<?xml version="1.0" encoding="UTF-8"?>
<updates>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18134</id>
    <title>Moderate: kernel security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-06-08 10:12:39"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)
  * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
  * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)
  * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)
  * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)
  * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)
  * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)
  * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)
  * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)
  * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)
  * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)
  * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)
  * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)
  * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
  * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
  * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)
  * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)
  * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
  * kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210)
  * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257)
  * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)
  * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)
  * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
  * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
  * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18134" id="RHSA-2026:18134" type="rhsa" title="RHSA-2026:18134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56633" id="CVE-2024-56633" type="cve" title="CVE-2024-56633"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-21839" id="CVE-2025-21839" type="cve" title="CVE-2025-21839"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-37980" id="CVE-2025-37980" type="cve" title="CVE-2025-37980"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38015" id="CVE-2025-38015" type="cve" title="CVE-2025-38015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38097" id="CVE-2025-38097" type="cve" title="CVE-2025-38097"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38166" id="CVE-2025-38166" type="cve" title="CVE-2025-38166"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38202" id="CVE-2025-38202" type="cve" title="CVE-2025-38202"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38267" id="CVE-2025-38267" type="cve" title="CVE-2025-38267"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38275" id="CVE-2025-38275" type="cve" title="CVE-2025-38275"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38279" id="CVE-2025-38279" type="cve" title="CVE-2025-38279"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38345" id="CVE-2025-38345" type="cve" title="CVE-2025-38345"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38346" id="CVE-2025-38346" type="cve" title="CVE-2025-38346"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38405" id="CVE-2025-38405" type="cve" title="CVE-2025-38405"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38441" id="CVE-2025-38441" type="cve" title="CVE-2025-38441"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38470" id="CVE-2025-38470" type="cve" title="CVE-2025-38470"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-39866" id="CVE-2025-39866" type="cve" title="CVE-2025-39866"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40034" id="CVE-2025-40034" type="cve" title="CVE-2025-40034"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40134" id="CVE-2025-40134" type="cve" title="CVE-2025-40134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40210" id="CVE-2025-40210" type="cve" title="CVE-2025-40210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40257" id="CVE-2025-40257" type="cve" title="CVE-2025-40257"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40320" id="CVE-2025-40320" type="cve" title="CVE-2025-40320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23040" id="CVE-2026-23040" type="cve" title="CVE-2026-23040"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23111" id="CVE-2026-23111" type="cve" title="CVE-2026-23111"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23210" id="CVE-2026-23210" type="cve" title="CVE-2026-23210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23243" id="CVE-2026-23243" type="cve" title="CVE-2026-23243"/>
      <reference href="https://bugzilla.redhat.com/2334549" id="2334549" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2350585" id="2350585" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2367614" id="2367614" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2373343" id="2373343" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376060" id="2376060" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376065" id="2376065" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376382" id="2376382" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379178" id="2379178" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379187" id="2379187" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379199" id="2379199" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379237" id="2379237" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379239" id="2379239" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383399" id="2383399" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383478" id="2383478" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383906" id="2383906" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2396940" id="2396940" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2406782" id="2406782" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2414468" id="2414468" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2416307" id="2416307" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2418880" id="2418880" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2419945" id="2419945" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436806" id="2436806" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439687" id="2439687" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439895" id="2439895" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448594" id="2448594" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18134.html" id="ALSA-2026:18134" type="self" title="ALSA-2026:18134"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.7.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">29736f26916c2b2e07fb5e9fb9cdd09dec220388ccf0229b9556461f59d4f434</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.7.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">31870816feb5aef2e4ad0c689cd80d2126ee8ee510583511828292bcfa5993e9</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.7.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">391360a5aaf6c8742fa920176aa1843817c9c22addf3d63c1ff1b8e9545a2ac7</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.7.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">475cfaed113a74a5db45431ced60bd867a09acbb46ef917105a36554afad13a1</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.7.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">51c067c2fc567e3c173025d9b58cb6e0dc69dbe9938ebf8d7c2fd2859c9899b6</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.7.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">78db96b63b180a526d27658a5f66bd367e0d516ce72b83b9aa8ec6f642d3b051</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.7.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b790f6a75eaeb8d2efcc7d2574257a819cd1eb357b7213a3dc37459c3c846560</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.7.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bf68f4488517255bb1d8875ef2098c5fc85d15fa002e2cd04a847a0ac329f730</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.7.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d3dd005a89c550d81bcbf6fce14d410ce31fa6d7982ae0dbea3356e495c8b595</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.7.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dd34e200421f50ae6eda25dea41e7e79498ef9642d29d6d796161417457e3743</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18142</id>
    <title>Low: NetworkManager security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:32:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>NetworkManager security update</summary>
    <description>NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.  

Security Fix(es):  

  * networkmanagr: NetworkManager File Access (CVE-2025-9615)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18142" id="RHSA-2026:18142" type="rhsa" title="RHSA-2026:18142"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-9615" id="CVE-2025-9615" type="cve" title="CVE-2025-9615"/>
      <reference href="https://bugzilla.redhat.com/2391503" id="2391503" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18142.html" id="ALSA-2026:18142" type="self" title="ALSA-2026:18142"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="NetworkManager-ovs" version="1.56.0" release="1.el10" epoch="1" arch="x86_64_v2" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-ovs-1.56.0-1.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">02a5ce3e7af1ab1ec68ad7845796c5e1045651ab678f8c9e2613f02c61a75f35</sum>
        </package>
        <package name="NetworkManager-cloud-setup" version="1.56.0" release="1.el10" epoch="1" arch="x86_64_v2" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-cloud-setup-1.56.0-1.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">325cf6492527e1930e63fee30b911790b4d46cc70a4140e4ae9042707d07afd4</sum>
        </package>
        <package name="NetworkManager-config-connectivity-redhat" version="1.56.0" release="1.el10" epoch="1" arch="noarch" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-config-connectivity-redhat-1.56.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">3c3510b6b69347004ae5092b71485721e86928b812cdbbb21a7a13cf2a6cf1ec</sum>
        </package>
        <package name="NetworkManager-ppp" version="1.56.0" release="1.el10" epoch="1" arch="x86_64_v2" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-ppp-1.56.0-1.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">f0111273c16b0da7324b570a3ef1de91774ad4ca34eed8c4f5f66704002d9aff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18143</id>
    <title>Moderate: p11-kit security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:34"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>p11-kit security update</summary>
    <description>The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.  

Security Fix(es):  

  * p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters (CVE-2026-2100)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18143" id="RHSA-2026:18143" type="rhsa" title="RHSA-2026:18143"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2100" id="CVE-2026-2100" type="cve" title="CVE-2026-2100"/>
      <reference href="https://bugzilla.redhat.com/2437308" id="2437308" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18143.html" id="ALSA-2026:18143" type="self" title="ALSA-2026:18143"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="p11-kit-server" version="0.26.2" release="1.el10" epoch="0" arch="x86_64_v2" src="p11-kit-0.26.2-1.el10.src.rpm">
          <filename>p11-kit-server-0.26.2-1.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">13b5529214002befab07b1781daa120a685812951d058d5ec49bb8d5f444efc8</sum>
        </package>
        <package name="p11-kit-devel" version="0.26.2" release="1.el10" epoch="0" arch="x86_64_v2" src="p11-kit-0.26.2-1.el10.src.rpm">
          <filename>p11-kit-devel-0.26.2-1.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">ae2ec59d37aefbf47bb9f0b4d47b8be65854041bf672b426e5e8dc26aea57a09</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18160</id>
    <title>Moderate: libssh security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libssh security update</summary>
    <description>libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.  

Security Fix(es):  

  * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)
  * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)
  * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)
  * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)
  * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18160" id="RHSA-2026:18160" type="rhsa" title="RHSA-2026:18160"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0964" id="CVE-2026-0964" type="cve" title="CVE-2026-0964"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0965" id="CVE-2026-0965" type="cve" title="CVE-2026-0965"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0966" id="CVE-2026-0966" type="cve" title="CVE-2026-0966"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0967" id="CVE-2026-0967" type="cve" title="CVE-2026-0967"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0968" id="CVE-2026-0968" type="cve" title="CVE-2026-0968"/>
      <reference href="https://bugzilla.redhat.com/2433121" id="2433121" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436979" id="2436979" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436980" id="2436980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436981" id="2436981" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436982" id="2436982" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18160.html" id="ALSA-2026:18160" type="self" title="ALSA-2026:18160"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libssh-devel" version="0.12.0" release="2.el10" epoch="0" arch="x86_64_v2" src="libssh-0.12.0-2.el10.src.rpm">
          <filename>libssh-devel-0.12.0-2.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">9a924029044043e06690f1cd3c2851532acdab730fc6bd2e98a91c0687a774be</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18326</id>
    <title>Moderate: libvirt security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:35:08"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libvirt security update</summary>
    <description>Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.  

Security Fix(es):  

  * libvirt: Denial of service in XML parsing (CVE-2025-12748)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18326" id="RHSA-2026:18326" type="rhsa" title="RHSA-2026:18326"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-12748" id="CVE-2025-12748" type="cve" title="CVE-2025-12748"/>
      <reference href="https://bugzilla.redhat.com/2413801" id="2413801" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18326.html" id="ALSA-2026:18326" type="self" title="ALSA-2026:18326"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libvirt-daemon-driver-storage-disk" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-disk-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">021ad00a0e91820173991c0011133f65dcc2601ecfa793db853695904f90cf18</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-iscsi" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-iscsi-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0364a1dcee25de58cccc54eef19b359c34295a4c065f2a32eb792ce304f3f8f3</sum>
        </package>
        <package name="libvirt-daemon-config-network" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-config-network-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">04b51cb5da64f98672ba9756ba8ced2c2aac1fc564a2b1562f4bd1b01e6aa846</sum>
        </package>
        <package name="libvirt-daemon-kvm" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-kvm-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">07a63eda9726bc331f5933ee53d845e1f99194fe5a41546c95665e60de815a48</sum>
        </package>
        <package name="libvirt-nss" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-nss-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0d79d7a7777a238f6bb352d3023e8d02d838e0af5df88e6910b6b4b92ebf9302</sum>
        </package>
        <package name="libvirt-daemon-driver-qemu" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-qemu-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0e6ee20aa16e0488c4a32817fd25df067168f03f54ec24b3f38a2f32207a4732</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-scsi" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-scsi-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">18ef67392844b99286285521cffb0a76e3847a23cf3cd75e117502ee177b54fd</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-core" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-core-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">35ce339cacb8720ddaad3ed9d89479331a76904f764b80d0732f60b116c3cfcb</sum>
        </package>
        <package name="libvirt-libs" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-libs-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">3969448bc9e02726a260fc04b39af6598d20d34676d0381d2097c56892824488</sum>
        </package>
        <package name="libvirt-daemon" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">399da4ce2afe2c661be83fdf0d8ea98b8179ee326aa8e840ef6efe3ab118c1e5</sum>
        </package>
        <package name="libvirt-daemon-plugin-lockd" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-plugin-lockd-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">407d3b87de33946507b46c8e9cf0ded9ec52f4e2da085af7cb68981b6e6043ee</sum>
        </package>
        <package name="libvirt-ssh-proxy" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-ssh-proxy-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">464eb93acae32cf721120830cb3131064951039e074bbb5f68b6ef85566521f2</sum>
        </package>
        <package name="libvirt-daemon-lock" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-lock-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">47450c47370c1df76c97935fc99911e823e0c4fea5d5e20b9c8b1573ebfc86fd</sum>
        </package>
        <package name="libvirt-daemon-proxy" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-proxy-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">65981ed6e4fb55e77077bed52e8a01912049744e6fe710607aca8843cb56f04e</sum>
        </package>
        <package name="libvirt-daemon-config-nwfilter" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-config-nwfilter-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">69cf53d6a66c2045454ce8acf26527ee14844cfff0e88a69288f81acd85336ed</sum>
        </package>
        <package name="libvirt-daemon-driver-network" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-network-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">74836473d47fe2bd35ed8a45c9c9dc67a0fb972a0ba6ef5ea20f500c7ff5b7f5</sum>
        </package>
        <package name="libvirt-daemon-driver-interface" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-interface-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">85bdc6a1eefc12d4f364c452171f932c9340d0ab10b3b016c910303f83194241</sum>
        </package>
        <package name="libvirt-daemon-driver-nwfilter" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-nwfilter-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">893fd7442e25235d93baf26c808f9d627054a30c241c6a1f2254c96423312902</sum>
        </package>
        <package name="libvirt-daemon-driver-secret" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-secret-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">8d807d6899c170b60ca04a89f281d434b55fd2457e6a6a96fc6518101aebfd7c</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-rbd" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-rbd-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9373f5e147f44261a39709cbe6ebb6434515d7e3845fcfd4dd93a7f9ab62bf8d</sum>
        </package>
        <package name="libvirt" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9801372ec307c54aa7c68fac34fdbf0621a101de86c3c94aa96895cefc95f3d8</sum>
        </package>
        <package name="libvirt-daemon-log" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-log-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9890f657a45f445c7ff58a7cdea96a0f85c7e6cfe5ecc38c2b31ae0622966f32</sum>
        </package>
        <package name="libvirt-client-qemu" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-client-qemu-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9d298734e340f5a6bd13932a9dd6f0161f51d006f691160d79e78e5d0db56126</sum>
        </package>
        <package name="libvirt-daemon-driver-storage" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">bc5db96f1c9d9d1c7acc30b31038618ea444121c9a036fa385758186a94cfc52</sum>
        </package>
        <package name="libvirt-daemon-driver-nodedev" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-nodedev-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">d589aabafa57ffecfb806fbca998b20cd2a2cffc7f5d8de3a0e46b592c21ebe2</sum>
        </package>
        <package name="libvirt-daemon-common" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-common-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">ea6d0227d7766ecd352f50eace3f7bc610e2760db1328fcca558f7c6ac146f6d</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-mpath" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-mpath-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">ecf4f377a05a98b6e0e677e35413e10ad94b0f93c88060fb9a8b285683e2d89e</sum>
        </package>
        <package name="libvirt-client" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-client-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">f4e3b57d21ca397c273dd1bb2e2b0b4d41cff9faba18265bfd92c2d75670b7d6</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-logical" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-logical-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">f6943594fc20b33b6e7e12cbb0a9db9b0505002b843b2a047d7a531323e33555</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18421</id>
    <title>Moderate: luksmeta security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>luksmeta security update</summary>
    <description>LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux.  

Security Fix(es):  

  * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18421" id="RHSA-2026:18421" type="rhsa" title="RHSA-2026:18421"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-11568" id="CVE-2025-11568" type="cve" title="CVE-2025-11568"/>
      <reference href="https://bugzilla.redhat.com/2404244" id="2404244" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18421.html" id="ALSA-2026:18421" type="self" title="ALSA-2026:18421"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libluksmeta" version="10" release="1.el10" epoch="0" arch="x86_64_v2" src="luksmeta-10-1.el10.src.rpm">
          <filename>libluksmeta-10-1.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">5fed210edcd96a6e8331cbddddda883a86976488b3669c0f573ab08b95e77214</sum>
        </package>
        <package name="luksmeta" version="10" release="1.el10" epoch="0" arch="x86_64_v2" src="luksmeta-10-1.el10.src.rpm">
          <filename>luksmeta-10-1.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">75d9ef72a9cf03b507d931037ffb8bb027e8341ddfa4f436736b0a92d6c22405</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18465</id>
    <title>Important: edk2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>edk2 security update</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   

Security Fix(es):  

  * edk2: EDK2: Improper Input Validation allows arbitrary command execution (CVE-2025-2296)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18465" id="RHSA-2026:18465" type="rhsa" title="RHSA-2026:18465"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-2296" id="CVE-2025-2296" type="cve" title="CVE-2025-2296"/>
      <reference href="https://bugzilla.redhat.com/2420637" id="2420637" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18465.html" id="ALSA-2026:18465" type="self" title="ALSA-2026:18465"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="edk2-ovmf" version="20251114" release="5.el10_2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">0440f37c3dfa7d8ed89074f19a592ec31ae69caf218c9c023a8e521cbedd1c05</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18479</id>
    <title>Important: qemu-kvm security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>qemu-kvm security update</summary>
    <description>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.  

