Moderate: mariadb:10.3 security and bug fix update

mariadb:10.3 security and bug fix update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb (10.3.17), galera (25.3.26). (BZ#1701687, BZ#1711265, BZ#1741358) Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510) * mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2537) * mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627) * mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628) * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739) * mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740) * mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758) * mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_6_default asio-devel-1.10.8-7.module_el8.6.0+2867+72759d2f.aarch64.rpm 63fc351fbcd03176401f95f16cebd29b23066a2a8c21696f72a9f8c2e916b4b3 Judy-devel-1.0.5-18.module_el8.6.0+2867+72759d2f.aarch64.rpm 93d0e21e8df7e2b686fe949792b8587fbe3436ee13cc46cd539a1a73684fa5d4 ALSA-2021:1242 Important: mariadb:10.3 and mariadb-devel:10.3 security update Copyright 2022 AlmaLinux OS 0 1 Important

mariadb:10.3 and mariadb-devel:10.3 security update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb (10.3.28), galera (25.3.32). Security Fix(es): * mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user (CVE-2021-27928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_6_default asio-devel-1.10.8-7.module_el8.6.0+2867+72759d2f.aarch64.rpm 63fc351fbcd03176401f95f16cebd29b23066a2a8c21696f72a9f8c2e916b4b3 Judy-devel-1.0.5-18.module_el8.6.0+2867+72759d2f.aarch64.rpm 93d0e21e8df7e2b686fe949792b8587fbe3436ee13cc46cd539a1a73684fa5d4 ALSA-2023:2932 Important: edk2 security update Copyright 2023 AlmaLinux OS 0 1 Important

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) * openssl: timing attack in RSA Decryption implementation (CVE-2022-4304) * openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450) * openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_8_default edk2-ovmf-20220126gitbb1bba3d77-4.el8.noarch.rpm 683b24853c8a0ce16403dbe844ee8c53651ad8ef3c57df9bd62c68f723da127c ALSA-2023:3087 Important: mysql:8.0 security, bug fix, and enhancement update Copyright 2023 AlmaLinux OS 0 1 Important

mysql:8.0 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql (8.0.32). (BZ#2177734, BZ#2177735, BZ#2177736) Security Fix(es): * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2023) (CVE-2023-21912) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21594) * mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2022) (CVE-2022-21599) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21604) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21608) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21611) * mysql: Server: Connection Handling unspecified vulnerability (CPU Oct 2022) (CVE-2022-21617) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21625) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Oct 2022) (CVE-2022-21632) * mysql: Server: Replication unspecified vulnerability (CPU Oct 2022) (CVE-2022-21633) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21637) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21640) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39400) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39408) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39410) * mysql: Server: DML unspecified vulnerability (CPU Jan 2023) (CVE-2023-21836) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21863) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21864) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21865) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21867) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21868) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21869) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21870) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21871) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21873) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2023) (CVE-2023-21875) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21876) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21877) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21878) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21879) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21880) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21881) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21883) * mysql: Server: GIS unspecified vulnerability (CPU Jan 2023) (CVE-2023-21887) * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21917) * mysql: Server: Thread Pooling unspecified vulnerability (CPU Jan 2023) (CVE-2023-21874) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21882) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * AlmaLinux8 AppStream and Devel channels missing mecab-devel rpm (BZ#2180411) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_8_default mecab-devel-0.996-2.module_el8.6.0+3340+d764b636.aarch64.rpm c0b14c42d4982d3da9aee02be557152498892b0b4e4a2434a6881bb17e53eba3 ALSA-2023:6919 Moderate: edk2 security and bug fix update Copyright 2023 AlmaLinux OS 0 1 Moderate

edk2 security and bug fix update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() (CVE-2019-14560) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_9_default edk2-ovmf-20220126gitbb1bba3d77-6.el8.noarch.rpm b7dc2f0f16182514fc961ea133795beb1c8fbe4c772d1954368594003a32ea9c ALSA-2023:6933 Moderate: libreoffice security update Copyright 2023 AlmaLinux OS 0 1 Moderate

