dbg-8.3.36-1.el10_2.x86_64.rpm 82e822b9c6c0c6a851d086771abc86b262b6f73c5c1d971ff906f568d0bdbfe6 php-cli-8.3.36-1.el10_2.x86_64.rpm 9173988150edb564c4ffeb3cab60a92545333dae1d35d6e4eb8071818be5703c php-gmp-8.3.36-1.el10_2.x86_64.rpm 9befa3c1a7decf3f353963412853c509b39d8c0ae413773765ed2f4892b0b197 php-xml-8.3.36-1.el10_2.x86_64.rpm 9df1f1f8f32a25fcc02f7dbc3b2130c28a415b51a89e2f5e32ad706067ffc19c php-dba-8.3.36-1.el10_2.x86_64.rpm a2764c8c85bec2afdff41f481687972e9abc5617fdd48b75bee39f87b8bb47f9 php-devel-8.3.36-1.el10_2.x86_64.rpm a2e2e433559eeb3a02dea1cd5402b69a1321a2a573dd2b48b35597b8ad0eb382 php-embedded-8.3.36-1.el10_2.x86_64.rpm b62242aeb003a8628d10197cfe4444916f0e8ac5ab8d816446c680e82c621441 php-bcmath-8.3.36-1.el10_2.x86_64.rpm c58310294262248d4db40056cc353fd16f71a5865a40f39f80b415e49cd135a0 php-mysqlnd-8.3.36-1.el10_2.x86_64.rpm eb27f7f36f1848838863a9154fae6cb67d75fc31bfe957a20a0922fba20580b0 php-common-8.3.36-1.el10_2.x86_64.rpm ecc2f2c81e2686da114ba0bad9346e69441acc9b5319766e35a096a2c37838f5 php-mbstring-8.3.36-1.el10_2.x86_64.rpm fc4bc779f9da2be318c7bee33004a3c6ec89d2064e61e195ef74107f6464d571 ALSA-2026:87071 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default php8.4-common-8.4.27-1.el10_2.x86_64.rpm 08a579cafdaf67bd83cc5a562e183a256aa1b6c9a6aef107189dd6f288cc97ff php8.4-dba-8.4.27-1.el10_2.x86_64.rpm 1583773c3210672d0a7ff1ca77d1c1e4eda09496835960b9980f3e0a40252fee php8.4-devel-8.4.27-1.el10_2.x86_64.rpm 1a4a22148efb58ab2120f108a4dbef548a80bdd0cc2e741a7d729a346d3ccf92 php8.4-bcmath-8.4.27-1.el10_2.x86_64.rpm 2710a3792aa93f5397fa473848314110454bcb501a1c7aee90e039c6f00c9174 php8.4-ldap-8.4.27-1.el10_2.x86_64.rpm 4d23ce9918d599c11547e7a21a6743c391cbc556396c58fe8ba8dd0970cb2704 php8.4-pdo-8.4.27-1.el10_2.x86_64.rpm 4ead5faddbc3cd507a343fd1f07053c3d925e56613baa2df26d18cdc7a3bbd35 php8.4-cli-8.4.27-1.el10_2.x86_64.rpm 5d380dc39487c76b453a0d1e9c42093f4ec586630060a0acd399e67dd1316b98 php8.4-dbg-8.4.27-1.el10_2.x86_64.rpm 6235da7f282df512e88138ebc32cd41a28897d2a84439a87197fea5a0192c7f0 php8.4-opcache-8.4.27-1.el10_2.x86_64.rpm 667f0baf6bef657eeecb4c881dfdc3736ea87f703dac74ff8de60b10f70ac96f php8.4-embedded-8.4.27-1.el10_2.x86_64.rpm 7a23b5939e33751439c602dd9b0d9d5569bfc6268de35a11b14085809235b893 php8.4-snmp-8.4.27-1.el10_2.x86_64.rpm 88bdfb79a04ef93f27b7bb8e738315e35d89032fe40651523e203212f88abc5d php8.4-pgsql-8.4.27-1.el10_2.x86_64.rpm 90377ca44d2d3b62d5980304c156b57254d92cef07b0baa67b166e0de9a489b5 php8.4-ffi-8.4.27-1.el10_2.x86_64.rpm 98e6e8e5a895005fb568c42a311e4e842ebf0b19ae8cd3981ea33fe00b250495 php8.4-fpm-8.4.27-1.el10_2.x86_64.rpm 9e3c20cc3bc97cb5be92fb067c4f912fd3d2d8c76568e736adcd10e98ebdefd4 php8.4-process-8.4.27-1.el10_2.x86_64.rpm a6f0b563e01d8d55fb1492349be25adf17480b22cf99c1d60ec77ea5e195e51a php8.4-gd-8.4.27-1.el10_2.x86_64.rpm a71ad11b91128e73dc6e4ae6ddd9a0882f3a07e6eff5c516d18fd2e76cfcb87b php8.4-mbstring-8.4.27-1.el10_2.x86_64.rpm aac80e03826f56e280d773a5c64c96a2061237606ed2b8f0ead1a5ec190e745b php8.4-odbc-8.4.27-1.el10_2.x86_64.rpm ac98683bea2a0690d4efc274bff3b2c94a6b8d924fc92fad62f0b14c31e7e2bc php8.4-gmp-8.4.27-1.el10_2.x86_64.rpm c0a3f3c0a34744d0a99749f404512799a068a0e41016acdb8f208e51d4bcea3b php8.4-8.4.27-1.el10_2.x86_64.rpm c37bdfac8f597a42b12d944e76bb7a40a9cb35f2521de77e230955011a49de9a php8.4-intl-8.4.27-1.el10_2.x86_64.rpm d03d728a100ce998b956c6f48b5e85c3248ad82c7ba440033433aeb8751a87fd php8.4-mysqlnd-8.4.27-1.el10_2.x86_64.rpm d97f1d69269505b9eedfb6bde03d58c52d24e433473c6a323e39b92655a8664e php8.4-enchant-8.4.27-1.el10_2.x86_64.rpm e8da54500ffc91300a3c96a9102d4ef4b6efac1d6a1a1686e24a9450d4469d19 ALSA-2026:88207 Copyright 2026 AlmaLinux OS 0 1 Important

iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3: Denial of Service via UDP receive worker infinite loop (CVE-2026-102253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-x86_64-appstream-rpms__10_0_default iperf3-3.17.1-6.el10_2.2.x86_64.rpm f562ef3d64bcf71c9a6d80315982c76a79f935d7921cbe9ab98455921eed5bc4