Security Fix(es):  

  * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)
  * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)
  * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699)
  * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695)
  * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18479" id="RHSA-2026:18479" type="rhsa" title="RHSA-2026:18479"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11692" id="CVE-2024-11692" type="cve" title="CVE-2024-11692"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11694" id="CVE-2024-11694" type="cve" title="CVE-2024-11694"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11695" id="CVE-2024-11695" type="cve" title="CVE-2024-11695"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11696" id="CVE-2024-11696" type="cve" title="CVE-2024-11696"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11697" id="CVE-2024-11697" type="cve" title="CVE-2024-11697"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11699" id="CVE-2024-11699" type="cve" title="CVE-2024-11699"/>
      <reference href="https://bugzilla.redhat.com/2328941" id="2328941" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328943" id="2328943" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328946" id="2328946" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328947" id="2328947" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328948" id="2328948" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328950" id="2328950" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18479.html" id="ALSA-2026:18479" type="self" title="ALSA-2026:18479"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="qemu-kvm-core" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-core-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">02b913b8f1acd264f2e5aebccea9db3efbaf74b5bc217ff40a9a53ccdad375f5</sum>
        </package>
        <package name="qemu-img" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-img-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">04c72b50b2b090490a08441f78f6f83320e579af3a1a8d30ca5d7f206da1294f</sum>
        </package>
        <package name="qemu-kvm-device-usb-host" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-usb-host-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1c7fa6758b04e0b5b7a6b04e5756324be39cd9204ad6979f79d58847d4c7c706</sum>
        </package>
        <package name="qemu-kvm-block-curl" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-block-curl-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">30beb677a15450421d0702198c8f45e78ba2ffc0ad30f85e257415e75799bbc2</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu-pci" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">317b10f1f8625c3ad16bbfc7257ab61f4869e4156babc5f34c19ed5e721e54ba</sum>
        </package>
        <package name="qemu-kvm-block-blkio" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-block-blkio-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">31ad3df9dfa243bcb48b161689c0524db0441b1ced3e2f8c8c01349f26f3f404</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4cc88712e173b7711fddc6137fbaab97ddb00f43ed2fca7a8637c569c0024632</sum>
        </package>
        <package name="qemu-kvm-ui-egl-headless" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-ui-egl-headless-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4ef278a0e6d3ea128261224da75024f6c0a53e80a09031fcd1f10a80d5c1a721</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-vga" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-display-virtio-vga-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">56bc6a479277e0c74d5b7ccf2754a84809dd449fe076beead495e85e80909e5d</sum>
        </package>
        <package name="qemu-kvm-block-rbd" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-block-rbd-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">681a2955c4991648b0900f514b5c1917c24297c9f7642f39155faf751c09a370</sum>
        </package>
        <package name="qemu-kvm-audio-pa" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-audio-pa-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">793c6f828dac538ff5af996201e7e25b47ff99cc1e247ddf9b887d8f799fd4df</sum>
        </package>
        <package name="qemu-kvm-docs" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-docs-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7d8b7d7411245eea40531ec56a72384bc87ec338e9400c9419ea2172931cc898</sum>
        </package>
        <package name="qemu-pr-helper" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-pr-helper-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7e25e79731ed77d33ac546fedd090d918fbb845a9f620a1e414d6a01839297ca</sum>
        </package>
        <package name="qemu-kvm-ui-opengl" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-ui-opengl-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">83c8dd4caffb920c9976da6c6532f9434beeeaf9d3b5af31d7f487d434be72f1</sum>
        </package>
        <package name="qemu-kvm-device-usb-redirect" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">91e741cd589bc5d7c580611dc8a9ee14c4789e5b64d3250031c845706ed164b9</sum>
        </package>
        <package name="qemu-kvm-common" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-common-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">a796843e38ce74c2a964c97fe3b3386ff28fde5751bf141e62db69493e4c6493</sum>
        </package>
        <package name="qemu-kvm" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b0dac79d289be95bbc053a1ca35f0accd654d39f3834613bc9709278c5ed67a9</sum>
        </package>
        <package name="qemu-guest-agent" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-guest-agent-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">c87aa68cc76df5d7d8b9acdee2c534917b2004ab6d88702b09061a9df0c741dd</sum>
        </package>
        <package name="qemu-kvm-tools" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-tools-10.1.0-16.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">c982bd1e0d40d8f4c442b89df0d6d08dce84ab1418354b0fc67bc441fcc20024</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18480</id>
    <title>Important: linux-sgx security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:31:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>linux-sgx security update</summary>
    <description>The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.  

Security Fix(es):  

  * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)
  * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)
  * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)
  * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)
  * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18480" id="RHSA-2026:18480" type="rhsa" title="RHSA-2026:18480"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13465" id="CVE-2025-13465" type="cve" title="CVE-2025-13465"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-15284" id="CVE-2025-15284" type="cve" title="CVE-2025-15284"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23745" id="CVE-2026-23745" type="cve" title="CVE-2026-23745"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23950" id="CVE-2026-23950" type="cve" title="CVE-2026-23950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-24842" id="CVE-2026-24842" type="cve" title="CVE-2026-24842"/>
      <reference href="https://bugzilla.redhat.com/2425946" id="2425946" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2430538" id="2430538" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431036" id="2431036" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431740" id="2431740" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2433645" id="2433645" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18480.html" id="ALSA-2026:18480" type="self" title="ALSA-2026:18480"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="tdx-qgs" version="2.26" release="7.el10" epoch="0" arch="x86_64_v2" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>tdx-qgs-2.26-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">06ebc0db065ae5cfabe6a8d4c97678ca0b96193979f200ab44866a978580d777</sum>
        </package>
        <package name="sgx-mpa" version="2.26" release="7.el10" epoch="0" arch="x86_64_v2" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-mpa-2.26-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">1c22afa2a9ee591866f41c95e39ab437b2a13a7db665ef858f25e9b1a4a15ba8</sum>
        </package>
        <package name="sgx-pccs" version="2.26" release="7.el10" epoch="0" arch="x86_64_v2" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-pccs-2.26-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">1f6928b14ed3007ec89cbc729488c679aa89b45513ed8a64d6b1ae2f9b0d9b05</sum>
        </package>
        <package name="sgx-pckid-tool" version="2.26" release="7.el10" epoch="0" arch="x86_64_v2" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-pckid-tool-2.26-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">89bbc3240415a952813ab1618e6b59455a441fbf9edf1ee1f6ca17778febe42b</sum>
        </package>
        <package name="sgx-common" version="2.26" release="7.el10" epoch="0" arch="x86_64_v2" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-common-2.26-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">a6c8ff6d31a7434ffbda39111e674f59bdcd90744d391791e914bd13b7bfb604</sum>
        </package>
        <package name="sgx-pccs-admin" version="2.26" release="7.el10" epoch="0" arch="x86_64_v2" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-pccs-admin-2.26-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">aea7f286c261ab240e8a0905aa4df4ed381b43e44fb5b67bca646f8f55de3c9b</sum>
        </package>
        <package name="sgx-libs" version="2.26" release="7.el10" epoch="0" arch="x86_64_v2" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-libs-2.26-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">ddd4911be5f27fc98c0a5ca95cd4ba576832bf4a656c1fcc6c4fd4e96cb8dc8a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18556</id>
    <title>Moderate: unbound security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:31:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: DNSBomb vulnerability (CVE-2024-33655)
  * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18556" id="RHSA-2026:18556" type="rhsa" title="RHSA-2026:18556"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-33655" id="CVE-2024-33655" type="cve" title="CVE-2024-33655"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-11411" id="CVE-2025-11411" type="cve" title="CVE-2025-11411"/>
      <reference href="https://bugzilla.redhat.com/2279942" id="2279942" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2405706" id="2405706" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18556.html" id="ALSA-2026:18556" type="self" title="ALSA-2026:18556"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="unbound-utils" version="1.24.2" release="7.el10" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">26000ed30b1ee346f6fb67893fc403a9bc15a0e3a52b5a14dc1526286162258b</sum>
        </package>
        <package name="unbound-dracut" version="1.24.2" release="7.el10" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">2b4415c8793624a8c6e17ca1341fdafb4403e7d849aa419a78a7deb698689ae8</sum>
        </package>
        <package name="unbound-libs" version="1.24.2" release="7.el10" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">4d39b0006dc9e724ba75d8d558b164a15c8dc489345011af47fd0cbb4ee746b6</sum>
        </package>
        <package name="python3-unbound" version="1.24.2" release="7.el10" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">5e081ffbb28daf88933262f5e69f6abe60edaab10148e954dff759939a8a81a9</sum>
        </package>
        <package name="unbound" version="1.24.2" release="7.el10" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-1.24.2-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">8d8be00cb70cba975c7a9e785c513efcf1f7909bdfe8cbcd05783822dbf312b9</sum>
        </package>
        <package name="unbound-anchor" version="1.24.2" release="7.el10" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">8fde48e36b3b58d0862fa8a557737ac54ae09e7e6842a7e829dbe06e59cac251</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19009</id>
    <title>Important: postgresql18 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql18 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)
  * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)
  * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)
  * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)
  * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19009" id="RHSA-2026:19009" type="rhsa" title="RHSA-2026:19009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2007" id="CVE-2026-2007" type="cve" title="CVE-2026-2007"/>
      <reference href="https://bugzilla.redhat.com/2439320" id="2439320" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439322" id="2439322" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439324" id="2439324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439325" id="2439325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439326" id="2439326" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19009.html" id="ALSA-2026:19009" type="self" title="ALSA-2026:19009"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="postgresql18-static" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-static-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">053b413438892de34c4f3e233f12a02129471578d9cea986ba7fc1d47ceac007</sum>
        </package>
        <package name="postgresql18-docs" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-docs-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1e92ed4d789cb3ed8d62850359ec457553d00db37b83c7e80a999ea7f1bf8156</sum>
        </package>
        <package name="postgresql18-private-devel" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-private-devel-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3ac373c2f572d10b2eb7762007f934fb613ff6e6034b3381dda4232968f29b74</sum>
        </package>
        <package name="postgresql18-contrib" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-contrib-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">50cd5a3fc78f89f672ce67f5095ed30375fa8772bb0a2adab5c8afcbffeb74a0</sum>
        </package>
        <package name="postgresql18-plpython3" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-plpython3-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">51e0c7180543697522d2bbff74d7472666a7c0314f20307caf40cfd7d4cff749</sum>
        </package>
        <package name="postgresql18" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5ada7c0f77845afd9a204d3af6a060c609f8096477b2f9d61d15c5cac0d657cd</sum>
        </package>
        <package name="postgresql18-upgrade" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-upgrade-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">67839a16e5020eb92125051054a341de26fc862c62bdd79e29471bf8a8e14b96</sum>
        </package>
        <package name="postgresql18-test" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-test-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">77ebc5762950b2ca1e6482ed9dee4512a736c9c45cd1423618d04163df5b7ff2</sum>
        </package>
        <package name="postgresql18-private-libs" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-private-libs-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">98aa96ded05840256192c21df86fa6107454b21ab5cb23e74e127d264073118e</sum>
        </package>
        <package name="postgresql18-upgrade-devel" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-upgrade-devel-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9c0fc2c5a1d295572fc75ee38d2206ce3615c55e032d704d4b900ff698158964</sum>
        </package>
        <package name="postgresql18-plperl" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-plperl-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c9cf4d888a256770adbfcd9afe8f9be722f93a8442b9a2fd5cd393bdb09acbb9</sum>
        </package>
        <package name="postgresql18-server-devel" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-server-devel-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f106f1b7fe19354b2dbf222ec2230a6194f7464b439d3491a78b1fbbbde656d5</sum>
        </package>
        <package name="postgresql18-server" version="18.3" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-server-18.3-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f5e4e206ccd2c78422cb8c06fd74e05a27a1889362bca72533f1c2ce5b54b8e9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19010</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql16 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)
  * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)
  * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)
  * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19010" id="RHSA-2026:19010" type="rhsa" title="RHSA-2026:19010"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006"/>
      <reference href="https://bugzilla.redhat.com/2439322" id="2439322" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439324" id="2439324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439325" id="2439325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439326" id="2439326" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19010.html" id="ALSA-2026:19010" type="self" title="ALSA-2026:19010"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="postgresql-upgrade-devel" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-devel-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">19e9bfe9c74f9e106e1a464a4c305d801e07b46480b8a0e7227794c760d3a8a3</sum>
        </package>
        <package name="postgresql-private-devel" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-private-devel-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1e17706ae4a32bc25a65002af8859a758fd93bd1771a01c00815f7ab10afd52f</sum>
        </package>
        <package name="postgresql-server" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-server-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">240d801b479ccb18582a6e90bf53bbbc63acb9f59e20aa9a988fbe9d8d36478d</sum>
        </package>
        <package name="postgresql-private-libs" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-private-libs-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">38dd7f15a89d8601e06e87d6e16a90ed0cbae50705282bf400f38f1f66ca7543</sum>
        </package>
        <package name="postgresql-contrib" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-contrib-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4a735e2ae68aaec7b837636cf65e4dd0e20017b4a1aa724e626db47c3eb13646</sum>
        </package>
        <package name="postgresql-static" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-static-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5d1b4b9ff2abf250c3b46de818b860fe3be27d6407ad781c12f3d5a7147e5a5b</sum>
        </package>
        <package name="postgresql-plperl" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-plperl-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9291405477caf6f51a192e69b2200192bb7696597809e6a9aedc539ddcf9e32d</sum>
        </package>
        <package name="postgresql-docs" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-docs-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">958820d0a5dea583a57c27c5dc628f5397c82b3e41ec7694766f151a47416d53</sum>
        </package>
        <package name="postgresql-pltcl" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-pltcl-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a05d4295e947ea8f8dfeaf6c6e02e250292db5bbfc7e378703b393b04ce2fce7</sum>
        </package>
        <package name="postgresql-server-devel" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-server-devel-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ad21714cc6175fa58f677601ce64622be9bfe3b239547e92cd3806c826386bd6</sum>
        </package>
        <package name="postgresql-test" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-test-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c09598ccd5cf05b8af684b690b285f473a9012a29ba00d35a640a8a1b778aefb</sum>
        </package>
        <package name="postgresql-upgrade" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cdc4f18ec4aa175a0985120350f973d69c8834fce427c4be7e0ae4e3a48efb21</sum>
        </package>
        <package name="postgresql-plpython3" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-plpython3-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d3e39c5ea0e4dbf3dd70d10c2828ba304f98cb9f7ee187682fadf64fecf6cba3</sum>
        </package>
        <package name="postgresql" version="16.13" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-16.13-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e5931199ff3932c2e947f78072d47a3e9611c87de7e25ffd885a1c64be52c9c7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19013</id>
    <title>Moderate: delve security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>delve security update</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.  

Security Fix(es):  

  * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
  * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
  * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19013" id="RHSA-2026:19013" type="rhsa" title="RHSA-2026:19013"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121"/>
      <reference href="https://bugzilla.redhat.com/2418462" id="2418462" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2434432" id="2434432" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2437111" id="2437111" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19013.html" id="ALSA-2026:19013" type="self" title="ALSA-2026:19013"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="delve" version="1.26.1" release="1.el10_2" epoch="0" arch="x86_64_v2" src="delve-1.26.1-1.el10_2.src.rpm">
          <filename>delve-1.26.1-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1afa7a083901e5d5a1f9c70c5b199ed9c0febdeaa528aa652ca84f55be940c0d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19017</id>
    <title>Important: podman security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:31:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19017" id="RHSA-2026:19017" type="rhsa" title="RHSA-2026:19017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455470" id="2455470" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19017.html" id="ALSA-2026:19017" type="self" title="ALSA-2026:19017"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="podman-docker" version="5.8.2" release="1.el10_2.alma.1" epoch="7" arch="noarch" src="podman-5.8.2-1.el10_2.alma.1.src.rpm">
          <filename>podman-docker-5.8.2-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">167be1b8d65574dac9045abe3e1e0b9208ed8e6c2c2c8b29b83d77c4173a468f</sum>
        </package>
        <package name="podman" version="5.8.2" release="1.el10_2.alma.1" epoch="7" arch="x86_64_v2" src="podman-5.8.2-1.el10_2.alma.1.src.rpm">
          <filename>podman-5.8.2-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">2c1b21a1b208d47465e94756775c711fbe87812994fcc733f009ed499e880bc2</sum>
        </package>
        <package name="podman-remote" version="5.8.2" release="1.el10_2.alma.1" epoch="7" arch="x86_64_v2" src="podman-5.8.2-1.el10_2.alma.1.src.rpm">
          <filename>podman-remote-5.8.2-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">76e57129338e83d0b879f64972313972e42f2eb6a8c14beb88e2aa7dfb8322b1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19019</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
  * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19019" id="RHSA-2026:19019" type="rhsa" title="RHSA-2026:19019"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0865" id="CVE-2026-0865" type="cve" title="CVE-2026-0865"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5713" id="CVE-2026-5713" type="cve" title="CVE-2026-5713"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100"/>
      <reference href="https://bugzilla.redhat.com/2431367" id="2431367" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2444691" id="2444691" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448168" id="2448168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448181" id="2448181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449649" id="2449649" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457409" id="2457409" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457932" id="2457932" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458239" id="2458239" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19019.html" id="ALSA-2026:19019" type="self" title="ALSA-2026:19019"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3.14-libs" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7937b6f3dae06a24656342306666a755d7d69f1cc21841330531442b6bb244ea</sum>
        </package>
        <package name="python3.14-tkinter" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c0dc27b42bf9f237bf329cb3ba3d061cb4ec53a5ae2d096627a23552f9b0c174</sum>
        </package>
        <package name="python3.14-devel" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c6b71d8bc1070d45f02bbbee77a04d26cef2fb26d92b09d694f3a246d142fcbd</sum>
        </package>
        <package name="python3.14" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e204b0131d4e87f04a3f295a44e42a2598522ca1df4e532374d9cddd9d304f30</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19020</id>
    <title>Moderate: crun security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>crun security update</summary>
    <description>crun is a OCI runtime  

Security Fix(es):  

  * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19020" id="RHSA-2026:19020" type="rhsa" title="RHSA-2026:19020"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-30892" id="CVE-2026-30892" type="cve" title="CVE-2026-30892"/>
      <reference href="https://bugzilla.redhat.com/2451576" id="2451576" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19020.html" id="ALSA-2026:19020" type="self" title="ALSA-2026:19020"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="crun-krun" version="1.27" release="2.el10_2" epoch="0" arch="x86_64_v2" src="crun-1.27-2.el10_2.src.rpm">
          <filename>crun-krun-1.27-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">306374930e1ab0e0e28ce3dde8a311bbc6ff5f0fc54244957a0d2be25e0a0ad3</sum>
        </package>
        <package name="crun" version="1.27" release="2.el10_2" epoch="0" arch="x86_64_v2" src="crun-1.27-2.el10_2.src.rpm">
          <filename>crun-1.27-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8e5a80b2f138b2dcfdde71f7abe990060fe8628ce83178e902e6b1909ab71959</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19022</id>
    <title>Important: golang security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:54"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>golang security update</summary>
    <description>The golang packages provide the Go programming language compiler.  