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: Empty entry in Java class path (CVE-2022-38745) * libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950) * libreoffice: Arbitrary file write (CVE-2023-1183) * libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_9_default autocorr-fa-6.4.7.2-15.el8.alma.noarch.rpm 05c485654a9e6d8c693a65dab2989c957a611f1361fbf17e6639fa143ed4ec8f autocorr-vi-6.4.7.2-15.el8.alma.noarch.rpm 076af5a9bbf6064ee7312be5ee950d47c77a1905bb85bb849181998052fce1c8 autocorr-da-6.4.7.2-15.el8.alma.noarch.rpm 0adf59db893ce7b72e90abcc581824b3582a40157b0b5c11d02192ba9eabe31b autocorr-ru-6.4.7.2-15.el8.alma.noarch.rpm 1275ba47144db64a7e7332dc7e894b2726811868bbc0913f7d9170536bb77385 autocorr-bg-6.4.7.2-15.el8.alma.noarch.rpm 144cf03a3aef2d67489581707a82098a3c6f1775a2b444b2afac11208aeb35b5 autocorr-sl-6.4.7.2-15.el8.alma.noarch.rpm 1775041fb319349324feebbb79dd8336a85e0c9d754e90cb4a29838fb8faf8a3 autocorr-tr-6.4.7.2-15.el8.alma.noarch.rpm 1a2b41a223dca97680acd5fc078fbfcca55c9038603a8bbeaa9341fa559b093b autocorr-nl-6.4.7.2-15.el8.alma.noarch.rpm 1bc1b616c65a2a062536bc75a94971e399326aa6274a19521b3ba29c5118da5c autocorr-zh-6.4.7.2-15.el8.alma.noarch.rpm 346f3bcf817ea5d5a481114561a06660b797a62f9367f5332705edda93e57e00 autocorr-de-6.4.7.2-15.el8.alma.noarch.rpm 4d1622dcd4ad1a4ed0a8a234182f4a5b9bbd30436f5d754bd51edb2e2140dd00 autocorr-pt-6.4.7.2-15.el8.alma.noarch.rpm 51a16404c173d1e98e4f0d059dd747368c94a5a5eb482d3f69bc2f0d8699aa1f autocorr-ro-6.4.7.2-15.el8.alma.noarch.rpm 53665faace477ae56bb2d0126d1fc94e3968bd8517c6c48b4502798c4c1fd3b7 autocorr-sr-6.4.7.2-15.el8.alma.noarch.rpm 54bf74535e662b640e3e61f86884cd456089cb69cb87efe9a65075319e872f7d autocorr-sk-6.4.7.2-15.el8.alma.noarch.rpm 5f3734364590ef0c9410daf9efb92706f1f919ffcb183a5de0558b7b22efebec autocorr-es-6.4.7.2-15.el8.alma.noarch.rpm 6634973546248c23236deb56abd650a35b927c3b0dc8a63d21071e48abeed556 autocorr-ko-6.4.7.2-15.el8.alma.noarch.rpm 66efe34b10f28a99a3691e891bf2f065a6208fff9be422a74d58db700a9c865b autocorr-lt-6.4.7.2-15.el8.alma.noarch.rpm 7fc1704cff662fa1033bde79bfeaefe56bc97e5dc9c98998fe7c978d90339650 autocorr-pl-6.4.7.2-15.el8.alma.noarch.rpm 8eef7b6596ae389d795eee94da2327a850fe2c5873b8f393c973b7f7ed97ddce autocorr-hu-6.4.7.2-15.el8.alma.noarch.rpm a88a28cff495a3189acc3e8a50134bca74fe15ae3f6f79176b67fa2eae61413d autocorr-lb-6.4.7.2-15.el8.alma.noarch.rpm b026cb8a830eb6ea12a2d9ff845ee169e4d6e4d3511e012d3ed367ef52ae3faf autocorr-it-6.4.7.2-15.el8.alma.noarch.rpm b088dde35f30aad9eeb05653ca021cd75388572ba5e501b987592e2a8f754ff1 autocorr-ga-6.4.7.2-15.el8.alma.noarch.rpm b0965ea54887ddcec9bb8f2375e954626ad0a0c9a629946fb514d52094740dd1 autocorr-ca-6.4.7.2-15.el8.alma.noarch.rpm c7c58489bc9d01a1c1e7077814d842079eefe94061ba808287a848b633a3dee0 autocorr-is-6.4.7.2-15.el8.alma.noarch.rpm cd8a972dfb6807858340f938f261bff2fa8e0a5b7c12da795f264dad1268ca8f autocorr-mn-6.4.7.2-15.el8.alma.noarch.rpm ce1933a0612f7ee60921f68ce9903e846f443b17d36f8357c6eddfaf2dca56be autocorr-hr-6.4.7.2-15.el8.alma.noarch.rpm ceaaa49abc6d7c4f03db8d45c38430d9b19d900a4ce44085a51aac9e9415149f autocorr-cs-6.4.7.2-15.el8.alma.noarch.rpm deb7f3e5eaf1c78bbca7a1e1b7532b52776c8c66e97bbdb9e290c99501ea51b2 autocorr-sv-6.4.7.2-15.el8.alma.noarch.rpm e2f818f472d654b83cb82b0895f0e60cd049b2380afc1de1f5c9ce42e7ed1f34 autocorr-ja-6.4.7.2-15.el8.alma.noarch.rpm e4fb18d0ff6defc65468a25b78be87f90b1f245dda72739c8b56d474e3bca2f1 autocorr-fi-6.4.7.2-15.el8.alma.noarch.rpm e8e203c377c73640f4fc15d794a5b888892e83b677bcc1e18dceb7d683dc04ca autocorr-fr-6.4.7.2-15.el8.alma.noarch.rpm f116a713532b1938651504ae5731005d84018acddb154f53326579664a1a04fa autocorr-af-6.4.7.2-15.el8.alma.noarch.rpm fe0147632856d65dca53495bb3af85d6cf3d95b1a6ba20829094925b24323104 ALSA-2024:0133 Moderate: fence-agents security update Copyright 2024 AlmaLinux OS 0 1 Moderate

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920) * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_9_default fence-agents-zvm-4.2.1-121.el8_9.2.noarch.rpm 18353da3e67927a86700fe33e87ca2f57528b87a59adec0061228d0ca4bf49d7 ALSA-2024:0827 Important: .NET 8.0 security update Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

fence-agents security and bug fix update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) * pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323) * jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_9_default fence-agents-lpar-4.2.1-129.el8.noarch.rpm 136828317eba081b48657d31f951b44b0280d3ea3bfdd737a0e811ea398732ab fence-agents-zvm-4.2.1-129.el8.noarch.rpm 157b003719bbae13f201387cf821adf9105d6b939dfb5a78eef5404c59fd58c2 ALSA-2024:3017 Important: edk2 security update Copyright 2024 AlmaLinux OS 0 1 Important

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message (CVE-2023-45235) * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763) * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764) * EDK2: integer overflow in CreateHob() could lead to HOB OOB R/W (CVE-2022-36765) * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message (CVE-2023-45229) * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231) * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232) * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_9_default edk2-ovmf-20220126gitbb1bba3d77-13.el8_10.noarch.rpm 1fb545a8932e86554ab54e46bec608eaac6622b998d967236b7ca7cbe3a37cc7 ALSA-2024:6309 Moderate: fence-agents security update Copyright 2024 AlmaLinux OS 0 1 Moderate