Security Fix(es):  

  * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19022" id="RHSA-2026:19022" type="rhsa" title="RHSA-2026:19022"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137"/>
      <reference href="https://bugzilla.redhat.com/2445345" id="2445345" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19022.html" id="ALSA-2026:19022" type="self" title="ALSA-2026:19022"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="golang" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-1.26.2-2.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1648b8a2c452870407d028633164d23ab3f4956551b3f696905b5fef0afc6e84</sum>
        </package>
        <package name="golang-tests" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-tests-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">86ddbd7f00012fa580ea1c9edb33d9e5982eef71b38e0283ad2659fa61352095</sum>
        </package>
        <package name="go-toolset" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>go-toolset-1.26.2-2.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">98bae162c67febcdea78c164ae65fcbabe2437904912f1b4b29da626391fc0f0</sum>
        </package>
        <package name="golang-bin" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-bin-1.26.2-2.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">a54309bb44b5ac8d87b6b9d56f3cb31869a62ac4916f64858c8de2e0bbcf6513</sum>
        </package>
        <package name="golang-docs" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-docs-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">a7b9810b608f99d1d4e8dc8771e6e1493f6f39113e88f56ae83bd92548afe904</sum>
        </package>
        <package name="golang-race" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-race-1.26.2-2.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">cde319bc17ce168a360070c7a52be767bde15e709b7b4991514268c88de49925</sum>
        </package>
        <package name="golang-src" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-src-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">dbf8e7996f83be39afa1954de0ab45d661a96b356a3e406a1960cd6be572a7bb</sum>
        </package>
        <package name="golang-misc" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-misc-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">ff930bc6ddd8d4469f1e7d1cab514142b71eff36da84ce419045251ce79e3e17</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19024</id>
    <title>Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:32:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  

Security Fix(es):  

  * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)
  * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)
  * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)
  * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)
  * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)
  * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)
  * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19024" id="RHSA-2026:19024" type="rhsa" title="RHSA-2026:19024"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2920" id="CVE-2026-2920" type="cve" title="CVE-2026-2920"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2921" id="CVE-2026-2921" type="cve" title="CVE-2026-2921"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2922" id="CVE-2026-2922" type="cve" title="CVE-2026-2922"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2923" id="CVE-2026-2923" type="cve" title="CVE-2026-2923"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3082" id="CVE-2026-3082" type="cve" title="CVE-2026-3082"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3083" id="CVE-2026-3083" type="cve" title="CVE-2026-3083"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3085" id="CVE-2026-3085" type="cve" title="CVE-2026-3085"/>
      <reference href="https://bugzilla.redhat.com/2447490" id="2447490" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447492" id="2447492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447495" id="2447495" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447496" id="2447496" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447498" id="2447498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447500" id="2447500" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447503" id="2447503" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19024.html" id="ALSA-2026:19024" type="self" title="ALSA-2026:19024"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-good-gtk" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">05fb4daa526e2f8def996f3434ae2e0426eccbcbfc456af9dc6bdd3421d3b91c</sum>
        </package>
        <package name="gstreamer1-plugins-good" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">079a5b2d7ce6f510effefd399564081492ea07915619e24a3eb7caf5a61a1c6c</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2f16aae28c9a65ce4da7c0148b1e9ac8c4901b1c8821311d71914afc2f1167ee</sum>
        </package>
        <package name="gstreamer1-plugins-base-tools" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-tools-1.26.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3c83b331b3096ff7790a587ae60736f6dfdc2de75d89d2a1c383352c8fe843cd</sum>
        </package>
        <package name="gstreamer1-plugins-ugly-free" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3f635079388f5f4ec84ab4bca1735661a26c45963ee719669c169d6de58feb12</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">54c8d64c5466c52c99988aa0c365bdc1741d4a6d29816983750a1b0eb8c6cdda</sum>
        </package>
        <package name="gstreamer1-plugins-base-devel" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-devel-1.26.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cf46e744649885660d0f4eebf773b84b487622b495f3e866c13cc9af87157da6</sum>
        </package>
        <package name="gstreamer1-plugins-base" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-1.26.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e118f01f6c78ae92a6e9f577eacf9c0a3ee15aace09a7fd0fdf6a8c5d2afca80</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19031</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>skopeo security update</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.   

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19031" id="RHSA-2026:19031" type="rhsa" title="RHSA-2026:19031"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19031.html" id="ALSA-2026:19031" type="self" title="ALSA-2026:19031"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="skopeo" version="1.22.2" release="1.el10_2" epoch="2" arch="x86_64_v2" src="skopeo-1.22.2-1.el10_2.src.rpm">
          <filename>skopeo-1.22.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">22ce892bac1081d9e74cc69b8cf839c3565365005c8cf720206deef5e672fe4f</sum>
        </package>
        <package name="skopeo-tests" version="1.22.2" release="1.el10_2" epoch="2" arch="x86_64_v2" src="skopeo-1.22.2-1.el10_2.src.rpm">
          <filename>skopeo-tests-1.22.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e2bd6584427c7de874bd6c479273672db002f9ca80efb6a785d49cf72c836bbd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19032</id>
    <title>Important: buildah security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>buildah security update</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19032" id="RHSA-2026:19032" type="rhsa" title="RHSA-2026:19032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19032.html" id="ALSA-2026:19032" type="self" title="ALSA-2026:19032"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="buildah" version="1.43.1" release="1.el10_2" epoch="2" arch="x86_64_v2" src="buildah-1.43.1-1.el10_2.src.rpm">
          <filename>buildah-1.43.1-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5b23709d2d30e0b8b62baf30bc2ec626c4d9fea8aef914a297f083a7c41bc809</sum>
        </package>
        <package name="buildah-tests" version="1.43.1" release="1.el10_2" epoch="2" arch="x86_64_v2" src="buildah-1.43.1-1.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9102503e850a6d79b12bfadc1f26f1cc2cc984f67b7d1f8765cfbde37376fb9b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19034</id>
    <title>Moderate: python-tornado security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>python-tornado security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19034" id="RHSA-2026:19034" type="rhsa" title="RHSA-2026:19034"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31958" id="CVE-2026-31958" type="cve" title="CVE-2026-31958"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35536" id="CVE-2026-35536" type="cve" title="CVE-2026-35536"/>
      <reference href="https://bugzilla.redhat.com/2446765" id="2446765" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454716" id="2454716" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19034.html" id="ALSA-2026:19034" type="self" title="ALSA-2026:19034"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3-tornado" version="6.5.5" release="1.el10_2" epoch="0" arch="x86_64_v2" src="python-tornado-6.5.5-1.el10_2.src.rpm">
          <filename>python3-tornado-6.5.5-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bea5502d3a4a8cd6e8b8c5f35b98b2b05ddfd7ae7b06c436f40a10d07f929e70</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19042</id>
    <title>Low: python-jwcrypto security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>python-jwcrypto security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19042" id="RHSA-2026:19042" type="rhsa" title="RHSA-2026:19042"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39373" id="CVE-2026-39373" type="cve" title="CVE-2026-39373"/>
      <reference href="https://bugzilla.redhat.com/2456187" id="2456187" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19042.html" id="ALSA-2026:19042" type="self" title="ALSA-2026:19042"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3-jwcrypto" version="1.5.6" release="5.el10_2" epoch="0" arch="noarch" src="python-jwcrypto-1.5.6-5.el10_2.src.rpm">
          <filename>python3-jwcrypto-1.5.6-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">db89aecbcd378aa983e05761a6b2cbca01c3a05e38a708730a9029e277498a12</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19043</id>
    <title>Moderate: corosync security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-07-15 10:03:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>corosync security update</summary>
    <description>The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software.  

Security Fix(es):  

  * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)
  * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19043" id="RHSA-2026:19043" type="rhsa" title="RHSA-2026:19043"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35091" id="CVE-2026-35091" type="cve" title="CVE-2026-35091"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35092" id="CVE-2026-35092" type="cve" title="CVE-2026-35092"/>
      <reference href="https://bugzilla.redhat.com/2453813" id="2453813" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2453814" id="2453814" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19043.html" id="ALSA-2026:19043" type="self" title="ALSA-2026:19043"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="corosynclib" version="3.1.10" release="1.el10_2.1" epoch="0" arch="x86_64_v2" src="corosync-3.1.10-1.el10_2.1.src.rpm">
          <filename>corosynclib-3.1.10-1.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">17ee57c47daff63921244fd1ac9512112c6303ae2d9639170368be3d78b5ca8d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19053</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:03"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>freeipmi security update</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.  

Security Fix(es):  

  * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19053" id="RHSA-2026:19053" type="rhsa" title="RHSA-2026:19053"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33554" id="CVE-2026-33554" type="cve" title="CVE-2026-33554"/>
      <reference href="https://bugzilla.redhat.com/2450778" id="2450778" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19053.html" id="ALSA-2026:19053" type="self" title="ALSA-2026:19053"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="freeipmi" version="1.6.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-1.6.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">11abe7e8b70a75103776deeb0aed1ee64e925456c12a24ff7f9e2cf8ef64d883</sum>
        </package>
        <package name="freeipmi-bmc-watchdog" version="1.6.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-bmc-watchdog-1.6.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3f167e8c88a1dad0463784f3d230374880387722c866b59352e6f7b4f8328e16</sum>
        </package>
        <package name="freeipmi-ipmidetectd" version="1.6.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-ipmidetectd-1.6.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4b000aa3494d98fe1a95e613ed489f073c93cbfcdd0911e933084eb93814eea1</sum>
        </package>
        <package name="freeipmi-ipmiseld" version="1.6.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-ipmiseld-1.6.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5e9f089e09cdac226b339917525352f3bb0fad9c25aa474bd702518bebbb5a50</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19054</id>
    <title>Important: tomcat security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:35:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>tomcat security update</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  

Security Fix(es):  

  * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19054" id="RHSA-2026:19054" type="rhsa" title="RHSA-2026:19054"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-24734" id="CVE-2026-24734" type="cve" title="CVE-2026-24734"/>
      <reference href="https://bugzilla.redhat.com/2440426" id="2440426" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19054.html" id="ALSA-2026:19054" type="self" title="ALSA-2026:19054"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="tomcat-jsp-3.1-api" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">032f9dfd26c60d1d72b363ff2061d11662e957528f62a47531f5bbf5f865b387</sum>
        </package>
        <package name="tomcat" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">30074a00cdb2fd116e1a86d0dd4fde4c0ee1ad6c1d76871cede1af36c10ad784</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">910908c4cbeb19192b15b52ff7bcb553a79de45a9fd931d50fa458956364dc8c</sum>
        </package>
        <package name="tomcat-el-5.0-api" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">a4ea29cfcc7dc0b39309a55f0cb9f6825d1b6965da13f87f41af81d7293301e1</sum>
        </package>
        <package name="tomcat-lib" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-lib-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">bf8d00201d00c1d371bcb29fde0b79354efbec1bdd757baaebc03477a5d83d5c</sum>
        </package>
        <package name="tomcat-docs-webapp" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">cd1899698b4ef517e177bafdcbdb1e1542a1f0c867d8b7fefb87b3e46b4b54bf</sum>
        </package>
        <package name="tomcat-admin-webapps" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">d5a2b5453e34039aa491637abe23194a845e0a52cb69be855ed09fbc360ed9f7</sum>
        </package>
        <package name="tomcat-webapps" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">fdbfa914a61bc11297a055cca8ba8bb8c9d37d90b771583e8b8b87d3a7a388c7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19061</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:32:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
  * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19061" id="RHSA-2026:19061" type="rhsa" title="RHSA-2026:19061"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4437" id="CVE-2026-4437" type="cve" title="CVE-2026-4437"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4438" id="CVE-2026-4438" type="cve" title="CVE-2026-4438"/>
      <reference href="https://bugzilla.redhat.com/2449777" id="2449777" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449783" id="2449783" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19061.html" id="ALSA-2026:19061" type="self" title="ALSA-2026:19061"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="glibc-devel" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-devel-2.39-121.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">8be98c9aafc5821e95fa4698b9107de09395e7050cee56ae6ab7b3da0f42853c</sum>
        </package>
        <package name="glibc-doc" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-121.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8e5944044c77883ffcdf699a95b72c6bb5ec1b40fe769362ba84948c5c446f4b</sum>
        </package>
        <package name="glibc-locale-source" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-locale-source-2.39-121.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">a692935d8532102554624b8d9dd18c6130b00cae6388eca094766a3502b31886</sum>
        </package>
        <package name="glibc-utils" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-utils-2.39-121.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">bc654b95d179f741bbc4792f4acc4e0614d885fe8c37b1f177232c61ac3ae021</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19064</id>
    <title>Important: python3.12 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:31:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.12 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
  * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
  * cpython: Out-of-memory when loading Plist (CVE-2025-13837)
  * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
  * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19064" id="RHSA-2026:19064" type="rhsa" title="RHSA-2026:19064"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13837" id="CVE-2025-13837" type="cve" title="CVE-2025-13837"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-15282" id="CVE-2025-15282" type="cve" title="CVE-2025-15282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-59375" id="CVE-2025-59375" type="cve" title="CVE-2025-59375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-6075" id="CVE-2025-6075" type="cve" title="CVE-2025-6075"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0672" id="CVE-2026-0672" type="cve" title="CVE-2026-0672"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100"/>
      <reference href="https://bugzilla.redhat.com/2395108" id="2395108" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2408891" id="2408891" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2418084" id="2418084" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431366" id="2431366" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431374" id="2431374" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2444691" id="2444691" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448168" id="2448168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448181" id="2448181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449649" id="2449649" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457409" id="2457409" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457932" id="2457932" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19064.html" id="ALSA-2026:19064" type="self" title="ALSA-2026:19064"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3-devel" version="3.12.13" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-devel-3.12.13-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b8aa7df344fb9b23bc17a7c697be1e13768bd64e7a4029707b3a824e7c991dd3</sum>
        </package>
        <package name="python3-tkinter" version="3.12.13" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-tkinter-3.12.13-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c6df14d5ea25e992133a20060acec79aaf78d58234a59fd0ded0ae959768918f</sum>
        </package>
        <package name="python-unversioned-command" version="3.12.13" release="2.el10_2" epoch="0" arch="noarch" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python-unversioned-command-3.12.13-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">e02dd9af1061d81e9eb4f3b2ab2cee1f8bcaa3917c0c834b9885fbcb4199da2e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19066</id>
    <title>Moderate: openssl security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>openssl security update</summary>
    <description>OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  

Security Fix(es):  

  * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19066" id="RHSA-2026:19066" type="rhsa" title="RHSA-2026:19066"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31790" id="CVE-2026-31790" type="cve" title="CVE-2026-31790"/>
      <reference href="https://bugzilla.redhat.com/2451094" id="2451094" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19066.html" id="ALSA-2026:19066" type="self" title="ALSA-2026:19066"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="openssl-devel" version="3.5.5" release="2.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="openssl-3.5.5-2.el10_2.alma.1.src.rpm">
          <filename>openssl-devel-3.5.5-2.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7117bdb32a1ac4b2bbd9f4ed763a0bad1665adb280bff069db692e3162a8a4ce</sum>
        </package>
        <package name="openssl-perl" version="3.5.5" release="2.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="openssl-3.5.5-2.el10_2.alma.1.src.rpm">
          <filename>openssl-perl-3.5.5-2.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">75800a58b76fda5d620342d71f95738c37917adce8d4b6a426cb0f5647295103</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19067</id>
    <title>Important: sudo security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:16"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>sudo security update</summary>
    <description>The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.  

Security Fix(es):  

  * sudo: Sudo: Privilege escalation due to failure in privilege drop calls (CVE-2026-35535)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19067" id="RHSA-2026:19067" type="rhsa" title="RHSA-2026:19067"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35535" id="CVE-2026-35535" type="cve" title="CVE-2026-35535"/>
      <reference href="https://bugzilla.redhat.com/2454714" id="2454714" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19067.html" id="ALSA-2026:19067" type="self" title="ALSA-2026:19067"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="sudo-python-plugin" version="1.9.17" release="4.p2.el10_2" epoch="0" arch="x86_64_v2" src="sudo-1.9.17-4.p2.el10_2.src.rpm">
          <filename>sudo-python-plugin-1.9.17-4.p2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0abb22dcf96ee2b8b611f5fadcbcea46256f8ee359cc50ce4faf885c585cbe47</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19068</id>
    <title>Moderate: systemd security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:32:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>systemd security update</summary>
    <description>The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.  

Security Fix(es):  

  * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19068" id="RHSA-2026:19068" type="rhsa" title="RHSA-2026:19068"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29111" id="CVE-2026-29111" type="cve" title="CVE-2026-29111"/>
      <reference href="https://bugzilla.redhat.com/2450505" id="2450505" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19068.html" id="ALSA-2026:19068" type="self" title="ALSA-2026:19068"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="systemd-journal-remote" version="257" release="23.el10_2.1.alma.1" epoch="0" arch="x86_64_v2" src="systemd-257-23.el10_2.1.alma.1.src.rpm">
          <filename>systemd-journal-remote-257-23.el10_2.1.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">356d7a452d70e45b740c4a1e5b8fbe89dd75fe05eb826e23f71537ac1533c7ee</sum>
        </package>
        <package name="systemd-devel" version="257" release="23.el10_2.1.alma.1" epoch="0" arch="x86_64_v2" src="systemd-257-23.el10_2.1.alma.1.src.rpm">
          <filename>systemd-devel-257-23.el10_2.1.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4c5eee654c38d21a85e5af20e90a0981f1f82e835f69df11a85e7cd7bea195fc</sum>
        </package>
        <package name="systemd-ukify" version="257" release="23.el10_2.1.alma.1" epoch="0" arch="noarch" src="systemd-257-23.el10_2.1.alma.1.src.rpm">
          <filename>systemd-ukify-257-23.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">b19a2e5d5ceb000880e9a0b2e332123c6cc5f6052003d8b27a6230bc528bca3a</sum>
        </package>
        <package name="systemd-boot-unsigned" version="257" release="23.el10_2.1.alma.1" epoch="0" arch="x86_64_v2" src="systemd-257-23.el10_2.1.alma.1.src.rpm">
          <filename>systemd-boot-unsigned-257-23.el10_2.1.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">e490055e1d79491d0c4aacfec462b9223ceefc254460644cb4ad36e59a0bc68a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19069</id>
    <title>Important: openssh security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>openssh security update</summary>
    <description>OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.  

Security Fix(es):  

  * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode (CVE-2026-35385)
  * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414)
  * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage (CVE-2026-35387)
  * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388)
  * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19069" id="RHSA-2026:19069" type="rhsa" title="RHSA-2026:19069"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35385" id="CVE-2026-35385" type="cve" title="CVE-2026-35385"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35386" id="CVE-2026-35386" type="cve" title="CVE-2026-35386"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35387" id="CVE-2026-35387" type="cve" title="CVE-2026-35387"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35388" id="CVE-2026-35388" type="cve" title="CVE-2026-35388"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35414" id="CVE-2026-35414" type="cve" title="CVE-2026-35414"/>
      <reference href="https://bugzilla.redhat.com/2454469" id="2454469" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454490" id="2454490" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454494" id="2454494" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454500" id="2454500" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454506" id="2454506" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19069.html" id="ALSA-2026:19069" type="self" title="ALSA-2026:19069"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="openssh-keysign" version="9.9p1" release="23.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="openssh-9.9p1-23.el10_2.alma.1.src.rpm">
          <filename>openssh-keysign-9.9p1-23.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">3fc9b59ddd441f622f309df757effaedda010563a8532d14b07aa3aa6537adc3</sum>
        </package>
        <package name="openssh-askpass" version="9.9p1" release="23.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="openssh-9.9p1-23.el10_2.alma.1.src.rpm">
          <filename>openssh-askpass-9.9p1-23.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">f136b16d1e75c696e4b68eeebe1824cfceb2e307ec6e6c7ba64c36fe7d834d2c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19073</id>
    <title>Important: vim security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>vim security update</summary>
    <description>Vim (Vi IMproved) is an updated and improved version of the vi editor.  

Security Fix(es):  

  * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19073" id="RHSA-2026:19073" type="rhsa" title="RHSA-2026:19073"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34982" id="CVE-2026-34982" type="cve" title="CVE-2026-34982"/>
      <reference href="https://bugzilla.redhat.com/2455400" id="2455400" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19073.html" id="ALSA-2026:19073" type="self" title="ALSA-2026:19073"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="vim-enhanced" version="9.1.083" release="9.el10_2.2" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.2.src.rpm">
          <filename>vim-enhanced-9.1.083-9.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">17b2e3f71b4466650cb429d146f6d33625570c58dd8035e5e5b51e5f885796ff</sum>
        </package>
        <package name="vim-X11" version="9.1.083" release="9.el10_2.2" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.2.src.rpm">
          <filename>vim-X11-9.1.083-9.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">26c24dc3a0ff352c03f4a1e4530e33bf0cddec338b2e9f70b924948c082c1924</sum>
        </package>
        <package name="xxd" version="9.1.083" release="9.el10_2.2" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.2.src.rpm">
          <filename>xxd-9.1.083-9.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">3d7c10ae913642e981a6b3b96ce8c705140c4bf3664395a70380161facf3386c</sum>
        </package>
        <package name="vim-common" version="9.1.083" release="9.el10_2.2" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.2.src.rpm">
          <filename>vim-common-9.1.083-9.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">701e0c2297f9a2d5e73878c3512d3c8600d02b4e6c1b7879e95fe4e433d85984</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19074</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060)
  * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
  * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677)
  * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19074" id="RHSA-2026:19074" type="rhsa" title="RHSA-2026:19074"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23060" id="CVE-2026-23060" type="cve" title="CVE-2026-23060"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31431" id="CVE-2026-31431" type="cve" title="CVE-2026-31431"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31677" id="CVE-2026-31677" type="cve" title="CVE-2026-31677"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43284" id="CVE-2026-43284" type="cve" title="CVE-2026-43284"/>
      <reference href="https://bugzilla.redhat.com/2436779" id="2436779" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460538" id="2460538" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461763" id="2461763" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467771" id="2467771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19074.html" id="ALSA-2026:19074" type="self" title="ALSA-2026:19074"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1f263b09b42f0520a940adea1f9bf4e42e535333e235572c93122675a494ac94</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.7.3.el10_2.noarch.rpm</filename>
          <sum type="sha256">2a68239ba7e1ffded8f59859942aad0efdfdc10912c47834975a6dd22a799961</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5e15729277ff817a05f78347a94986405e5e76c31d3daa2a945b9830d7d499e8</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6dc7b53addd96547b8ee126b404509bf77b1a294b66be39667389ac9f8f16d51</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7b55e864e4aec1a2b81c9c6548da00244fd729637ca88cef45ee2ba47ca40115</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>rv-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9c1f739e46056b4d3554ee9e50ac5b436317835655e2a41576503f435853f730</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bcf48755998f5cb685c82328ac7549df280eae21653fc74ed8d1a7fc7baea01a</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d83dd9adca309ff97b38e7079bd58390ebf5214513402ad371203fef7c58c452</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fc67748170c3df2df79c34da766de5b447580039c00ff566e50d5adc903a1d1b</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>perf-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ff3fd04df78e7e54bb5d10cb5643d54bee8e866f429e65edc76d45e123c3c0ef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19125</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>xorg-x11-server-Xwayland security update</summary>
    <description>Xwayland is an X server for running X clients under Wayland.  

Security Fix(es):  

  * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)
  * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)
  * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19125" id="RHSA-2026:19125" type="rhsa" title="RHSA-2026:19125"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33999" id="CVE-2026-33999" type="cve" title="CVE-2026-33999"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34001" id="CVE-2026-34001" type="cve" title="CVE-2026-34001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34003" id="CVE-2026-34003" type="cve" title="CVE-2026-34003"/>
      <reference href="https://bugzilla.redhat.com/2451106" id="2451106" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451109" id="2451109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451113" id="2451113" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19125.html" id="ALSA-2026:19125" type="self" title="ALSA-2026:19125"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="xorg-x11-server-Xwayland" version="24.1.9" release="4.el10_2" epoch="0" arch="x86_64_v2" src="xorg-x11-server-Xwayland-24.1.9-4.el10_2.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.9-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">302413288f34cab4a43831abfdbac21da6eb362a5ddf1cbfefee3a16a1b33dfc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19126</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>yggdrasil security update</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19126" id="RHSA-2026:19126" type="rhsa" title="RHSA-2026:19126"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19126.html" id="ALSA-2026:19126" type="self" title="ALSA-2026:19126"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="yggdrasil" version="0.4.9" release="4.el10_2" epoch="0" arch="x86_64_v2" src="yggdrasil-0.4.9-4.el10_2.src.rpm">
          <filename>yggdrasil-0.4.9-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6d92390290fa04bac5b04eaa245c071f8800a49cc79f5332179c1db341a4a6e9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19127</id>
    <title>Important: gdk-pixbuf2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:29:29"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gdk-pixbuf2 security update</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.  

Security Fix(es):  

  * gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19127" id="RHSA-2026:19127" type="rhsa" title="RHSA-2026:19127"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5201" id="CVE-2026-5201" type="cve" title="CVE-2026-5201"/>
      <reference href="https://bugzilla.redhat.com/2453291" id="2453291" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19127.html" id="ALSA-2026:19127" type="self" title="ALSA-2026:19127"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gdk-pixbuf2-modules" version="2.42.12" release="4.el10_2.5" epoch="0" arch="x86_64_v2" src="gdk-pixbuf2-2.42.12-4.el10_2.5.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">94027679f070a2e650981b38205752e7d999ae64ae5b7c241f2a7e2dc5f50ea8</sum>
        </package>
        <package name="gdk-pixbuf2-devel" version="2.42.12" release="4.el10_2.5" epoch="0" arch="x86_64_v2" src="gdk-pixbuf2-2.42.12-4.el10_2.5.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">a1bf0321a8580c443644ed6a67368305a1f206b113fc90a44cead4479d5cc81a</sum>
        </package>
        <package name="gdk-pixbuf2" version="2.42.12" release="4.el10_2.5" epoch="0" arch="x86_64_v2" src="gdk-pixbuf2-2.42.12-4.el10_2.5.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">f655018f75604e387b6120e0860892c54325460d3db46e3de0023275ec122cc6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19128</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>yggdrasil-worker-package-manager security update</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19128" id="RHSA-2026:19128" type="rhsa" title="RHSA-2026:19128"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19128.html" id="ALSA-2026:19128" type="self" title="ALSA-2026:19128"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="yggdrasil-worker-package-manager" version="0.2.3" release="6.el10_2" epoch="0" arch="x86_64_v2" src="yggdrasil-worker-package-manager-0.2.3-6.el10_2.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-6.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ac83c67038b6479c4009afc0e356a8d27a9124ad9b560eff09c4ed37d8a54b6b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19130</id>
    <title>Important: libcap security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libcap security update</summary>
    <description>Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.  

Security Fix(es):  

  * libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19130" id="RHSA-2026:19130" type="rhsa" title="RHSA-2026:19130"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4878" id="CVE-2026-4878" type="cve" title="CVE-2026-4878"/>
      <reference href="https://bugzilla.redhat.com/2451615" id="2451615" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19130.html" id="ALSA-2026:19130" type="self" title="ALSA-2026:19130"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libcap-devel" version="2.69" release="7.el10_2.1" epoch="0" arch="x86_64_v2" src="libcap-2.69-7.el10_2.1.src.rpm">
          <filename>libcap-devel-2.69-7.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">33b89e4ac6354b8a8d7e0eec840369b7e3e46737559590c75fa49af49bad5ee3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19133</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>git-lfs security update</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19133" id="RHSA-2026:19133" type="rhsa" title="RHSA-2026:19133"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19133.html" id="ALSA-2026:19133" type="self" title="ALSA-2026:19133"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="git-lfs" version="3.7.1" release="4.el10_2" epoch="0" arch="x86_64_v2" src="git-lfs-3.7.1-4.el10_2.src.rpm">
          <filename>git-lfs-3.7.1-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6f952bb274fbbf2a2348d8534cc78798af01a689ccffbf7551a1e696d53b827b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19134</id>
    <title>Important: grafana security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:49"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>grafana security update</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.   

Security Fix(es):  

  * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)
  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19134" id="RHSA-2026:19134" type="rhsa" title="RHSA-2026:19134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27877" id="CVE-2026-27877" type="cve" title="CVE-2026-27877"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2452293" id="2452293" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19134.html" id="ALSA-2026:19134" type="self" title="ALSA-2026:19134"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="grafana" version="10.2.6" release="26.el10_2" epoch="0" arch="x86_64_v2" src="grafana-10.2.6-26.el10_2.src.rpm">
          <filename>grafana-10.2.6-26.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4e1aea0e082a2ee9f583d30458b6767031c90656a8ad111f8feda9ce90e0737c</sum>
        </package>
        <package name="grafana-selinux" version="10.2.6" release="26.el10_2" epoch="0" arch="x86_64_v2" src="grafana-10.2.6-26.el10_2.src.rpm">
          <filename>grafana-selinux-10.2.6-26.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">931d29261e589b6c4de4c8f822007b79ce585b85ab301f5f256752fa127eaa03</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19135</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>opentelemetry-collector security update</summary>
    <description>Collector with the supported components for a AlmaLinux build of OpenTelemetry  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
  * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19135" id="RHSA-2026:19135" type="rhsa" title="RHSA-2026:19135"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33186" id="CVE-2026-33186" type="cve" title="CVE-2026-33186"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33810" id="CVE-2026-33810" type="cve" title="CVE-2026-33810"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449833" id="2449833" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455470" id="2455470" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456335" id="2456335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19135.html" id="ALSA-2026:19135" type="self" title="ALSA-2026:19135"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="opentelemetry-collector" version="0.144.0" release="2.el10_2" epoch="0" arch="x86_64_v2" src="opentelemetry-collector-0.144.0-2.el10_2.src.rpm">
          <filename>opentelemetry-collector-0.144.0-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2caffaf5a9e42f65dbc49470bce17fc45cc341182559ec73f403bbc2050038f8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19136</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>grafana-pcp security update</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.  

Security Fix(es):  

  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19136" id="RHSA-2026:19136" type="rhsa" title="RHSA-2026:19136"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19136.html" id="ALSA-2026:19136" type="self" title="ALSA-2026:19136"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="grafana-pcp" version="5.3.0" release="5.el10_2" epoch="0" arch="x86_64_v2" src="grafana-pcp-5.3.0-5.el10_2.src.rpm">
          <filename>grafana-pcp-5.3.0-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">32a7a49ede63c19d91534417992f120b8dd43332a018f82fc1405a637805cc88</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19137</id>
    <title>Important: go-fdo-server security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>go-fdo-server security update</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.  

Security Fix(es):  

  * github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19137" id="RHSA-2026:19137" type="rhsa" title="RHSA-2026:19137"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33816" id="CVE-2026-33816" type="cve" title="CVE-2026-33816"/>
      <reference href="https://bugzilla.redhat.com/2455972" id="2455972" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19137.html" id="ALSA-2026:19137" type="self" title="ALSA-2026:19137"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="go-fdo-server-rendezvous" version="1.0.1" release="1.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">2f723b54c36ddf004e4bea960e425128bf2d983f8a3113e157997f07bad4fa7a</sum>
        </package>
        <package name="go-fdo-server-owner" version="1.0.1" release="1.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">4fdde5d0f325c9777d1a0493b93f5f958290c8b3b8c46095516d2e7e8ea2d03e</sum>
        </package>
        <package name="go-fdo-server-manufacturer" version="1.0.1" release="1.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">503719bae2e16f1ef8bfb6389d8210cb55c14a40a4f7f7f00e40c82bfd1f8095</sum>
        </package>
        <package name="go-fdo-server" version="1.0.1" release="1.el10_2" epoch="0" arch="x86_64_v2" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-1.0.1-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">69a0191d7f1f7afd0e75e34877711add0ace146c613e15b094231ecf3a9c0d94</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19139</id>
    <title>Important: go-fdo-client security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>go-fdo-client security update</summary>
    <description>go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.  

Security Fix(es):  

  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19139" id="RHSA-2026:19139" type="rhsa" title="RHSA-2026:19139"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19139.html" id="ALSA-2026:19139" type="self" title="ALSA-2026:19139"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="go-fdo-client" version="1.0.0" release="3.el10_2" epoch="0" arch="x86_64_v2" src="go-fdo-client-1.0.0-3.el10_2.src.rpm">
          <filename>go-fdo-client-1.0.0-3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e3f991b9f7b5801995ef4a0b563eb0ad6c7e3700c4ad2513296a552088f65cf7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19141</id>
    <title>Important: PackageKit security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>PackageKit security update</summary>
    <description>PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.  

Security Fix(es):  

  * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19141" id="RHSA-2026:19141" type="rhsa" title="RHSA-2026:19141"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41651" id="CVE-2026-41651" type="cve" title="CVE-2026-41651"/>
      <reference href="https://bugzilla.redhat.com/2460604" id="2460604" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19141.html" id="ALSA-2026:19141" type="self" title="ALSA-2026:19141"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="PackageKit-gstreamer-plugin" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64_v2" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-gstreamer-plugin-1.2.8-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">089c70ff772f35e73a5da2414a5fba96bd1cac68b488d9272dcf5beb43f2345d</sum>
        </package>
        <package name="PackageKit" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64_v2" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-1.2.8-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">161f3e2cf9ebc73aae69ef5254a2d3d65f0401a6c4ed872e22a40e888da74f6b</sum>
        </package>
        <package name="PackageKit-command-not-found" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64_v2" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-command-not-found-1.2.8-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1c382fd1d22ab7791a2c059670d787a71921fb102e478f1187193544fdaf14cb</sum>
        </package>
        <package name="PackageKit-glib" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64_v2" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-glib-1.2.8-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5b452912b1feb48d85e8c48d7f65a84c2023c1e9386132068249a5279e28f70c</sum>
        </package>
        <package name="PackageKit-gtk3-module" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64_v2" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-gtk3-module-1.2.8-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bd2cafb29dc93095bda855f8f0d5482e0ea62617fde534061283086f014a3080</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19143</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:51"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libsoup3 security update</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.  

Security Fix(es):  

  * libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)
  * libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19143" id="RHSA-2026:19143" type="rhsa" title="RHSA-2026:19143"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4271" id="CVE-2026-4271" type="cve" title="CVE-2026-4271"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5119" id="CVE-2026-5119" type="cve" title="CVE-2026-5119"/>
      <reference href="https://bugzilla.redhat.com/2448044" id="2448044" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452932" id="2452932" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19143.html" id="ALSA-2026:19143" type="self" title="ALSA-2026:19143"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libsoup3-devel" version="3.6.5" release="3.el10_2.11" epoch="0" arch="x86_64_v2" src="libsoup3-3.6.5-3.el10_2.11.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_2.11.x86_64_v2.rpm</filename>
          <sum type="sha256">28788897ff445bb5456a22517cb78a388ac21ee0d8101ac3796d25e830d566b6</sum>
        </package>
        <package name="libsoup3" version="3.6.5" release="3.el10_2.11" epoch="0" arch="x86_64_v2" src="libsoup3-3.6.5-3.el10_2.11.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_2.11.x86_64_v2.rpm</filename>
          <sum type="sha256">51f68826da83aadb59fee2dfde1e436f0f39b894d5ff3cc881b8cb4e98812dc5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19145</id>
    <title>Important: krb5 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>krb5 security update</summary>
    <description>Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).  

Security Fix(es):  

  * krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356)
  * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19145" id="RHSA-2026:19145" type="rhsa" title="RHSA-2026:19145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40355" id="CVE-2026-40355" type="cve" title="CVE-2026-40355"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40356" id="CVE-2026-40356" type="cve" title="CVE-2026-40356"/>
      <reference href="https://bugzilla.redhat.com/2463368" id="2463368" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463370" id="2463370" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19145.html" id="ALSA-2026:19145" type="self" title="ALSA-2026:19145"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="krb5-devel" version="1.21.3" release="10.el10_2" epoch="0" arch="x86_64_v2" src="krb5-1.21.3-10.el10_2.src.rpm">
          <filename>krb5-devel-1.21.3-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8f3c574a5d5fdfce6a2b6942cd48c9268a8882f0ac2d18f7976b3aa6b42fbe11</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19146</id>
    <title>Important: openexr security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-07-08 11:53:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>openexr security update</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.  

Security Fix(es):  

  * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19146" id="RHSA-2026:19146" type="rhsa" title="RHSA-2026:19146"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34588" id="CVE-2026-34588" type="cve" title="CVE-2026-34588"/>
      <reference href="https://bugzilla.redhat.com/2455408" id="2455408" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19146.html" id="ALSA-2026:19146" type="self" title="ALSA-2026:19146"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="openexr-libs" version="3.1.10" release="8.el10_2.2" epoch="0" arch="x86_64_v2" src="openexr-3.1.10-8.el10_2.2.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">63beb42f147f49166833de48ab3350ae290b4d9b653a442e154c7f9e5fbea851</sum>
        </package>
        <package name="openexr" version="3.1.10" release="8.el10_2.2" epoch="0" arch="x86_64_v2" src="openexr-3.1.10-8.el10_2.2.src.rpm">
          <filename>openexr-3.1.10-8.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">8ee194ffadd7d97764d6c2369e3f33fee73da13d159b649b77af9ce8520f2f32</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19148</id>
    <title>Moderate: glib2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glib2 security update</summary>
    <description>GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.  