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891) * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default fence-agents-lpar-4.2.1-129.el8_10.4.noarch.rpm 205135ff58c1d58c0b02beba0ac3663756dbc2b5d826f0bbf04919c400432431 fence-agents-aws-4.2.1-129.el8_10.4.noarch.rpm 56c91a605a010fe43299ecf2596888ed7d641c849997fd647ca3942cc420407d fence-agents-zvm-4.2.1-129.el8_10.4.noarch.rpm d17e0ee4261933fbac3765cb871589142a177e2c1805f0d717366387945f6002 ALSA-2025:1301 Moderate: gcc security update Copyright 2025 AlmaLinux OS 0 1 Moderate

gcc security update

The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default libgfortran-static-8.5.0-23.el8_10.alma.1.aarch64.rpm f996357a124a7a6b59023dc8d2317c48757bed846d1e6d361886cbcf21e7eb4f ALSA-2025:14750 Moderate: fence-agents security update Copyright 2025 AlmaLinux OS 0 1 Moderate

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default fence-agents-zvm-4.2.1-129.el8_10.14.noarch.rpm 9ba2ff782b9909e2497195536939e9c669364b9f0f1cb40d4000d41fdf546c44 fence-agents-lpar-4.2.1-129.el8_10.14.noarch.rpm fc56eb26c22649ed78abc0d49041c719fdcfdadc165696bf094d1b100e107123 ALSA-2025:1611 Important: nodejs:22 security update Copyright 2025 AlmaLinux OS 0 1 Important

nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150) * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083) * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default nodejs-libs-22.13.1-1.module_el8.10.0+3961+6a788e57.aarch64.rpm 2ea1998701b2ccf7534ed749f6e8c72bf88bee401976a82688db63386b2d4182 v8-12.4-devel-12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57.aarch64.rpm 4445dc14a234c0383ff0c8511e7a7555cbc1563a22090c55eed9735625c189fb ALSA-2025:17129 Important: idm:DL1 security update Copyright 2025 AlmaLinux OS 0 1 Important

idm:DL1 security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default ipa-server-dns-4.9.13-20.module_el8.10.0+4050+3b475c71.noarch.rpm 0f57023cd77d9cd95f79e3121536dc6a64df775ade5ca0ed77f9c43b599c416e ipa-server-trust-ad-4.9.13-20.module_el8.10.0+4050+3b475c71.aarch64.rpm 166056cdc435010e07139edaedf3fc8e55b7116795b3c2b6e93e9a279edfaba9 ipa-server-common-4.9.13-20.module_el8.10.0+4050+3b475c71.noarch.rpm 210fef6fec21a273b8d6a11892f44fbeced6920170464f2cb9d0bec91af4f941 ipa-healthcheck-0.12-6.module_el8.10.0+4036+84b152d9.noarch.rpm 59f7474a67cbc965bd0c360b4385395b89d1a12cf7015fcd6b16abe44ce85b0b ipa-server-4.9.13-20.module_el8.10.0+4050+3b475c71.aarch64.rpm 938948d738239553a2546ec37cb9906a0bfaeaf817eac55bb4aa9110970d0f87 python3-ipaserver-4.9.13-20.module_el8.10.0+4050+3b475c71.noarch.rpm 9ab0a89ea1497eb8d96dc65bee67dab6c3998e1cd5ab6f639fc3a30b12952f51 python3-ipatests-4.9.13-20.module_el8.10.0+4050+3b475c71.noarch.rpm e2f5abd08f35fc62e83bab9d1b3eac088705001c32a0106e31ab98a09c12205b ALSA-2025:21140 Important: idm:DL1 security update Copyright 2025 AlmaLinux OS 0 1 Important

idm:DL1 security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088) * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default ipa-server-dns-4.9.13-20.module_el8.10.0+4050+3b475c71.noarch.rpm 0f57023cd77d9cd95f79e3121536dc6a64df775ade5ca0ed77f9c43b599c416e ipa-server-trust-ad-4.9.13-20.module_el8.10.0+4050+3b475c71.aarch64.rpm 166056cdc435010e07139edaedf3fc8e55b7116795b3c2b6e93e9a279edfaba9 ipa-server-common-4.9.13-20.module_el8.10.0+4050+3b475c71.noarch.rpm 210fef6fec21a273b8d6a11892f44fbeced6920170464f2cb9d0bec91af4f941 ipa-healthcheck-0.12-6.module_el8.10.0+4036+84b152d9.noarch.rpm 59f7474a67cbc965bd0c360b4385395b89d1a12cf7015fcd6b16abe44ce85b0b ipa-server-4.9.13-20.module_el8.10.0+4050+3b475c71.aarch64.rpm 938948d738239553a2546ec37cb9906a0bfaeaf817eac55bb4aa9110970d0f87 python3-ipaserver-4.9.13-20.module_el8.10.0+4050+3b475c71.noarch.rpm 9ab0a89ea1497eb8d96dc65bee67dab6c3998e1cd5ab6f639fc3a30b12952f51 python3-ipatests-4.9.13-20.module_el8.10.0+4050+3b475c71.noarch.rpm e2f5abd08f35fc62e83bab9d1b3eac088705001c32a0106e31ab98a09c12205b ALSA-2025:22668 Moderate: go-toolset:rhel8 security update Copyright 2025 AlmaLinux OS 0 1 Moderate

go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * os/exec: Unexpected paths returned from LookPath in os/exec (CVE-2025-47906) * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default golang-race-1.25.3-2.module_el8.10.0+4074+24330916.aarch64.rpm bd2ef970d94d6ece072cf966af292fdd53c4d6f9a3a85e087e208f2a3993141b ALSA-2025:23137 Moderate: mysql:8.4 security update Copyright 2025 AlmaLinux OS 0 1 Moderate

mysql:8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040) * mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default mysql-test-data-8.4.7-1.module_el8.10.0+4077+98379720.noarch.rpm 32c0e3b4c114fae4abfa71886d6b9d4728a673d813b70886a9595c7538ccfad4 mysql-errmsg-8.4.7-1.module_el8.10.0+4077+98379720.noarch.rpm 70d2ed08985d4667389fdab4c8cf39416aa2d5bc47900fdc45073cfc1b647df3 mysql-common-8.4.7-1.module_el8.10.0+4077+98379720.noarch.rpm 7bac4aecb12b46f80ea60f49a07d9a45780295c28c05d53339e66db22296a4fc ALSA-2025:4459 Important: nodejs:22 security update Copyright 2025 AlmaLinux OS 0 1 Important

nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498) * SQLite: integer overflow in SQLite (CVE-2025-3277) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default v8-12.4-devel-12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756.aarch64.rpm 17cb30c7a9ee334ddbe499b46f1ab599586fcb3298b3e19b0e9c7db5339de395 nodejs-libs-22.15.0-1.module_el8.10.0+3986+a908e756.aarch64.rpm 2c505dc5f38324c7cf34690f8dfd26dedaacc007b3a9945197cddf6e62e53c19 ALSA-2025:8506 Important: nodejs:22 security update Copyright 2025 AlmaLinux OS 0 1 Important

nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default v8-12.4-devel-12.4.254.21-1.22.16.0.1.module_el8.10.0+4006+3c416519.aarch64.rpm 1e7098a0eebc6f04297f7d3d95b635a2c80b5aab5f763760b605d77ce748d5d0 nodejs-libs-22.16.0-1.module_el8.10.0+4006+3c416519.aarch64.rpm 840618f7fe1aea993d0383c9f39c8a96d5865ec377859fb8deae032368f65831 ALSA-2025:9188 Important: idm:DL1 security update Copyright 2025 AlmaLinux OS 0 1 Important

idm:DL1 security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default python3-ipatests-4.9.13-18.module_el8.10.0+4018+32aeeb28.noarch.rpm 303ddbf7b9150cfac4510632323b565f2759baa8cf86576d93a050e8e18f86a1 ipa-server-common-4.9.13-18.module_el8.10.0+4018+32aeeb28.noarch.rpm 3ba505bc9d78830978408b7025512d8fdb2834042c2cba7ff735db1d22f04d5d ipa-healthcheck-0.12-5.module_el8.10.0+3980+d78e8e90.noarch.rpm 56b8766fd06a41900a4bc86ecc305d35eed3657241b7fe9e1760aa64c0eaa21c ipa-server-trust-ad-4.9.13-18.module_el8.10.0+4018+32aeeb28.aarch64.rpm 70fa914708ddcb07903b4ec5cb2133ab0ccf2730a8c63206a7d44108843ead36 ipa-server-4.9.13-18.module_el8.10.0+4018+32aeeb28.aarch64.rpm 9e4bee2ab19285aa695c1d39521c1e450c15cd7aaae59b8fcf6bbe1bb44ef05d ipa-server-dns-4.9.13-18.module_el8.10.0+4018+32aeeb28.noarch.rpm accd6092b597737762e6936c1eab6467a2752e5dde51ba8f9a23aa2461be804e python3-ipaserver-4.9.13-18.module_el8.10.0+4018+32aeeb28.noarch.rpm be5881ad817c676c938ae1976012411bf3ff0606f4cb4ecd4a8da85854f143a9 ALSA-2025:A004 Important: libblockdev security update Copyright 2025 AlmaLinux OS 0 1 Important

libblockdev security update

libblockdev is a C library supporting GObject introspection for manipulation of block devices. It has a plugin-based architecture where each technology (like LVM, Btrfs, MD RAID, Swap,...) is implemented in a separate plugin, possibly with multiple implementations (e.g. using LVM CLI or the new LVM DBus API). Security Fix(es): * libblockdev: Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. (CVE-2025-6019) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default libblockdev-nvdimm-devel-2.28-6.el8.alma.1.aarch64.rpm 742e0f0eac7f38e14fb324601d5da0f0322f3ba997e1635dcbc65e8ef2c79a9f libblockdev-mpath-devel-2.28-6.el8.alma.1.aarch64.rpm cd73df5183011717a6b0f3945eb040317abba79f0f395a9287028390d312a8a3 libblockdev-tools-2.28-6.el8.alma.1.aarch64.rpm d4d85f17825653dc1157098886a6be416b348d49b5957dc03e6ccdf4907444c0 libblockdev-lvm-dbus-devel-2.28-6.el8.alma.1.aarch64.rpm dfdadaafc53c7358c642571b2ddca6a75495d54a32718d8851aed21e4abb13ad libblockdev-kbd-devel-2.28-6.el8.alma.1.aarch64.rpm ed6e6ceb4403b24f89436056cb55e34080fdd140ed467933a1d2f16bb2c34b21 libblockdev-dm-devel-2.28-6.el8.alma.1.aarch64.rpm f61666f4c90eda3bdf03b26733b675d1439bbb6d4827d2bfe7104e661b0ce3b2 ALSA-2026:0921 Important: go-toolset:rhel8 security update Copyright 2026 AlmaLinux OS 0 1 Important

go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default golang-race-1.25.5-1.module_el8.10.0+4107+b32a33ce.aarch64.rpm 2af15d5a5022e9d7532bd1d8f6b4ebdbf6f0b167e645b4a6f3f514720a0d2411 ALSA-2026:10704 Important: go-toolset:rhel8 security update Copyright 2026 AlmaLinux OS 0 1 Important