Security Fix(es):  

  * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087)
  * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19148" id="RHSA-2026:19148" type="rhsa" title="RHSA-2026:19148"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-14087" id="CVE-2025-14087" type="cve" title="CVE-2025-14087"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-14512" id="CVE-2025-14512" type="cve" title="CVE-2025-14512"/>
      <reference href="https://bugzilla.redhat.com/2419093" id="2419093" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2421339" id="2421339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19148.html" id="ALSA-2026:19148" type="self" title="ALSA-2026:19148"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="glib2-devel" version="2.80.4" release="12.el10_2.13" epoch="0" arch="x86_64_v2" src="glib2-2.80.4-12.el10_2.13.src.rpm">
          <filename>glib2-devel-2.80.4-12.el10_2.13.x86_64_v2.rpm</filename>
          <sum type="sha256">ca379d299abb3eb2fe75f13b1366aabd7ced3a9c7f5b1563b0fa00334ae6e79a</sum>
        </package>
        <package name="glib2-tests" version="2.80.4" release="12.el10_2.13" epoch="0" arch="x86_64_v2" src="glib2-2.80.4-12.el10_2.13.src.rpm">
          <filename>glib2-tests-2.80.4-12.el10_2.13.x86_64_v2.rpm</filename>
          <sum type="sha256">fe31b1ab9e4807a235ea74e90176b51101bde52dc472537ac94083b59f50ca1e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19149</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dovecot security update</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   

Security Fix(es):  

  * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)
  * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)
  * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19149" id="RHSA-2026:19149" type="rhsa" title="RHSA-2026:19149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-59032" id="CVE-2025-59032" type="cve" title="CVE-2025-59032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27857" id="CVE-2026-27857" type="cve" title="CVE-2026-27857"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27858" id="CVE-2026-27858" type="cve" title="CVE-2026-27858"/>
      <reference href="https://bugzilla.redhat.com/2452172" id="2452172" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452175" id="2452175" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452179" id="2452179" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19149.html" id="ALSA-2026:19149" type="self" title="ALSA-2026:19149"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dovecot-pigeonhole" version="2.3.21" release="19.el10_2" epoch="1" arch="x86_64_v2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-pigeonhole-2.3.21-19.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0a5e14d6751fcdd9c7a1c920d8ec232d5dd3fe2851a7d916f558d9a91e41eede</sum>
        </package>
        <package name="dovecot-mysql" version="2.3.21" release="19.el10_2" epoch="1" arch="x86_64_v2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-mysql-2.3.21-19.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6a912f985dfdd03fe7d5b6a1f7680b7a3a9d06aada4cab6d2d26362e992270a6</sum>
        </package>
        <package name="dovecot" version="2.3.21" release="19.el10_2" epoch="1" arch="x86_64_v2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-2.3.21-19.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7e54619b20d6af85681ae3204ac245fcce7ed87f9388325939d7dd0bfd57fd84</sum>
        </package>
        <package name="dovecot-pgsql" version="2.3.21" release="19.el10_2" epoch="1" arch="x86_64_v2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-pgsql-2.3.21-19.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8c8614e66f4962e66255fbbdc55a710f5b4f99ed22c420eb44c8a1e0b5226636</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19150</id>
    <title>Important: libtiff security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:53"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libtiff security update</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.  

Security Fix(es):  

  * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19150" id="RHSA-2026:19150" type="rhsa" title="RHSA-2026:19150"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4775" id="CVE-2026-4775" type="cve" title="CVE-2026-4775"/>
      <reference href="https://bugzilla.redhat.com/2450768" id="2450768" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19150.html" id="ALSA-2026:19150" type="self" title="ALSA-2026:19150"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libtiff-devel" version="4.6.0" release="8.el10_2.1" epoch="0" arch="x86_64_v2" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-devel-4.6.0-8.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">00c123814daea26b3f4318f314107abb546e83a4cd48a1b0d890a555405db637</sum>
        </package>
        <package name="libtiff" version="4.6.0" release="8.el10_2.1" epoch="0" arch="x86_64_v2" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-4.6.0-8.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">d9cab33948be4871f7b343b96277be3f2f8c7e105d89979df58a4d1afcbc8b8e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19152</id>
    <title>Important: rsync security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>rsync security update</summary>
    <description>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  

Security Fix(es):  

  * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19152" id="RHSA-2026:19152" type="rhsa" title="RHSA-2026:19152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41035" id="CVE-2026-41035" type="cve" title="CVE-2026-41035"/>
      <reference href="https://bugzilla.redhat.com/2458898" id="2458898" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19152.html" id="ALSA-2026:19152" type="self" title="ALSA-2026:19152"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="rsync-rrsync" version="3.4.1" release="6.el10_2" epoch="0" arch="noarch" src="rsync-3.4.1-6.el10_2.src.rpm">
          <filename>rsync-rrsync-3.4.1-6.el10_2.noarch.rpm</filename>
          <sum type="sha256">6ce73c87a6758941f9efbd47f3a5dd2a2ea31d8602fe86d9b50d137c2939e69a</sum>
        </package>
        <package name="rsync-daemon" version="3.4.1" release="6.el10_2" epoch="0" arch="noarch" src="rsync-3.4.1-6.el10_2.src.rpm">
          <filename>rsync-daemon-3.4.1-6.el10_2.noarch.rpm</filename>
          <sum type="sha256">9f76d6a1f61310d5e7fb2cad97fccf750d8a2777db08a53fec77160350cf917f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19153</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>thunderbird security update</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.  

Security Fix(es):  

  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)
  * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)
  * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)
  * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19153" id="RHSA-2026:19153" type="rhsa" title="RHSA-2026:19153"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7320" id="CVE-2026-7320" type="cve" title="CVE-2026-7320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7321" id="CVE-2026-7321" type="cve" title="CVE-2026-7321"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7322" id="CVE-2026-7322" type="cve" title="CVE-2026-7322"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7323" id="CVE-2026-7323" type="cve" title="CVE-2026-7323"/>
      <reference href="https://bugzilla.redhat.com/2463481" id="2463481" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463483" id="2463483" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463484" id="2463484" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463485" id="2463485" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19153.html" id="ALSA-2026:19153" type="self" title="ALSA-2026:19153"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="thunderbird" version="140.10.1" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="thunderbird-140.10.1-1.el10_2.alma.1.src.rpm">
          <filename>thunderbird-140.10.1-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">270dd24db823f03037431ca137f5efb3326c30892568b0ffce6ffddf678ad21d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19154</id>
    <title>Important: giflib security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>giflib security update</summary>
    <description>giflib is a library for reading and writing gif images.  

Security Fix(es):  

  * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19154" id="RHSA-2026:19154" type="rhsa" title="RHSA-2026:19154"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23868" id="CVE-2026-23868" type="cve" title="CVE-2026-23868"/>
      <reference href="https://bugzilla.redhat.com/2446207" id="2446207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19154.html" id="ALSA-2026:19154" type="self" title="ALSA-2026:19154"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="giflib" version="5.2.1" release="24.el10_2" epoch="0" arch="x86_64_v2" src="giflib-5.2.1-24.el10_2.src.rpm">
          <filename>giflib-5.2.1-24.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c9dedb41f5e93fed563f0c59ba322b21f502ed42e2e0ae71059b89ac7ca71227</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19157</id>
    <title>Important: firefox security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)
  * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)
  * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)
  * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19157" id="RHSA-2026:19157" type="rhsa" title="RHSA-2026:19157"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7320" id="CVE-2026-7320" type="cve" title="CVE-2026-7320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7321" id="CVE-2026-7321" type="cve" title="CVE-2026-7321"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7322" id="CVE-2026-7322" type="cve" title="CVE-2026-7322"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7323" id="CVE-2026-7323" type="cve" title="CVE-2026-7323"/>
      <reference href="https://bugzilla.redhat.com/2463481" id="2463481" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463483" id="2463483" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463484" id="2463484" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463485" id="2463485" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19157.html" id="ALSA-2026:19157" type="self" title="ALSA-2026:19157"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.10.1" release="1.el10_2" epoch="0" arch="x86_64_v2" src="firefox-140.10.1-1.el10_2.src.rpm">
          <filename>firefox-140.10.1-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8666329d0f776fd472e9bd4004be34431ef5d61a4268c4c8fabfad608512a711</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19158</id>
    <title>Important: dnsmasq security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dnsmasq security update</summary>
    <description>The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.  

Security Fix(es):  

  * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)
  * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)
  * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)
  * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)
  * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)
  * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19158" id="RHSA-2026:19158" type="rhsa" title="RHSA-2026:19158"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2291" id="CVE-2026-2291" type="cve" title="CVE-2026-2291"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4890" id="CVE-2026-4890" type="cve" title="CVE-2026-4890"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4891" id="CVE-2026-4891" type="cve" title="CVE-2026-4891"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4892" id="CVE-2026-4892" type="cve" title="CVE-2026-4892"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4893" id="CVE-2026-4893" type="cve" title="CVE-2026-4893"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5172" id="CVE-2026-5172" type="cve" title="CVE-2026-5172"/>
      <reference href="https://bugzilla.redhat.com/2439088" id="2439088" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458516" id="2458516" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458517" id="2458517" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458518" id="2458518" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458519" id="2458519" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458521" id="2458521" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19158.html" id="ALSA-2026:19158" type="self" title="ALSA-2026:19158"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dnsmasq-utils" version="2.90" release="7.el10_2" epoch="0" arch="x86_64_v2" src="dnsmasq-2.90-7.el10_2.src.rpm">
          <filename>dnsmasq-utils-2.90-7.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7ea1c08a8a2899546d9f7cfd932a93daaefc402f608973a58c4aaef733f0a656</sum>
        </package>
        <package name="dnsmasq" version="2.90" release="7.el10_2" epoch="0" arch="x86_64_v2" src="dnsmasq-2.90-7.el10_2.src.rpm">
          <filename>dnsmasq-2.90-7.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">956813393855e1b4e6dec4c9918a27556c20743ced8c07d5b3ca57d1082dfe5b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19159</id>
    <title>Critical: nginx security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19159" id="RHSA-2026:19159" type="rhsa" title="RHSA-2026:19159"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42945" id="CVE-2026-42945" type="cve" title="CVE-2026-42945"/>
      <reference href="https://bugzilla.redhat.com/2477116" id="2477116" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19159.html" id="ALSA-2026:19159" type="self" title="ALSA-2026:19159"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nginx-core" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">36157ea94e24b86d2d98a0dfac4c323b78c7ea29bceeeae7055be48a2e6e0d80</sum>
        </package>
        <package name="nginx-all-modules" version="1.26.3" release="6.el10_2.3" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">3f0c16ba9b852a8917cd5d6999e2c127f547446efc3c0f2cf3c5eefc43e389c4</sum>
        </package>
        <package name="nginx-mod-stream" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">879cb972e6f98b6f8f8b9800dadde35dd95d6b7a46a44c0e0ec5b1d26d8df983</sum>
        </package>
        <package name="nginx-filesystem" version="1.26.3" release="6.el10_2.3" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">8890f406349040013ca50201c62964d631bbd50b288c439c5ab1bfd5bafc9330</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">8bf20507eefd0019dc32824fead4a06f07016650c5e74d65b09bc5e0d228ccb1</sum>
        </package>
        <package name="nginx-mod-http-perl" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">95df441855d06ef0b2724898e05d6d48a036e9849b07719edaab3e834f2b57e5</sum>
        </package>
        <package name="nginx-mod-mail" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">b6bad52be69cfc3f3c811f0b3a3432b5f1c85072908b55ebf25c086892de6dc1</sum>
        </package>
        <package name="nginx" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">b990dc8183711a5f3559a8583ecd59fa2564ee13133a83dd4e959db4e711d986</sum>
        </package>
        <package name="nginx-mod-http-image-filter" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">f31dcbd57f05a250a8f3c66d477a2ec9b1bb1644ff8c6ca9aa8ce23749b1fdc7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19160</id>
    <title>Important: firefox security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: Other issue in the WebRTC component (CVE-2026-8094)
  * firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092)
  * firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19160" id="RHSA-2026:19160" type="rhsa" title="RHSA-2026:19160"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8090" id="CVE-2026-8090" type="cve" title="CVE-2026-8090"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8092" id="CVE-2026-8092" type="cve" title="CVE-2026-8092"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8094" id="CVE-2026-8094" type="cve" title="CVE-2026-8094"/>
      <reference href="https://bugzilla.redhat.com/2467706" id="2467706" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467708" id="2467708" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467709" id="2467709" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19160.html" id="ALSA-2026:19160" type="self" title="ALSA-2026:19160"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.10.2" release="1.el10_2" epoch="0" arch="x86_64_v2" src="firefox-140.10.2-1.el10_2.src.rpm">
          <filename>firefox-140.10.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d2c1835a07e92c5901f36abae80103438014624549bb2aef0fbc174000a65cc6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19560</id>
    <title>Important: libsndfile security update</title>
    <issued date="2026-05-20 00:00:00"/>
    <updated date="2026-05-26 12:29:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libsndfile security update</summary>
    <description>libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV.   

Security Fix(es):  

  * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19560" id="RHSA-2026:19560" type="rhsa" title="RHSA-2026:19560"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-37555" id="CVE-2026-37555" type="cve" title="CVE-2026-37555"/>
      <reference href="https://bugzilla.redhat.com/2463856" id="2463856" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19560.html" id="ALSA-2026:19560" type="self" title="ALSA-2026:19560"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libsndfile" version="1.2.2" release="6.el10_2.1" epoch="0" arch="x86_64_v2" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-1.2.2-6.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">3638712efe299a65a26b61162ef7f303f1cd3cb5674f1cad951b687c790a797e</sum>
        </package>
        <package name="libsndfile-utils" version="1.2.2" release="6.el10_2.1" epoch="0" arch="x86_64_v2" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-utils-1.2.2-6.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">48caea25e912233616f78a5416cea5cb2dc96fb5b8b2a7a9224951920609086b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19569</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-20 00:00:00"/>
    <updated date="2026-06-07 18:12:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
  * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)
  * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
  * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741)
  * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)
  * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401)
  * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
  * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
  * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)
  * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)
  * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)
  * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300)
  * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19569" id="RHSA-2026:19569" type="rhsa" title="RHSA-2026:19569"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56603" id="CVE-2024-56603" type="cve" title="CVE-2024-56603"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-39766" id="CVE-2025-39766" type="cve" title="CVE-2025-39766"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68724" id="CVE-2025-68724" type="cve" title="CVE-2025-68724"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68741" id="CVE-2025-68741" type="cve" title="CVE-2025-68741"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23270" id="CVE-2026-23270" type="cve" title="CVE-2026-23270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23401" id="CVE-2026-23401" type="cve" title="CVE-2026-23401"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31402" id="CVE-2026-31402" type="cve" title="CVE-2026-31402"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31408" id="CVE-2026-31408" type="cve" title="CVE-2026-31408"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31607" id="CVE-2026-31607" type="cve" title="CVE-2026-31607"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43128" id="CVE-2026-43128" type="cve" title="CVE-2026-43128"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43284" id="CVE-2026-43284" type="cve" title="CVE-2026-43284"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46300" id="CVE-2026-46300" type="cve" title="CVE-2026-46300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46333" id="CVE-2026-46333" type="cve" title="CVE-2026-46333"/>
      <reference href="https://bugzilla.redhat.com/2334439" id="2334439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2394648" id="2394648" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2424886" id="2424886" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2425046" id="2425046" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448745" id="2448745" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2453803" id="2453803" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454844" id="2454844" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455334" id="2455334" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461521" id="2461521" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467144" id="2467144" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467771" id="2467771" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477015" id="2477015" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477802" id="2477802" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19569.html" id="ALSA-2026:19569" type="self" title="ALSA-2026:19569"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.16.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">11ef5ac5b22f3f65fa7a5f84ab58570bff3cdac7a27b71e7512344b99652db86</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.16.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1716664ea69f8a5cf510b0a341bbf5fe5b4aa45209d1bf90d0cdcf5324673f24</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.16.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">20019ae0be1b10ddb455e68dc3e25b837af47e3bd82468588a44402eaa76e643</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.16.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">52aaa828bad6753793a6ae98e976371e3f62b4388f317cd5bd9091f97574dbb1</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.16.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7299e858d2136f53baee1f0fa0a080086c30fd2d133b43ad235f412975d1ed2d</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.16.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">a30d005f590aa010563453b7942bdd2cfa63cee5945427cf1bda74dd421aed6b</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.16.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ab260f9e48c7be15a598cdd27ac1cd2e277ad4a4b7af86c661f3532dda6f5bed</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.16.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ad8b5aae1475730a2879981f6e9f84f5cdaff39c515429242ca68d378f2c218b</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.16.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b8436ac6bb94a0f98b38b8a977b00a3a1e6394bca803748d9e7de3ca74700bab</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.16.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f8e282a61c4f50b58d5dbf234b5783a5ae9c0b66cc107f9663880826348a90e9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20594</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-05-27 13:09:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20594" id="RHSA-2026:20594" type="rhsa" title="RHSA-2026:20594"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4046" id="CVE-2026-4046" type="cve" title="CVE-2026-4046"/>
      <reference href="https://bugzilla.redhat.com/2453117" id="2453117" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20594.html" id="ALSA-2026:20594" type="self" title="ALSA-2026:20594"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="glibc-devel" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-devel-2.39-124.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0ad6521dd44dbaab2dfd9e14255746c24ff54a00e45ae98a24889dd1967f20fc</sum>
        </package>
        <package name="glibc-utils" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-utils-2.39-124.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7924ec538b7dbfd5ebe390abb3850c3037b1aa28c974e3618057d052a2e04424</sum>
        </package>
        <package name="glibc-locale-source" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-locale-source-2.39-124.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7ff2c0d97e1762267214a14d14a96e74a26ab8cb5651aef95351b95c40aa7dba</sum>
        </package>
        <package name="glibc-doc" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-124.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">c589ecc76ade948f7fc3324ba9ed3bd004cb7f413e99688e10998fd997695708</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20600</id>
    <title>Important: wireshark security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-07-08 11:52:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>wireshark security update</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.  