go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140) * golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default golang-race-1.25.9-1.module_el8.10.0+4167+2e2e20dd.aarch64.rpm 3a793f87bf64ea581d4ad5b69a232fdf8f415785d9eb88ee9c6fc35b5a6f50a9 ALSA-2026:12176 Important: fence-agents security update Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007) * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default fence-agents-nutanix-ahv-4.2.1-129.el8_10.25.noarch.rpm 043ee47c51e110683c02887fbb85e38d13f9ab68610d50c69ace366a2a4012ec fence-agents-zvm-4.2.1-129.el8_10.25.noarch.rpm 1a2bae3e7c04fcbe60385d24203eace95b01fde631e2cd0d739713771ab94a96 fence-agents-lpar-4.2.1-129.el8_10.25.noarch.rpm 96fa29ed84454cf8893ad5e8cac410b06dcfa7da3c90090bed35699c2a3697dd fence-agents-aws-4.2.1-129.el8_10.25.noarch.rpm ea01f2ced268ea06be9ca086b465349a0c8952357f15a7e14829670da9e209a6 ALSA-2026:1240 Important: fence-agents security update Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default fence-agents-nutanix-ahv-4.2.1-129.el8_10.20.noarch.rpm 4963fac734a5c0638add92fc638f6efa5a209abbdd46d3db0a69b08bb0a9e5a5 fence-agents-zvm-4.2.1-129.el8_10.20.noarch.rpm 5712d7d502090923f6f8fd42a790eb186d64015fdffbb19d69ec088925f80421 fence-agents-lpar-4.2.1-129.el8_10.20.noarch.rpm 89d1df470e9bd0d8617a347d07a73ef9373b0e6e14f55b978d1d591f03575667 fence-agents-aws-4.2.1-129.el8_10.20.noarch.rpm a3f7ffa8d683f949e2a77ed2843efb02fcc9fc1a8c9a3360efb3ac033d0a044b ALSA-2026:1906 Important: fence-agents security update Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default fence-agents-aws-4.2.1-129.el8_10.21.noarch.rpm 22167e15c2afc4e2d256b3658aeba654f2bbd1af090838c5e1472234168090f7 fence-agents-nutanix-ahv-4.2.1-129.el8_10.21.noarch.rpm 2b3faef686285d0e6e50807c1e25a509f0539351acb46c2ecdec140b9636860c fence-agents-lpar-4.2.1-129.el8_10.21.noarch.rpm 82ff0a54f86548a9ed0130b782db7d26b3d7e2c2bde8196135cfab174ad7791e fence-agents-zvm-4.2.1-129.el8_10.21.noarch.rpm aa33e42af193ded809e5aef77034d1f1e84bd6c08a6b972a67754b742f1b8957 ALSA-2026:21295 Important: .NET 10.0 security update Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) * cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825) * cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817) * html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826) * net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default golang-race-1.25.10-1.module_el8.10.0+4187+c45165c4.aarch64.rpm 733e1ea51c6f99c93a461bfbd47da7f8840843a576f04a0b913a7299608cbe49 ALSA-2026:2420 Important: nodejs:24 security update Copyright 2026 AlmaLinux OS 0 1 Important

nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default npm-11.6.2-1.24.13.0.0.module_el8.10.0+4113+bc863bc2.noarch.rpm 9919ff306026467e4310bd20ef03654cc7483478f47f4ce9bc95b9c25217bcdd v8-13.6-devel-13.6.233.17-1.24.13.0.0.module_el8.10.0+4113+bc863bc2.aarch64.rpm b90b3f25d4f9ae17b64043d5fd73ef489d372f605de59fb952558942de62b6cf ALSA-2026:25114 Important: .NET 10.0 security update Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

mysql:8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236) * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default mysql-errmsg-8.4.9-1.module_el8.10.0+4193+cbb8e728.noarch.rpm 4eaf86685c7be5aa67008e904d67f2cb5247b2498134e2e9bbfa0c52b265ad63 mysql-common-8.4.9-1.module_el8.10.0+4193+cbb8e728.noarch.rpm b808f9278368ddaa3426e68bdab0ceba601957a14fcbc404b09c4d6dfafabc3e mysql-test-data-8.4.9-1.module_el8.10.0+4193+cbb8e728.noarch.rpm f059737d89a485a2c6f6be94a49ecdafd4ff1e310913085daeb5b36919474f79 ALSA-2026:2708 Important: go-toolset:rhel8 security update Copyright 2026 AlmaLinux OS 0 1 Important

go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default golang-race-1.25.7-1.module_el8.10.0+4117+b694c6c9.aarch64.rpm 3df562bcc4e340965b9ae2b229409dd8ab49cc50bb669906d77f15c7c1ddeae4 ALSA-2026:38995 Important: go-toolset:rhel8 security, bug fix, and enhancement update Copyright 2026 AlmaLinux OS 0 1 Important

go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.5+1 [almalinux-8.10.z] (JIRA:AlmaLinux-193478) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default golang-race-1.26.5-1.module_el8.10.0+4223+bd807c2e.aarch64.rpm 7a3ab8609dd6afb1fa2ba82f8d79cf04022e1d045d96bea34241898876566429 ALSA-2026:39868 Important: nodejs:24 security, bug fix, and enhancement update Copyright 2026 AlmaLinux OS 0 1 Important

nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8] (JIRA:AlmaLinux-168744) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default v8-13.6-devel-13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94.aarch64.rpm 3e1698b63c4d350226a9b5bcbfaea8c9bd033a2957b0dff67828bd3c4765fc78 npm-11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94.noarch.rpm 8622fde48003921573a31d0b6e33f98c4d6584ca5bbdc8fd71c17f8426a535e7 ALSA-2026:41900 Important: .NET 10.0 security, bug fix, and enhancement update Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:AlmaLinux-192459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default dotnet-templates-10.0-10.0.110-1.el8_10.aarch64.rpm 288a7f35736dd9af75a23dd7e198718742af8a210f1ae61af5da2b6076be6686 aspnetcore-runtime-10.0-10.0.10-1.el8_10.aarch64.rpm 3b401196a76b7623c8ca9d0f0857fb56a66b235a0e6bc8ff9f2f90c32d37e52d dotnet-apphost-pack-10.0-10.0.10-1.el8_10.aarch64.rpm 3fb9d6d9cb484d5a8de40d5f1b064ebfd0fbf04eced491323c2a887785d6439c aspnetcore-runtime-dbg-10.0-10.0.10-1.el8_10.aarch64.rpm 5b9d9bed1cdaa3a1457f87dd84115ae6ff1eb29d6cf0d7bca78cfdad0e6516d2 dotnet-runtime-dbg-10.0-10.0.10-1.el8_10.aarch64.rpm 613f089c23d204bf17b7c8c8176a204b3ad9e3621e875c9e543a5f16afa545ed dotnet-runtime-10.0-10.0.10-1.el8_10.aarch64.rpm 61d5d4f07ad3d593be3b6efb6d84538ffe7e4d2ce13627e2a209c4b683ce6002 dotnet-hostfxr-10.0-10.0.10-1.el8_10.aarch64.rpm 709da1beb6926dd045354d3cd28aa97332439b8bfd2ba0c363e8ea57843f79eb dotnet-sdk-10.0-10.0.110-1.el8_10.aarch64.rpm 805c60b354fa97b90deb3cd7235b35a82315b55230c5710cf60ed1bcc91ae175 dotnet-sdk-dbg-10.0-10.0.110-1.el8_10.aarch64.rpm 892ab4a989efbf07272208d0a44481b5342bae97766435072fc2d4643bf936d5 dotnet-sdk-aot-10.0-10.0.110-1.el8_10.aarch64.rpm a7a40f2c283db537c4192d3c0af658406e7763912b8f6376de926a667c5b1cdc aspnetcore-targeting-pack-10.0-10.0.10-1.el8_10.aarch64.rpm ac4437840f0496dc7d6b200645e53d2134f36e8e460936fcbf1542bd2018cfe2 dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el8_10.aarch64.rpm da01c877a2fe39ff6360bac8de651c106515f568763f7de735fb51124bb24cf7 dotnet-targeting-pack-10.0-10.0.10-1.el8_10.aarch64.rpm fb7aecac2813ed90c6938a858080271bd79e34238f774aa0da6a82b895d6cb62 ALSA-2026:4458 Important: .NET 10.0 security update Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default npm-11.16.0-1.24.18.0.2.module_el8.10.0+4237+cde4efc3.noarch.rpm 361d4a0fa19754d400849ec9f2599c5fbc8b47bf2f2fd22725a4a281f3e0bd3a v8-13.6-devel-13.6.233.17-1.24.18.0.2.module_el8.10.0+4237+cde4efc3.aarch64.rpm a09234bfa2bdcb2e922909ab6d7a57d0e74ad7711b32970d564eb26fb38e84cc ALSA-2026:47736 Important: fence-agents security update Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default fence-agents-aws-4.2.1-129.el8_10.27.noarch.rpm 01a3e896b3a9ca6a07fff581ae09cd7c0314493ea080d70877e7299dfd463700 fence-agents-nutanix-ahv-4.2.1-129.el8_10.27.noarch.rpm 320febe4288455dc389a9dbdf594627502fef50ff2077bba2ca73acea39e3a7b fence-agents-zvm-4.2.1-129.el8_10.27.noarch.rpm ad99ee32df4f8201f467ca2c2abf4a16060335f2122820d1997a28b9eac69dc1 fence-agents-lpar-4.2.1-129.el8_10.27.noarch.rpm cd0182acdc9b7fe25ae451a26e3b895859d10f2e147299a7b18c951fc4c56fe4 ALSA-2026:49927 Moderate: fence-agents security update Copyright 2026 AlmaLinux OS 0 1 Moderate

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default fence-agents-lpar-4.2.1-129.el8_10.28.noarch.rpm a7507df9731d2661f6a41d6774e709ddf16a54df925fc23540cf99b8a359dab9 fence-agents-zvm-4.2.1-129.el8_10.28.noarch.rpm c07027e36d527be89b30521f1cfbe1c8e37f462882979fa74ad548aae545e90a fence-agents-aws-4.2.1-129.el8_10.28.noarch.rpm c893d64c04c0d735e6abf31556291094d5de3e0ef1e74e9847ba7b8c93b7288b fence-agents-nutanix-ahv-4.2.1-129.el8_10.28.noarch.rpm e70c65f25517d1b74f2ed0461a4279ad4306a6d75772b54b624210e4a5603f79 ALSA-2026:53363 Important: fence-agents security update Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default fence-agents-nutanix-ahv-4.2.1-129.el8_10.29.noarch.rpm 437ea1a46de9b47db36a6d3cf0e57577f7975c2222b803fc369a7c18daf10bc4 fence-agents-zvm-4.2.1-129.el8_10.29.noarch.rpm 4e405dc6d454fe3738c738e78091e9208bdb78d272a5a009b090dcbf3eb99f19 fence-agents-aws-4.2.1-129.el8_10.29.noarch.rpm c9b599faeb88253b8a007a81d1ebf5538ef53e5b044d7c1b6ff8a98d86671437 fence-agents-lpar-4.2.1-129.el8_10.29.noarch.rpm e9818b2e176efbfd44d15538c9000055f1c8195806f77b8c503d44702b158e01 ALSA-2026:54371 Important: nodejs:24 security update Copyright 2026 AlmaLinux OS 0 1 Important

nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default npm-11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4.noarch.rpm 201d993641952b6d55cddb97bcb31be103cd7ac79fd0e8d4a6adb8e72d8faa76 v8-13.6-devel-13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4.aarch64.rpm 2cd80a25e7c2e75600ad68e73a51bb86651d9c2ce341a20f77d7913e0dee57f8 ALSA-2026:54542 Important: .NET 10.0 security, bug fix, and enhancement update Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