Security Fix(es):  

  * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405)
  * wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVE-2026-5656)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20600" id="RHSA-2026:20600" type="rhsa" title="RHSA-2026:20600"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5405" id="CVE-2026-5405" type="cve" title="CVE-2026-5405"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5656" id="CVE-2026-5656" type="cve" title="CVE-2026-5656"/>
      <reference href="https://bugzilla.redhat.com/2464273" id="2464273" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464276" id="2464276" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20600.html" id="ALSA-2026:20600" type="self" title="ALSA-2026:20600"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="wireshark" version="4.4.2" release="10.el10_2" epoch="1" arch="x86_64_v2" src="wireshark-4.4.2-10.el10_2.src.rpm">
          <filename>wireshark-4.4.2-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3470c9c7a886fd80ed05140da9cf0736f9b60fd74ea7c256f00df410fcd92278</sum>
        </package>
        <package name="wireshark-cli" version="4.4.2" release="10.el10_2" epoch="1" arch="x86_64_v2" src="wireshark-4.4.2-10.el10_2.src.rpm">
          <filename>wireshark-cli-4.4.2-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8137707b1a7f6dc5bc7b3e1dbcb7d8f3b9dc390e2451ac36a200a1eb4fd2f3c6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20606</id>
    <title>Important: ruby4.0 security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-06-04 10:20:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ruby4.0 security update</summary>
    <description>Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.  

Security Fix(es):  

  * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)
  * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20606" id="RHSA-2026:20606" type="rhsa" title="RHSA-2026:20606"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33210" id="CVE-2026-33210" type="cve" title="CVE-2026-33210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41316" id="CVE-2026-41316" type="cve" title="CVE-2026-41316"/>
      <reference href="https://bugzilla.redhat.com/2449871" id="2449871" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461369" id="2461369" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20606.html" id="ALSA-2026:20606" type="self" title="ALSA-2026:20606"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="ruby4.0" version="4.0.3" release="34.el10_2" epoch="0" arch="x86_64_v2" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-4.0.3-34.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">041fb07a7b2a10c55b9c69107eace9bb0c7cc2ec524f1d091ebcb5b616eb5738</sum>
        </package>
        <package name="ruby4.0-devel" version="4.0.3" release="34.el10_2" epoch="0" arch="x86_64_v2" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-devel-4.0.3-34.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">44800d7b1e9c94b2171a870b707c3d1ae8fa0800a7caba1a24699a739684a6c5</sum>
        </package>
        <package name="ruby4.0-rubygem-mysql2" version="0.5.7" release="34.el10_2" epoch="0" arch="x86_64_v2" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-mysql2-0.5.7-34.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8d0e2b0ef952af4a77fed2ef76b2c359e4b2e286cc254204ba768cef8624f613</sum>
        </package>
        <package name="ruby4.0-rubygem-pg" version="1.6.3" release="34.el10_2" epoch="0" arch="x86_64_v2" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-pg-1.6.3-34.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f769db38e639a1fb446e29a898c8ae7d0b64c7ac00cdc1671871a83e7042079a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20613</id>
    <title>Important: gnutls security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-07-08 11:55:27"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gnutls security update</summary>
    <description>The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library,  
which implements cryptographic algorithms and protocols such as SSL, TLS, and  
DTLS.  

Security Fix(es):  

  * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  * gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
  * gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  * gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
  * gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
  * gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)


For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE page(s)  
listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20613" id="RHSA-2026:20613" type="rhsa" title="RHSA-2026:20613"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33845" id="CVE-2026-33845" type="cve" title="CVE-2026-33845"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33846" id="CVE-2026-33846" type="cve" title="CVE-2026-33846"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3832" id="CVE-2026-3832" type="cve" title="CVE-2026-3832"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3833" id="CVE-2026-3833" type="cve" title="CVE-2026-3833"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42009" id="CVE-2026-42009" type="cve" title="CVE-2026-42009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42010" id="CVE-2026-42010" type="cve" title="CVE-2026-42010"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42011" id="CVE-2026-42011" type="cve" title="CVE-2026-42011"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42012" id="CVE-2026-42012" type="cve" title="CVE-2026-42012"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42013" id="CVE-2026-42013" type="cve" title="CVE-2026-42013"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42014" id="CVE-2026-42014" type="cve" title="CVE-2026-42014"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42015" id="CVE-2026-42015" type="cve" title="CVE-2026-42015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5260" id="CVE-2026-5260" type="cve" title="CVE-2026-5260"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5419" id="CVE-2026-5419" type="cve" title="CVE-2026-5419"/>
      <reference href="https://bugzilla.redhat.com/2445763" id="2445763" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2450624" id="2450624" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2450625" id="2450625" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467279" id="2467279" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467289" id="2467289" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467437" id="2467437" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20613.html" id="ALSA-2026:20613" type="self" title="ALSA-2026:20613"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gnutls-c++" version="3.8.10" release="4.el10_2" epoch="0" arch="x86_64_v2" src="gnutls-3.8.10-4.el10_2.src.rpm">
          <filename>gnutls-c++-3.8.10-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2d027dda8502f115398726b10a3465d2e0069d6a34e2b97e41eb2ac78958283f</sum>
        </package>
        <package name="gnutls-fips" version="3.8.10" release="4.el10_2" epoch="0" arch="x86_64_v2" src="gnutls-3.8.10-4.el10_2.src.rpm">
          <filename>gnutls-fips-3.8.10-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">432306d96462fd56e3d9e707ff7d2ea717b614f425a0093eb6b35ca384bea0c9</sum>
        </package>
        <package name="gnutls-utils" version="3.8.10" release="4.el10_2" epoch="0" arch="x86_64_v2" src="gnutls-3.8.10-4.el10_2.src.rpm">
          <filename>gnutls-utils-3.8.10-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7338df771166dbacae6212d9f5746b97da00e92a5bd6aa0801dbcc9d9402aed0</sum>
        </package>
        <package name="gnutls-devel" version="3.8.10" release="4.el10_2" epoch="0" arch="x86_64_v2" src="gnutls-3.8.10-4.el10_2.src.rpm">
          <filename>gnutls-devel-3.8.10-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7ce7bd6e657c0b156eb26b530561d513823c319b3f0706c3f593cec42550adce</sum>
        </package>
        <package name="gnutls-dane" version="3.8.10" release="4.el10_2" epoch="0" arch="x86_64_v2" src="gnutls-3.8.10-4.el10_2.src.rpm">
          <filename>gnutls-dane-3.8.10-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e6cd034a6e65409ce94ea1403e9a8120f773b0fdcc63da61ade0755bddd73353</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20693</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-05-27 12:56:49"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>mysql8.4 security update</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.  

Security Fix(es):  

  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004)
  * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238)
  * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236)
  * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304)
  * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20693" id="RHSA-2026:20693" type="rhsa" title="RHSA-2026:20693"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-21998" id="CVE-2026-21998" type="cve" title="CVE-2026-21998"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22001" id="CVE-2026-22001" type="cve" title="CVE-2026-22001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22002" id="CVE-2026-22002" type="cve" title="CVE-2026-22002"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22004" id="CVE-2026-22004" type="cve" title="CVE-2026-22004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22005" id="CVE-2026-22005" type="cve" title="CVE-2026-22005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22009" id="CVE-2026-22009" type="cve" title="CVE-2026-22009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22015" id="CVE-2026-22015" type="cve" title="CVE-2026-22015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22017" id="CVE-2026-22017" type="cve" title="CVE-2026-22017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34270" id="CVE-2026-34270" type="cve" title="CVE-2026-34270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34271" id="CVE-2026-34271" type="cve" title="CVE-2026-34271"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34276" id="CVE-2026-34276" type="cve" title="CVE-2026-34276"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34303" id="CVE-2026-34303" type="cve" title="CVE-2026-34303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34304" id="CVE-2026-34304" type="cve" title="CVE-2026-34304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34308" id="CVE-2026-34308" type="cve" title="CVE-2026-34308"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35236" id="CVE-2026-35236" type="cve" title="CVE-2026-35236"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35237" id="CVE-2026-35237" type="cve" title="CVE-2026-35237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35238" id="CVE-2026-35238" type="cve" title="CVE-2026-35238"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35239" id="CVE-2026-35239" type="cve" title="CVE-2026-35239"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35240" id="CVE-2026-35240" type="cve" title="CVE-2026-35240"/>
      <reference href="https://bugzilla.redhat.com/2460274" id="2460274" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460275" id="2460275" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460276" id="2460276" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460279" id="2460279" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460295" id="2460295" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460312" id="2460312" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460315" id="2460315" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460316" id="2460316" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460323" id="2460323" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460324" id="2460324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460325" id="2460325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460326" id="2460326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460329" id="2460329" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460335" id="2460335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460342" id="2460342" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460344" id="2460344" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460348" id="2460348" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460356" id="2460356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460358" id="2460358" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20693.html" id="ALSA-2026:20693" type="self" title="ALSA-2026:20693"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mysql8.4-common" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-common-8.4.9-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">0d7ccc94e1089ffb6b3fbcd721eec0fed9e1f3494a20fd6d6458a4b6df88a845</sum>
        </package>
        <package name="mysql8.4-errmsg" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.9-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">1be911010c4913a85c01b874457f48ba4933cb9701ec3fe5760128223f810f45</sum>
        </package>
        <package name="mysql8.4" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-8.4.9-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">56545bd95e2e65658b45b70ba90c8a03919b048406058cabd008ec691a23e2ef</sum>
        </package>
        <package name="mysql8.4-server" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-server-8.4.9-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">81faf2861cb2a20b884769aa2cb8a4475987203a72ae81e2530b98c40639a79e</sum>
        </package>
        <package name="mysql8.4-libs" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-libs-8.4.9-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">91f96947a287b867ee3a6d00e3787617f6da0d192c65208ff9bd7e7e5264a6bd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21286</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-05-27 00:00:00"/>
    <updated date="2026-05-28 12:38:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 8.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):  

  * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)
  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21286" id="RHSA-2026:21286" type="rhsa" title="RHSA-2026:21286"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34043" id="CVE-2026-34043" type="cve" title="CVE-2026-34043"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899"/>
      <reference href="https://bugzilla.redhat.com/2453284" id="2453284" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476605" id="2476605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21286.html" id="ALSA-2026:21286" type="self" title="ALSA-2026:21286"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dotnet-runtime-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.27-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0e6a493f40a3f873bcd76bf5d9bf6d320422d66e8ebd21fbd2e1f4865b650aff</sum>
        </package>
        <package name="dotnet-templates-8.0" version="8.0.127" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.127-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1b97fcb5f8ab86f77c527ca030138f368643a65a7a4df8464d1ace7a78dd60a0</sum>
        </package>
        <package name="dotnet-sdk-8.0" version="8.0.127" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.127-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">28d1438ee63129b5ae0f9cba0dab459973288c9dea2a38ccc97f543ac18108d3</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.27-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4a8547680c1dd9e05a4475e8e2864d212f1327cdf041d4025d7349e2d4b12b38</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.27-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">64f0a8d13bf6cb355ee75de8fd0c7282aed5c22e806e075926eb255467931f62</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.27-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7cd2e51029c907a256ce83f0196698c59d8fd0b365be837f2240203248db2932</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.27-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7f02bf1d5c499ae7eff75f923c8236d312fb7ef2b48551944f0b7c454578a4e2</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.27-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">aee8c5955aa5404cb708850b776bdb081f940ff01e6a8d8b453fa6654bbc4a44</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" version="8.0.127" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.127-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b4d54b58caed669afe77ac60e0e8f99ce8eacdfc48b87f3fe5d4f9ffd6e44f73</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.27-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b67cdb11ba635572b280191ebc730da9ced826ac3ac046c5f301b169065d220a</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.27-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c9f8362957306005f37174a5d1e0bb8f6e75505a80304adbcc9fe898f965ac19</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21380</id>
    <title>Important: firefox security update</title>
    <issued date="2026-05-27 00:00:00"/>
    <updated date="2026-05-29 09:42:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)
  * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)
  * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)
  * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)
  * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975)
  * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)
  * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968)
  * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)
  * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958)
  * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)
  * firefox: Privilege escalation in the Security component (CVE-2026-8970)
  * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)
  * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)
  * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)
  * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)
  * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)
  * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)
  * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21380" id="RHSA-2026:21380" type="rhsa" title="RHSA-2026:21380"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8388" id="CVE-2026-8388" type="cve" title="CVE-2026-8388"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8391" id="CVE-2026-8391" type="cve" title="CVE-2026-8391"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8401" id="CVE-2026-8401" type="cve" title="CVE-2026-8401"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8946" id="CVE-2026-8946" type="cve" title="CVE-2026-8946"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8947" id="CVE-2026-8947" type="cve" title="CVE-2026-8947"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8950" id="CVE-2026-8950" type="cve" title="CVE-2026-8950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8953" id="CVE-2026-8953" type="cve" title="CVE-2026-8953"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8954" id="CVE-2026-8954" type="cve" title="CVE-2026-8954"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8955" id="CVE-2026-8955" type="cve" title="CVE-2026-8955"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8956" id="CVE-2026-8956" type="cve" title="CVE-2026-8956"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8957" id="CVE-2026-8957" type="cve" title="CVE-2026-8957"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8958" id="CVE-2026-8958" type="cve" title="CVE-2026-8958"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8961" id="CVE-2026-8961" type="cve" title="CVE-2026-8961"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8962" id="CVE-2026-8962" type="cve" title="CVE-2026-8962"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8968" id="CVE-2026-8968" type="cve" title="CVE-2026-8968"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8970" id="CVE-2026-8970" type="cve" title="CVE-2026-8970"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8974" id="CVE-2026-8974" type="cve" title="CVE-2026-8974"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8975" id="CVE-2026-8975" type="cve" title="CVE-2026-8975"/>
      <reference href="https://bugzilla.redhat.com/2476469" id="2476469" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476475" id="2476475" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476492" id="2476492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479839" id="2479839" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479840" id="2479840" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479842" id="2479842" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479846" id="2479846" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479847" id="2479847" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479848" id="2479848" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479849" id="2479849" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479852" id="2479852" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479853" id="2479853" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479855" id="2479855" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479860" id="2479860" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479871" id="2479871" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479873" id="2479873" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479876" id="2479876" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479880" id="2479880" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21380.html" id="ALSA-2026:21380" type="self" title="ALSA-2026:21380"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.11.0" release="1.el10_2" epoch="0" arch="x86_64_v2" src="firefox-140.11.0-1.el10_2.src.rpm">
          <filename>firefox-140.11.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a21484d04d74687aac5881ab0026017f5159a2adb55e7c5848ebd9ee3d905bfc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21433</id>
    <title>Important: httpd security update</title>
    <issued date="2026-05-27 00:00:00"/>
    <updated date="2026-05-28 12:35:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>httpd security update</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  

Security Fix(es):  

  * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
  * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
  * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
  * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
  * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21433" id="RHSA-2026:21433" type="rhsa" title="RHSA-2026:21433"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-28780" id="CVE-2026-28780" type="cve" title="CVE-2026-28780"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33007" id="CVE-2026-33007" type="cve" title="CVE-2026-33007"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33857" id="CVE-2026-33857" type="cve" title="CVE-2026-33857"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34032" id="CVE-2026-34032" type="cve" title="CVE-2026-34032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34059" id="CVE-2026-34059" type="cve" title="CVE-2026-34059"/>
      <reference href="https://bugzilla.redhat.com/2464940" id="2464940" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464952" id="2464952" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464953" id="2464953" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2465299" id="2465299" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2466913" id="2466913" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21433.html" id="ALSA-2026:21433" type="self" title="ALSA-2026:21433"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="httpd" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-2.4.63-13.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">129c9ee3e095ed43cb6ade01d1226eeb5844db78c4743500d57b027dc180f090</sum>
        </package>
        <package name="mod_proxy_html" version="2.4.63" release="13.el10_2.1" epoch="1" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_proxy_html-2.4.63-13.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">19d6971fb7800baf481ede41142c5f92f970cd88f17ad5fa6e00477a6975947a</sum>
        </package>
        <package name="mod_session" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_session-2.4.63-13.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1fbd563e17c41659eef5c526ada72ed8e1d6dea3e182d4bdb6836d44f7795f79</sum>
        </package>
        <package name="httpd-tools" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-tools-2.4.63-13.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">2c2f07e9cafea27405ec0b31c7af019eb8bd2c212a61bd9f49e40fbfc45b1f7f</sum>
        </package>
        <package name="httpd-core" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-core-2.4.63-13.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4e9f7ef72326b37d158bedb9e7ee98a82e9ed30d3b62b4dd74fefc17bdc48f81</sum>
        </package>
        <package name="mod_ssl" version="2.4.63" release="13.el10_2.1" epoch="1" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_ssl-2.4.63-13.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">535d5f1051507409cabc71361ea90c1ffc442306fd4ccb7001399437ba4f0800</sum>
        </package>
        <package name="mod_ldap" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_ldap-2.4.63-13.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7e2798a6d603d54104a2ac17a16ac390ffa12ab3c223f63cc5568cbb0f93d5de</sum>
        </package>
        <package name="mod_lua" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_lua-2.4.63-13.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">8d75f8a2fda9b4e0d773d0f5b4b01a7ee3ff7ea0fd4607693d001093492669e9</sum>
        </package>
        <package name="httpd-devel" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-devel-2.4.63-13.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9cd161a7d688fdf71c32af4bfdf39299c1689609291229fb87f6b5cf9b5b3c2d</sum>
        </package>
        <package name="httpd-filesystem" version="2.4.63" release="13.el10_2.1" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e031b93501860443509180fc94ca9fd2f55bb1e5c48013833c3648cf8b45ea9f</sum>
        </package>
        <package name="httpd-manual" version="2.4.63" release="13.el10_2.1" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e3cfbdbc5fcf4512653e1a0be2d6396861efc9b9c15498e4543c0fcbc556c07a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21557</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-06-08 09:59:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
  * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
  * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
  * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
  * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
  * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
  * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
  * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
  * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)
  * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
  * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
  * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
  * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
  * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
  * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
  * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)
  * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
  * kernel: mm/page_alloc: clear page-&gt;private in free_pages_prepare() (CVE-2026-43303)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21557" id="RHSA-2026:21557" type="rhsa" title="RHSA-2026:21557"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56645" id="CVE-2024-56645" type="cve" title="CVE-2024-56645"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68183" id="CVE-2025-68183" type="cve" title="CVE-2025-68183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23375" id="CVE-2026-23375" type="cve" title="CVE-2026-23375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23392" id="CVE-2026-23392" type="cve" title="CVE-2026-23392"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23455" id="CVE-2026-23455" type="cve" title="CVE-2026-23455"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31684" id="CVE-2026-31684" type="cve" title="CVE-2026-31684"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31685" id="CVE-2026-31685" type="cve" title="CVE-2026-31685"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43006" id="CVE-2026-43006" type="cve" title="CVE-2026-43006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43020" id="CVE-2026-43020" type="cve" title="CVE-2026-43020"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43023" id="CVE-2026-43023" type="cve" title="CVE-2026-43023"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43027" id="CVE-2026-43027" type="cve" title="CVE-2026-43027"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43051" id="CVE-2026-43051" type="cve" title="CVE-2026-43051"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43110" id="CVE-2026-43110" type="cve" title="CVE-2026-43110"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43116" id="CVE-2026-43116" type="cve" title="CVE-2026-43116"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43158" id="CVE-2026-43158" type="cve" title="CVE-2026-43158"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43190" id="CVE-2026-43190" type="cve" title="CVE-2026-43190"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43205" id="CVE-2026-43205" type="cve" title="CVE-2026-43205"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43303" id="CVE-2026-43303" type="cve" title="CVE-2026-43303"/>
      <reference href="https://bugzilla.redhat.com/2334560" id="2334560" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2422699" id="2422699" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451199" id="2451199" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451218" id="2451218" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454810" id="2454810" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461757" id="2461757" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461759" id="2461759" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464369" id="2464369" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464402" id="2464402" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464455" id="2464455" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464462" id="2464462" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464496" id="2464496" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467005" id="2467005" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467014" id="2467014" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467064" id="2467064" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467090" id="2467090" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467210" id="2467210" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468091" id="2468091" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21557.html" id="ALSA-2026:21557" type="self" title="ALSA-2026:21557"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="perf" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.18.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">34f1024d1ae82676895520b8bc8f32febdc150b51c3f1933a0fc4d5315e1724f</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.18.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3be0801b76ce97ddfb5ecccf788b86b90d394532e0989e6e93f9428cd1782cb4</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.18.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4d01ff10ed61d8a8edcb7cf96ddad524834307c6072094d510dd8417e3560531</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.18.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6c1ba1740dffe19662003c57bea4a9f83bc13e9bd5f9532a59f44da1949e7960</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.18.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7c80e355a279f1e0c542b01903879f47f55d6b2c8f276eabb1d0a5abbfa8ba58</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.18.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7eeb64271da3436b56fcb98f5fa2bd33e2c6b427f9ace875dfc3bf62d437a860</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.18.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">839713723022322969c90889e9e80bc7c74159055e6304dc28262b660d98dc74</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.18.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">97552aabbcdb1f2c3e3531195d5567377326a6101347254cf8e0187c4ebd09fc</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.18.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">d65ef7f528d990c65a6b7fb8ffc6e3ded25ceee509be5fa08d627d0c203045e9</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.18.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ee08255a3222c4c249203bb0af871983895ad8e77aaff517e54962f801068c6b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21676</id>
    <title>Important: cockpit security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-28 14:30:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>cockpit security update</summary>
    <description>Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.  