mysql:8.4 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: Performance Schema unspecified vulnerability (CPU Jul 2026) (CVE-2026-61081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47064) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47012) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60331) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60190) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60177) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-60145) * mysql: DDL unspecified vulnerability (CPU Jul 2026) (CVE-2026-46936) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60186) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60315) * mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026) (CVE-2026-61096) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60163) * mysql: InnoDB unspecified vulnerability (CPU Jul 2026) (CVE-2026-47052) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60188) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60184) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60185) * mysql: JSON unspecified vulnerability (CPU Jul 2026) (CVE-2026-61109) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60191) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-61094) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60178) * mysql: Group Replication GCS unspecified vulnerability (CPU Jul 2026) (CVE-2026-60332) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60189) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60747) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-47023) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60183) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60316) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60187) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60585) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60182) Bug Fix(es) and Enhancement(s): * [tracker] Rebase MySQL to 8.4.11 (JIRA:AlmaLinux-188046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default mysql-errmsg-8.4.11-1.module_el8.10.0+4255+e01a855c.noarch.rpm 25d6b276f637eb80d111e1b53f7d81fac1366d68a81d2c55ff658020d052e492 mysql-common-8.4.11-1.module_el8.10.0+4255+e01a855c.noarch.rpm 8565517a279c84a4e53ef300d9fb050968f93523ada46c2c2ce2dd2e4ab34380 mysql-test-data-8.4.11-1.module_el8.10.0+4255+e01a855c.noarch.rpm 92f736713491b312df60a739cd99a0929fb4939fb38976552ba7d1c9928de928 ALSA-2026:60305 Important: go-toolset:rhel8 security, bug fix, and enhancement update Copyright 2026 AlmaLinux OS 0 1 Important

go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.7+1 [almalinux-8.10.z] (JIRA:AlmaLinux-246426) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default golang-race-1.26.7-1.module_el8.10.0+4264+117c8fc2.aarch64.rpm 4195705c7cdac9d0323f6d6c647aaa5a54bd638deb5b47d40d9ac82e9eb5cc39 ALSA-2026:62583 Important: nodejs:24 security update Copyright 2026 AlmaLinux OS 0 1 Important

nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default npm-11.17.0-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.noarch.rpm 4b9bd0ff598bba7c8bcc1148855160dfe7ace30fa9b167175f62a82928d0ee8f v8-13.6-devel-13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm 4d61fa6fd5a9a2a95834d18f0d35a53eeb5f108d73bc8f8f3aa89ffaa8925e9f ALSA-2026:6391 Moderate: mysql:8.4 security update Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql:8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21941) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21948) * mysql: InnoDB unspecified vulnerability (CPU Jan 2026) (CVE-2026-21936) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21968) * mysql: DDL unspecified vulnerability (CPU Jan 2026) (CVE-2026-21937) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2026) (CVE-2026-21964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default mysql-test-data-8.4.8-1.module_el8.10.0+4154+a69a9128.noarch.rpm 132e239d2e381d6d84c5ff6879a5f733dc36643413bc8cb6f17518f85f7303dd mysql-errmsg-8.4.8-1.module_el8.10.0+4154+a69a9128.noarch.rpm 9a3e60b49d558d7e50333d04cc2e23d3fc3dd796da2994c0db236d453cbb176d mysql-common-8.4.8-1.module_el8.10.0+4154+a69a9128.noarch.rpm aed379944a57d0b9a041d49e5844d2a6b9cac49d21f67dd731061dda00f50bab ALSA-2026:68676 Important: .NET 10.0 security, bug fix, and enhancement update Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default golang-race-1.25.8-1.module_el8.10.0+4156+92f0ae2f.aarch64.rpm 8e34eaf540a82b0f0c739ba7e1700b90fd7002b531c0724ab9a3023b6cc7984c ALSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update Copyright 2026 AlmaLinux OS 0 1 Important

nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) Bug Fix(es) and Enhancement(s): * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8.10.z] (JIRA:AlmaLinux-249188) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default v8-13.6-devel-13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960.aarch64.rpm 35c5cc9e2fcb8619245567727ba0fe0443e0795a5fbaacf897c36ec22c981393 npm-11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960.noarch.rpm 638e1b948cbbb3b7c3dc14d88099a23f329c9375e51f55d397013e7afd91bb9e ALSA-2026:7670 Important: nodejs:24 security update Copyright 2026 AlmaLinux OS 0 1 Important

nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs denial of service (CVE-2026-21637) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581) * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715) * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716) * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711) * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713) * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714) * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default npm-11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42.noarch.rpm 149b7e5f38874abbc9d1a1f050adfb1b83230912911b200f8251cae7894a2d5d v8-13.6-devel-13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42.aarch64.rpm aac5e73c322aefa82d2e3db01d96e503f70ba6802347cac713185b9519df95f1 ALSA-2026:83460 Critical: idm:DL1 security, bug fix, and enhancement update Copyright 2026 AlmaLinux OS 0 1 Critical