Security Fix(es):  

  * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21676" id="RHSA-2026:21676" type="rhsa" title="RHSA-2026:21676"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4802" id="CVE-2026-4802" type="cve" title="CVE-2026-4802"/>
      <reference href="https://bugzilla.redhat.com/2451155" id="2451155" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21676.html" id="ALSA-2026:21676" type="self" title="ALSA-2026:21676"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="cockpit-packagekit" version="356.2" release="1.el10_2" epoch="0" arch="noarch" src="cockpit-356.2-1.el10_2.src.rpm">
          <filename>cockpit-packagekit-356.2-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">29bea62d6da80ffe7185c0a5c07130c9f8bdd8cf3db5e6956ab11f4675ba353b</sum>
        </package>
        <package name="cockpit-storaged" version="356.2" release="1.el10_2" epoch="0" arch="noarch" src="cockpit-356.2-1.el10_2.src.rpm">
          <filename>cockpit-storaged-356.2-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">db2a2a221c93a54b55c9d8c46acdea7e845e9d978c1572d583e9113742dd59f2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21754</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-29 11:49:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 9.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es):  

  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21754" id="RHSA-2026:21754" type="rhsa" title="RHSA-2026:21754"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899"/>
      <reference href="https://bugzilla.redhat.com/2476605" id="2476605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21754.html" id="ALSA-2026:21754" type="self" title="ALSA-2026:21754"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dotnet-sdk-dbg-9.0" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.117-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">07ab3a7b2e76695f4aae122c9627eda6002fcdee53751a01a5dbbeac4a960ed4</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.16-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1a3ce9bbc382a83085e076f24f44bbdba816f2148b2c4fadf607d5e0307c7b95</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.16-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2ef16fe802e6e7eb3ec17fb2c24edaea9cd3e75517023f7c8a12dce76a720cee</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.117-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">56b38ab1664d7f16d38d77f6cb34cafae4fa89bd78612bd43ca0bf9cdf938d0c</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.16-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">601dd2585951534110f75612c254ab6cf0353d570779519a11645ada29d87dd4</sum>
        </package>
        <package name="dotnet-templates-9.0" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.117-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">77c971b1c9fe44a3c4445efe83996291b0734efbb8d97d4fdf72b54fc1d5ea8b</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.16-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">840e2a7faa733bc50dd8b3b7a4c63090e87511b45bf1d51b779a7591192fc982</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.16-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8758571fc27ea1b1fdd4e47c2cb6a861c80c40b59b9d00aaf2c20fb7007186e1</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.117-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8d564ba3263cb4741cc1893b358160af545be9470cedd26c2bfee65c42805f48</sum>
        </package>
        <package name="dotnet-sdk-9.0" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.117-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ab00076d6eb8ac58b17b18a6a134563d3c342293d8cf3227cb9080f3ceb89ec1</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.16-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b5c719ea3dbc04b1dda67ebae8f5da640eb793e5c32debbf189ffdc39cea61a2</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.16-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b810efbf91bc49cc9948ed6771acc1b8001f52134c9d2576c84bdf4af2fa2d58</sum>
        </package>
        <package name="dotnet-runtime-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.16-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e6d9139ee52bbff2249005ca3b287dbe3600e6da2ba606c9a0d5c5f829a266b1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21757</id>
    <title>Important: flatpak security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-29 12:28:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>flatpak security update</summary>
    <description>Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  

Security Fix(es):  

  * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
  * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21757" id="RHSA-2026:21757" type="rhsa" title="RHSA-2026:21757"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34078" id="CVE-2026-34078" type="cve" title="CVE-2026-34078"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34079" id="CVE-2026-34079" type="cve" title="CVE-2026-34079"/>
      <reference href="https://bugzilla.redhat.com/2456276" id="2456276" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456284" id="2456284" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21757.html" id="ALSA-2026:21757" type="self" title="ALSA-2026:21757"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="flatpak" version="1.16.0" release="9.el10_2.1" epoch="0" arch="x86_64_v2" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-1.16.0-9.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0c31d436b97831e787da899c9c572316bd531e098303548d91cdbbbd273944ac</sum>
        </package>
        <package name="flatpak-selinux" version="1.16.0" release="9.el10_2.1" epoch="0" arch="noarch" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">22949ff4b832a5fbaf79d354cfc73af59a6746d662dcf4d0c294b24dcd69a9c7</sum>
        </package>
        <package name="flatpak-libs" version="1.16.0" release="9.el10_2.1" epoch="0" arch="x86_64_v2" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-libs-1.16.0-9.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">60d1d9f8bf0c9d8929a491dd9e93aa782ca90dce9d5cdcc1bc273b286662d0ea</sum>
        </package>
        <package name="flatpak-session-helper" version="1.16.0" release="9.el10_2.1" epoch="0" arch="x86_64_v2" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-session-helper-1.16.0-9.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">743d833aa29eba1625c8faf53e87297cce5ce176418548d7024bbcbb5212ed21</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22141</id>
    <title>Moderate: go-fdo-client and go-fdo-server security update</title>
    <issued date="2026-06-01 00:00:00"/>
    <updated date="2026-07-15 07:31:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>go-fdo-client and go-fdo-server security update</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.  

Security Fix(es):  

  * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22141" id="RHSA-2026:22141" type="rhsa" title="RHSA-2026:22141"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://bugzilla.redhat.com/2437111" id="2437111" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22141.html" id="ALSA-2026:22141" type="self" title="ALSA-2026:22141"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="go-fdo-server-owner" version="1.0.1" release="2.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">2f5a8bd1401f47c152f97edd4dcc2bcfe5b02e9edea564cd3f27e4152facb328</sum>
        </package>
        <package name="go-fdo-server" version="1.0.1" release="2.el10_2" epoch="0" arch="x86_64_v2" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-1.0.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">50468070a7e546383a806a7379ad2eb10fe9d6522ac77fc7fab212c0f84eb842</sum>
        </package>
        <package name="go-fdo-server-rendezvous" version="1.0.1" release="2.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">843e6a44fb5ab7ca974b5dc823978d86e2f4d3d2a91a9aef3292f97beafc75f3</sum>
        </package>
        <package name="go-fdo-client" version="1.0.0" release="4.el10_2" epoch="0" arch="x86_64_v2" src="go-fdo-client-1.0.0-4.el10_2.src.rpm">
          <filename>go-fdo-client-1.0.0-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9790ddd81db302dfcb7d942ae00787c57992244b750580a4319184b35a60f681</sum>
        </package>
        <package name="go-fdo-server-manufacturer" version="1.0.1" release="2.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">b1739b5cbc00a312407f39f5c8b72d26a9a88f099f93f00e1d68db826a024bb9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22145</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-01 00:00:00"/>
    <updated date="2026-06-03 07:58:16"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 10.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es):  

  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22145" id="RHSA-2026:22145" type="rhsa" title="RHSA-2026:22145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899"/>
      <reference href="https://bugzilla.redhat.com/2476605" id="2476605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22145.html" id="ALSA-2026:22145" type="self" title="ALSA-2026:22145"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dotnet-apphost-pack-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2adf77b55ad21b12f5cc7bbaced878d6dddf276562b1749a33d7e0548e0f67e9</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">33a9942c713b896a4d7839da17e6965b56c4a1dc5ceadb27076ccb1a66f1d000</sum>
        </package>
        <package name="dotnet-host" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3b36d76ae2c185d3cbe4b1ac60085d0b2ab0f0265827e128bc8b62c7b5d8ebb6</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">45d87545418a4641fb32b3876a862701e2259b1201f376d5784e5968f4b0ae3d</sum>
        </package>
        <package name="dotnet-runtime-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">55067debeecf0f99c3a5be74ec00eed5f33865d8eadba6f9b26a9a89255af2d5</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9383b44a32afa5a81a5efe28a580d43a85365865ede6fbac6f487aa36a6c91de</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9ebfdf73c750bfcd87863beef961deb522d46ec2a40566e6ad8f8a11bce6514f</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b893a8a7aa92ea2f9cf150dc7e3f9c8b79618b9be77aec1139db057feddcb5d0</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" version="10.0.108" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.108-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d00cdbfa75667cee73cdc4b4c69508e982c8b17636028afbfadad64572e6cf00</sum>
        </package>
        <package name="dotnet-sdk-10.0" version="10.0.108" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.108-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">de24ca34652c47ca150ed2095cee0aaf4f390d5ec98a40c658af43180a342f12</sum>
        </package>
        <package name="dotnet-templates-10.0" version="10.0.108" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.108-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e45ca7e1e9faf29faf0c71492fd2f88d6255b2d4bcdc58a9b7c4295d533ac0c9</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" version="10.0.108" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.108-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e4e48073c4a0baea0efdd314f69347cdcb6468ade575500718d70e01d70d5765</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f699f83bd98e2d07ff4ed2a64f51db9c19cf0b29f733f6f1cdaae694c690e191</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22314</id>
    <title>Moderate: openssl security update</title>
    <issued date="2026-06-01 00:00:00"/>
    <updated date="2026-06-03 07:56:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>openssl security update</summary>
    <description>OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  

Security Fix(es):  

  * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22314" id="RHSA-2026:22314" type="rhsa" title="RHSA-2026:22314"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-28390" id="CVE-2026-28390" type="cve" title="CVE-2026-28390"/>
      <reference href="https://bugzilla.redhat.com/2456314" id="2456314" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22314.html" id="ALSA-2026:22314" type="self" title="ALSA-2026:22314"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="openssl-perl" version="3.5.5" release="3.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="openssl-3.5.5-3.el10_2.alma.1.src.rpm">
          <filename>openssl-perl-3.5.5-3.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">12466e9715f6747e3293838d38af737ac16774f0d5fd310de54bf8093ba2b5e1</sum>
        </package>
        <package name="openssl-devel" version="3.5.5" release="3.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="openssl-3.5.5-3.el10_2.alma.1.src.rpm">
          <filename>openssl-devel-3.5.5-3.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">eefc262713403eefa22b83b5b1c9623ae51a808075eccfd99655d7a8f6fe8c62</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22325</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-06-01 00:00:00"/>
    <updated date="2026-06-03 07:54:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>thunderbird security update</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.  

Security Fix(es):  

  * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)
  * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)
  * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)
  * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)
  * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975)
  * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)
  * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968)
  * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)
  * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958)
  * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)
  * firefox: Privilege escalation in the Security component (CVE-2026-8970)
  * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)
  * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)
  * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)
  * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959)
  * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)
  * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)
  * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)
  * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22325" id="RHSA-2026:22325" type="rhsa" title="RHSA-2026:22325"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8388" id="CVE-2026-8388" type="cve" title="CVE-2026-8388"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8391" id="CVE-2026-8391" type="cve" title="CVE-2026-8391"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8401" id="CVE-2026-8401" type="cve" title="CVE-2026-8401"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8946" id="CVE-2026-8946" type="cve" title="CVE-2026-8946"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8947" id="CVE-2026-8947" type="cve" title="CVE-2026-8947"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8950" id="CVE-2026-8950" type="cve" title="CVE-2026-8950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8953" id="CVE-2026-8953" type="cve" title="CVE-2026-8953"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8954" id="CVE-2026-8954" type="cve" title="CVE-2026-8954"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8955" id="CVE-2026-8955" type="cve" title="CVE-2026-8955"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8956" id="CVE-2026-8956" type="cve" title="CVE-2026-8956"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8957" id="CVE-2026-8957" type="cve" title="CVE-2026-8957"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8958" id="CVE-2026-8958" type="cve" title="CVE-2026-8958"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8959" id="CVE-2026-8959" type="cve" title="CVE-2026-8959"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8961" id="CVE-2026-8961" type="cve" title="CVE-2026-8961"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8962" id="CVE-2026-8962" type="cve" title="CVE-2026-8962"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8968" id="CVE-2026-8968" type="cve" title="CVE-2026-8968"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8970" id="CVE-2026-8970" type="cve" title="CVE-2026-8970"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8974" id="CVE-2026-8974" type="cve" title="CVE-2026-8974"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8975" id="CVE-2026-8975" type="cve" title="CVE-2026-8975"/>
      <reference href="https://bugzilla.redhat.com/2476469" id="2476469" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476475" id="2476475" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476492" id="2476492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479839" id="2479839" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479840" id="2479840" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479842" id="2479842" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479846" id="2479846" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479847" id="2479847" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479848" id="2479848" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479849" id="2479849" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479852" id="2479852" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479853" id="2479853" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479855" id="2479855" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479860" id="2479860" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479861" id="2479861" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479871" id="2479871" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479873" id="2479873" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479876" id="2479876" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479880" id="2479880" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22325.html" id="ALSA-2026:22325" type="self" title="ALSA-2026:22325"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="thunderbird" version="140.11.0" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="thunderbird-140.11.0-1.el10_2.alma.1.src.rpm">
          <filename>thunderbird-140.11.0-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7e6977c192235b98bfc2a984f85b1f98f4a21bc8a954f1dff20c0c284d9ad276</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22528</id>
    <title>Moderate: mod_http2 security update</title>
    <issued date="2026-06-02 00:00:00"/>
    <updated date="2026-06-03 12:42:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>mod_http2 security update</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.  

Security Fix(es):  

  * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22528" id="RHSA-2026:22528" type="rhsa" title="RHSA-2026:22528"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-53020" id="CVE-2025-53020" type="cve" title="CVE-2025-53020"/>
      <reference href="https://bugzilla.redhat.com/2379343" id="2379343" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22528.html" id="ALSA-2026:22528" type="self" title="ALSA-2026:22528"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mod_http2" version="2.0.29" release="4.el10_2" epoch="0" arch="x86_64_v2" src="mod_http2-2.0.29-4.el10_2.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9d8f9b9aeee71310a32979f59e6b399980d691ad302cf300ddae6424383aee5f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22529</id>
    <title>Moderate: libexif security update</title>
    <issued date="2026-06-02 00:00:00"/>
    <updated date="2026-06-04 14:44:27"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libexif security update</summary>
    <description>The libexif packages provide a library for extracting extra information from image files.  

Security Fix(es):  

  * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22529" id="RHSA-2026:22529" type="rhsa" title="RHSA-2026:22529"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40386" id="CVE-2026-40386" type="cve" title="CVE-2026-40386"/>
      <reference href="https://bugzilla.redhat.com/2457689" id="2457689" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22529.html" id="ALSA-2026:22529" type="self" title="ALSA-2026:22529"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libexif" version="0.6.24" release="9.el10_2.1" epoch="0" arch="x86_64_v2" src="libexif-0.6.24-9.el10_2.1.src.rpm">
          <filename>libexif-0.6.24-9.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0d50d21906a522e5f5fd70df329f88cca1e24320cb67ada110564e059c3f6548</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22649</id>
    <title>Important: php8.4 security update</title>
    <issued date="2026-06-02 00:00:00"/>
    <updated date="2026-07-15 10:25:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>php8.4 security update</summary>
    <description>PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.  