idm:DL1 security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * Fix ipatests for kdcproxy after CVE-2025-59088 fix [almalinux-8.10.z] (JIRA:AlmaLinux-129966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default python3-ipatests-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 0dc892199eff5db7ff0d4f18fbc8fd1f9ea16661bf474c6e54d5c1d0a7e3f831 ipa-server-dns-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 41ac26e437e356ffae3f1853af16bfe2a1b506b069def7ecdd8184bc1ab8da84 ipa-healthcheck-0.12-6.module_el8.10.0+4036+84b152d9.noarch.rpm 59f7474a67cbc965bd0c360b4385395b89d1a12cf7015fcd6b16abe44ce85b0b python3-ipaserver-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 6e5b188f929fec264a8166ce08465200a08aab493312263f5c94252b8266c70f ipa-server-4.9.13-21.module_el8.10.0+4302+2d2000af.3.aarch64.rpm 733ae2d568122a50e9a94527e306cc94f92c3cc1dc542acb5785dcc30503768a ipa-server-common-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 7ab3b7165531371d213aeb17e9ba8f415d8bd39db86d7025f9c24629d9d4ac0d ipa-server-trust-ad-4.9.13-21.module_el8.10.0+4302+2d2000af.3.aarch64.rpm fb4eec2c1cfb02cce2659a92a5b1ec893449ad329893507b9ac9f9f4218bbbb2 ALSA-2026:8473 Important: .NET 10.0 security update Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 (JIRA:AlmaLinux-277805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default dotnet-sdk-dbg-10.0-10.0.113-1.el8_10.aarch64.rpm 01338518a115bc737e2149a81f74c1bf2720a04038aff2acb27b67bc5bd17e74 dotnet-templates-10.0-10.0.113-1.el8_10.aarch64.rpm 098346879a9fd81ac43a859951c5e3bd199a9ca8628403b9f9de924965fea7b8 dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el8_10.aarch64.rpm 1ed424a69c080e5d1eaa4a043860a1a91c9dc22ecce449dbee68c1a15f73b49d aspnetcore-runtime-dbg-10.0-10.0.13-1.el8_10.aarch64.rpm 28fd230cdb4e2c6205f0df42e2d7687b1bec1db138f7711ae9d845166bb953a1 dotnet-sdk-aot-10.0-10.0.113-1.el8_10.aarch64.rpm 54073d09e9c5a3988eb8b0f9a4affb3eed6fb3a1e66336f0263acc7e9283c45a dotnet-sdk-10.0-10.0.113-1.el8_10.aarch64.rpm 58caac4c61abb3f3bc05361ab518b561c5f02007692a62217ef0c5ed59c05a37 aspnetcore-runtime-10.0-10.0.13-1.el8_10.aarch64.rpm a9e424c9ac2188b298a6d42422b1c26e3e7f69168b039e4d2642f44a6d8ea3c2 dotnet-apphost-pack-10.0-10.0.13-1.el8_10.aarch64.rpm ab250b7a97a81210be6992018074ffd6500fd5065f2cb673057b27109bf8dac9 dotnet-targeting-pack-10.0-10.0.13-1.el8_10.aarch64.rpm c59cd933812b03e3d8043900130ec604258de19f61a045c308a38bfa644cbf83 dotnet-runtime-dbg-10.0-10.0.13-1.el8_10.aarch64.rpm cb54999e27c187f2a3436198136c4d4b8f497903485e8007ef6ebd6980ca78bd dotnet-hostfxr-10.0-10.0.13-1.el8_10.aarch64.rpm e816ecb97f7b80d63fa20c401c5d1cd28dc842a88aa1bd8ba03b0fd6ecedd147 dotnet-runtime-10.0-10.0.13-1.el8_10.aarch64.rpm f0ea1a91626b06cc9385aeff9a3d66b41efef47a4d369b1eb6683c12ec816547 aspnetcore-targeting-pack-10.0-10.0.13-1.el8_10.aarch64.rpm f64c0691afab578d8e57a4746648c832494ba47c5f27c73c07b19b2757a4c861 ALSA-2026:86203 Important: go-toolset:rhel8 security, bug fix, and enhancement update Copyright 2026 AlmaLinux OS 0 1 Important

go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [almalinux-8.10.z] (JIRA:AlmaLinux-287193) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default golang-race-1.26.10-1.module_el8.10.0+4307+6e4cbc60.aarch64.rpm 26ed938cd54cacd427374dff695461cf492f93798b500a6afa6a48471c484dff ALSA-2026:A001 Important: kernel security update Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default kernel-selftests-internal-4.18.0-553.121.1.el8_10.aarch64.rpm ba43d6cf5d3c8b00e107c13c84a9ca1fa18afb7338fab8e739d4e12841f3d23e kernel-modules-internal-4.18.0-553.121.1.el8_10.aarch64.rpm bf7f07f2e3f64b7a7b7acc3e50c17689903815df571d9395c21bec1071355764 kernel-debug-modules-internal-4.18.0-553.121.1.el8_10.aarch64.rpm eaf30ef4602af07310fdf15b5c0e93cb7302462565c08095cdf2a2784f2dab52 ALSA-2026:A004 Important: kernel security update Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default kernel-modules-internal-4.18.0-553.123.2.el8_10.aarch64.rpm 01b1f98cc43dc9fe1f22844d737b15d01dd83900e2d03ff6b87a6a75753d04f1 kernel-debug-modules-internal-4.18.0-553.123.2.el8_10.aarch64.rpm 369431a4a508940040b611e52ca92d41ee507f5cd9fc11661991b85a53ad44f6 kernel-selftests-internal-4.18.0-553.123.2.el8_10.aarch64.rpm cc91c141bc5f42cef54e48218df49c4314465a0307b6f4381bbade38bb260ff8 ALSA-2026:A008 Important: kernel security update Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300) * kernel: ptrace: require CAP_SYS_PTRACE when task has no mm (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-aarch64-devel-rpms__8_10_default kernel-debug-modules-internal-4.18.0-553.124.4.el8_10.aarch64.rpm 2da5152c6570c654a67897d4f370edbc4f2d0c7234bdba0b5af4070a9dbd2c2d kernel-modules-internal-4.18.0-553.124.4.el8_10.aarch64.rpm 3f9c2bee2689736bb0eb2fb38c0017d5bd1bd84046835ce77b836c9c106e9ce1 kernel-selftests-internal-4.18.0-553.124.4.el8_10.aarch64.rpm 95b035bb37b1e1bb95bf89c27b07af46ba049ebfdd00476ede38e408ad5babb0