Security Fix(es):  

  * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)
  * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)
  * php: NULL pointer dereference in SOAP apache:Map decoder with missing &lt;value&gt; (CVE-2026-7262)
  * php: signed integer overflow in metaphone() (CVE-2026-7568)
  * php: denial of service via DOMNode::C14N() (CVE-2026-7263)
  * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22649" id="RHSA-2026:22649" type="rhsa" title="RHSA-2026:22649"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6104" id="CVE-2026-6104" type="cve" title="CVE-2026-6104"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6735" id="CVE-2026-6735" type="cve" title="CVE-2026-6735"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7258" id="CVE-2026-7258" type="cve" title="CVE-2026-7258"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7262" id="CVE-2026-7262" type="cve" title="CVE-2026-7262"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7263" id="CVE-2026-7263" type="cve" title="CVE-2026-7263"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7568" id="CVE-2026-7568" type="cve" title="CVE-2026-7568"/>
      <reference href="https://bugzilla.redhat.com/2468561" id="2468561" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468562" id="2468562" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468565" id="2468565" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468566" id="2468566" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468572" id="2468572" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468573" id="2468573" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22649.html" id="ALSA-2026:22649" type="self" title="ALSA-2026:22649"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="php8.4" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">00e015fa52ddc696ec24b0411296a20fd45b931da23b57fbca395f4a25d9f5b3</sum>
        </package>
        <package name="php8.4-ldap" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-ldap-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">066ca21c5f6997344e8dc5276eaa1aae1ecea3fd6f0edfac5e85c8a8fb02c562</sum>
        </package>
        <package name="php8.4-devel" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-devel-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0d68a34985dd37f190e14a83df8153e5f3ac66c5afa38d711a65c78788173ff2</sum>
        </package>
        <package name="php8.4-cli" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-cli-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">112c5dcfaa1f245a3081bdcbac47d1723a000a045dc55a19c55f6e0db9075341</sum>
        </package>
        <package name="php8.4-opcache" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-opcache-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1f7e78eac96f93ecaa8f36aae0dbb59e55ba96be062edd3ad6c76d1fe8498b18</sum>
        </package>
        <package name="php8.4-ffi" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-ffi-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">231f4dd6ceb4427c432266b56070537b5f1144fd2652a393c390f9bb5eaaad0b</sum>
        </package>
        <package name="php8.4-bcmath" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-bcmath-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">513e77c1adc3f4f0297ba3a0b0b04e9931750a0e34f8ab2d52340395b6214d30</sum>
        </package>
        <package name="php8.4-mysqlnd" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-mysqlnd-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">51bdcfd0ac3daadd1fdc7f20d7d13ed4973165bad5dfbbde33e939b57f21e9a4</sum>
        </package>
        <package name="php8.4-pdo" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-pdo-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5485ed53f27d2ac4de6ebcc047b32c8c8ad7ba01fca029755e5eedb57c96b721</sum>
        </package>
        <package name="php8.4-gmp" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-gmp-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">657c99f90cf129baf2fea9021c62b74045b4044a1f2313744d9d1c1fbd792ca6</sum>
        </package>
        <package name="php8.4-dbg" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-dbg-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">67da5000f2661e9b473d9d677cb3a74e89e6c12d8f46c9e352ba8f7346ca1b87</sum>
        </package>
        <package name="php8.4-process" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-process-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">68b874f4163f2242f7b6e338e8dbde893b357178fe6c58368154966082a38937</sum>
        </package>
        <package name="php8.4-mbstring" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-mbstring-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">72afd68b214f7f8ab3405f0fb2049fe499a56aa4a6ca8d860248367ebb03fd4a</sum>
        </package>
        <package name="php8.4-snmp" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-snmp-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7bd2371d48e20ee4b00a03044a71f56aa3655a1b224421c39c740fe0a821bfe8</sum>
        </package>
        <package name="php8.4-fpm" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-fpm-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8ab1c517b53c3538e5aba1154a8423bc559d7c17a955b45ba07fb6c9dd1264b7</sum>
        </package>
        <package name="php8.4-soap" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-soap-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">97a7eab8ae4ff887505a6feb2afd785a3a4a63f56c0c4f7e8885394d7c5764c6</sum>
        </package>
        <package name="php8.4-xml" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-xml-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9ff93d77c7c993f6543828527ebba586b7aae1b848c709e33cfd2ecb72a6f7c6</sum>
        </package>
        <package name="php8.4-intl" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-intl-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a78db64e8c7876d3b0abd2402626cb36cfb86d2db6f253cc5db6f0819e3d0287</sum>
        </package>
        <package name="php8.4-embedded" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-embedded-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b3293e3b2362533593191b69ca54d3494323073abb070357aaa1eec680ce7370</sum>
        </package>
        <package name="php8.4-enchant" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-enchant-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b73464025b711178db56aa36f1bf26f69dce4b620a9d775956fcd0deccf9e522</sum>
        </package>
        <package name="php8.4-common" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-common-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bb475e3b45c113103d8b97eebfd58ce7936956687d5247e819d32bceb276912f</sum>
        </package>
        <package name="php8.4-gd" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-gd-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c49322e84cfa3145473941018781acebdf461f15f1c0c2e3dba4a07aed216b3a</sum>
        </package>
        <package name="php8.4-odbc" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-odbc-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c5c66e3fc08739e69f7b516899f7226cc9d23b7b7aa8076bd0ff9cd45c10048a</sum>
        </package>
        <package name="php8.4-dba" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-dba-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ce4b91485d5df479d56fad40400f6288990f3421ef01366c5488bde7afcac241</sum>
        </package>
        <package name="php8.4-pgsql" version="8.4.21" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-pgsql-8.4.21-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">eb706c3813cf06732a1dd58713ebd6876c7c6bfebe9ec0ab134fcaa4866686b4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22711</id>
    <title>Moderate: vim security update</title>
    <issued date="2026-06-03 00:00:00"/>
    <updated date="2026-06-03 12:43:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>vim security update</summary>
    <description>Vim (Vi IMproved) is an updated and improved version of the vi editor.  

Security Fix(es):  

  * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22711" id="RHSA-2026:22711" type="rhsa" title="RHSA-2026:22711"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35177" id="CVE-2026-35177" type="cve" title="CVE-2026-35177"/>
      <reference href="https://bugzilla.redhat.com/2455542" id="2455542" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22711.html" id="ALSA-2026:22711" type="self" title="ALSA-2026:22711"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="vim-common" version="9.1.083" release="9.el10_2.3" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.3.src.rpm">
          <filename>vim-common-9.1.083-9.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">1be5926d6583d778c29dd597fc021a9f61434a18f950237d1687574a12d8ed93</sum>
        </package>
        <package name="vim-X11" version="9.1.083" release="9.el10_2.3" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.3.src.rpm">
          <filename>vim-X11-9.1.083-9.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">20b10fb450993c6546282a2c1386e26e3179bfe316873e64c3633a1aa158dcc8</sum>
        </package>
        <package name="vim-enhanced" version="9.1.083" release="9.el10_2.3" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.3.src.rpm">
          <filename>vim-enhanced-9.1.083-9.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">8bfba57e55018a03e594d21f43ba1a9294c4a27e334ee195f0fc35be9b6aeed0</sum>
        </package>
        <package name="xxd" version="9.1.083" release="9.el10_2.3" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.3.src.rpm">
          <filename>xxd-9.1.083-9.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">c857f47c63b366f9b050a0d267a1aad057a665b05a9e9dfa9af0a8f6f5ef0c75</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22715</id>
    <title>Important: expat security update</title>
    <issued date="2026-06-03 00:00:00"/>
    <updated date="2026-06-04 08:56:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>expat security update</summary>
    <description>Expat is a C library for parsing XML documents.  

Security Fix(es):  

  * libexpat: denial of service via crafted XML input (CVE-2026-45186)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22715" id="RHSA-2026:22715" type="rhsa" title="RHSA-2026:22715"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45186" id="CVE-2026-45186" type="cve" title="CVE-2026-45186"/>
      <reference href="https://bugzilla.redhat.com/2468575" id="2468575" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22715.html" id="ALSA-2026:22715" type="self" title="ALSA-2026:22715"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="expat-devel" version="2.7.3" release="1.el10_2.1" epoch="0" arch="x86_64_v2" src="expat-2.7.3-1.el10_2.1.src.rpm">
          <filename>expat-devel-2.7.3-1.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7c8cf73a61ca7c18212476bb5c096cff2c35a0c5e0761fbf0bd970eae7eb428f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22963</id>
    <title>Critical: samba security update</title>
    <issued date="2026-06-03 00:00:00"/>
    <updated date="2026-06-04 10:06:47"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>samba security update</summary>
    <description>Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.  

Security Fix(es):  

  * samba: Missing access check on reparse point operations (CVE-2026-1933)
  * samba: vfs_worm does not block directory modification (CVE-2026-2340)
  * samba: group policy certificate enrollment uses &lt;http://&gt; without validation (CVE-2026-3012)
  * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
  * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
  * samba: Remote Code Execution in SAMR (CVE-2026-4408)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22963" id="RHSA-2026:22963" type="rhsa" title="RHSA-2026:22963"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1933" id="CVE-2026-1933" type="cve" title="CVE-2026-1933"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2340" id="CVE-2026-2340" type="cve" title="CVE-2026-2340"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3012" id="CVE-2026-3012" type="cve" title="CVE-2026-3012"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40170" id="CVE-2026-40170" type="cve" title="CVE-2026-40170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4408" id="CVE-2026-4408" type="cve" title="CVE-2026-4408"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4480" id="CVE-2026-4480" type="cve" title="CVE-2026-4480"/>
      <reference href="https://bugzilla.redhat.com/2447317" id="2447317" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447318" id="2447318" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447319" id="2447319" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452232" id="2452232" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2459061" id="2459061" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479762" id="2479762" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22963.html" id="ALSA-2026:22963" type="self" title="ALSA-2026:22963"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="samba-gpupdate" version="4.23.5" release="109.el10_2" epoch="0" arch="noarch" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-gpupdate-4.23.5-109.el10_2.noarch.rpm</filename>
          <sum type="sha256">02ab33c4186fb468d4de6cffac56cd285836279fe4e2d03245fef1dcf26dd611</sum>
        </package>
        <package name="samba-winexe" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64_v2" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-winexe-4.23.5-109.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">152c243a8e438b6ae46e6b4c1c6dafaaa5473f2ae0f03d8681974ddfba424edd</sum>
        </package>
        <package name="samba-krb5-printing" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64_v2" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-krb5-printing-4.23.5-109.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2e58971c2e83cbe479e19c8940b29b2e0d0e4b11c9563dd4a4d73e2e90cfb7dd</sum>
        </package>
        <package name="samba-winbind-krb5-locator" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64_v2" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-winbind-krb5-locator-4.23.5-109.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5402b5a523b52de9cec1adaf22d37ee23bf60ecf89419b6f8819ab1f7ce7040a</sum>
        </package>
        <package name="samba-client" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64_v2" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-client-4.23.5-109.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9d19fd4dd415ff1f6cf1c54b266780bf7397808f760243e3c35c760cc5193ba3</sum>
        </package>
        <package name="samba-vfs-iouring" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64_v2" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-vfs-iouring-4.23.5-109.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a10fbec54d17c3e55eac2ef7662bc5fd6684bb49f21418384c9ba7859b59ab5b</sum>
        </package>
        <package name="samba-winbind-clients" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64_v2" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-winbind-clients-4.23.5-109.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ce7d3939a370b0008c391f13acf76c56778e43d8af9a730a256afafc51d46f6c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23102</id>
    <title>Important: delve security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-04 10:13:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>delve security update</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.  

Security Fix(es):  

  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23102" id="RHSA-2026:23102" type="rhsa" title="RHSA-2026:23102"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23102.html" id="ALSA-2026:23102" type="self" title="ALSA-2026:23102"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="delve" version="1.26.1" release="2.el10_2" epoch="0" arch="x86_64_v2" src="delve-1.26.1-2.el10_2.src.rpm">
          <filename>delve-1.26.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">21157dd5c4d83a5c48d60bdb15a068277598c490870ebc319d08546f8bb3537c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23231</id>
    <title>Important: unbound security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-04 11:47:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)
  * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959)
  * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23231" id="RHSA-2026:23231" type="rhsa" title="RHSA-2026:23231"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33278" id="CVE-2026-33278" type="cve" title="CVE-2026-33278"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42944" id="CVE-2026-42944" type="cve" title="CVE-2026-42944"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42959" id="CVE-2026-42959" type="cve" title="CVE-2026-42959"/>
      <reference href="https://bugzilla.redhat.com/2479774" id="2479774" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479806" id="2479806" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479808" id="2479808" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23231.html" id="ALSA-2026:23231" type="self" title="ALSA-2026:23231"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="unbound-anchor" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0ad181f5b53609721164a982bc1594d388028d6daa8c3e3f02b74c37828f1edf</sum>
        </package>
        <package name="unbound-libs" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">101bac9c71d326534e72bff9e2628a752b62f0f3eead27694125450ebbd08a60</sum>
        </package>
        <package name="python3-unbound" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">5deb382341e0f741c00483324391caeaab853572f1df8eb648c195d7ac5082e7</sum>
        </package>
        <package name="unbound-utils" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">6b9d7d54790ddb5be82745459d8faaa3f879fb42c6955b67a8fbb9c98ca9e93a</sum>
        </package>
        <package name="unbound-dracut" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7d0fac45bd28db8749c487978a68231631c554a0dc4c4b7e7e5fe033f7f7e263</sum>
        </package>
        <package name="unbound" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-1.24.2-7.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b2c979393c14030c9c1e03e27c06154e5b3fd055b880bf433045ff144ff233e8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23329</id>
    <title>Important: kernel security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-08 10:00:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
  * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
  * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
  * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
  * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
  * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322)
  * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23329" id="RHSA-2026:23329" type="rhsa" title="RHSA-2026:23329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38653" id="CVE-2025-38653" type="cve" title="CVE-2025-38653"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68366" id="CVE-2025-68366" type="cve" title="CVE-2025-68366"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31613" id="CVE-2026-31613" type="cve" title="CVE-2026-31613"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31709" id="CVE-2026-31709" type="cve" title="CVE-2026-31709"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43322" id="CVE-2026-43322" type="cve" title="CVE-2026-43322"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43329" id="CVE-2026-43329" type="cve" title="CVE-2026-43329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46243" id="CVE-2026-46243" type="cve" title="CVE-2026-46243"/>
      <reference href="https://bugzilla.redhat.com/2390372" id="2390372" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2424881" id="2424881" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461480" id="2461480" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464476" id="2464476" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468124" id="2468124" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468131" id="2468131" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481486" id="2481486" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23329.html" id="ALSA-2026:23329" type="self" title="ALSA-2026:23329"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-headers" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.20.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">24a0b126b4030483686d49f06df52be28c76220fbe3d1b5e69faad4efa7e4eba</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.20.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6c9c2be534f26073053945348617fdab758112c33b82fad430783b8464e3ceb0</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.20.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">707b35cd9edae7d22d94c4518fd0ff559b8835f3b879a10038d9244855fc2c25</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.20.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7e8af2cfecaf9274f0bddf6ccaa65d59e80f59f101f677d5d2a046e47c686734</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.20.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">92615be1663a5222c258b0ed45a7dade269c488db241ca040ecd21cf417495fb</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.20.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9dd135883fde17d5ad61819f0fa16fd5a4a376623f454bffbe9fdccc86fd7875</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.20.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">a836026e76d4d01a4cd956f4ff3470e96d192b18c9b27f6d4d5b5e46c6aa8694</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.20.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b5e1842ffb0051aaef6762fa238250d4bf9c7fe0a508cf804c5fc1b763f57acc</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.20.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c6f9215e326c7ac41518209342291b73c10b4291d2c20edad2cf2b95414963f7</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.20.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d5bb6db5eaf68d79ca2899aa5069a09158482a488eadad57f310902543d56a6c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23388</id>
    <title>Important: php security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-05 10:29:28"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>php security update</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.  

Security Fix(es):  

  * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)
  * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)
  * php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)
  * php: NULL pointer dereference in SOAP apache:Map decoder with missing &lt;value&gt; (CVE-2026-7262)
  * php: signed integer overflow in metaphone() (CVE-2026-7568)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23388" id="RHSA-2026:23388" type="rhsa" title="RHSA-2026:23388"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6735" id="CVE-2026-6735" type="cve" title="CVE-2026-6735"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7258" id="CVE-2026-7258" type="cve" title="CVE-2026-7258"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7259" id="CVE-2026-7259" type="cve" title="CVE-2026-7259"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7262" id="CVE-2026-7262" type="cve" title="CVE-2026-7262"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7568" id="CVE-2026-7568" type="cve" title="CVE-2026-7568"/>
      <reference href="https://bugzilla.redhat.com/2468561" id="2468561" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468562" id="2468562" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468564" id="2468564" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468565" id="2468565" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468566" id="2468566" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23388.html" id="ALSA-2026:23388" type="self" title="ALSA-2026:23388"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="php-intl" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-intl-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0aa242861b11fa5b0a184af9d52a96c051c36f69d8f4920b5e6a861ba6e2afa5</sum>
        </package>
        <package name="php-dba" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-dba-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1023f37cd1f16ad62455d31c03810e8c2bdd28eb2c110523548f4e9f6d186572</sum>
        </package>
        <package name="php-process" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-process-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1048a9647ebbacf15c1155a3a0d7d9ad6e911c5ed165b831152875c6843c7f4f</sum>
        </package>
        <package name="php-ffi" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-ffi-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">12b016ec4debd00be64ac18de164d227f24fd2165670f833508abda5f62c143a</sum>
        </package>
        <package name="php-mysqlnd" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-mysqlnd-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">18ac6f5fb96e9af32c8e4f12222d4f4361a895126c14b1d054b2431f9c0edb08</sum>
        </package>
        <package name="php-soap" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-soap-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1d8213096da5201e87f09fa24f35832c9879d6b5226b6196c78f7dee6f2a72fd</sum>
        </package>
        <package name="php-bcmath" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-bcmath-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1e323ade31695a070f19633a1cba6fe75225b783e857949ce5e8025d98050a97</sum>
        </package>
        <package name="php-ldap" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-ldap-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3b6f998399f716cdd8be7ff6edf4fa91f5a899586f687408ecc122d17ef45010</sum>
        </package>
        <package name="php-xml" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-xml-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">45ec8ef1f34c73af90ca65e683218d83dbad768fc99586955b91c640ac0719c4</sum>
        </package>
        <package name="php-devel" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-devel-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">48b662e2e024279d7137d070ef6c36fbaeb535c2e4fd2b45bd7995b16bfc13ff</sum>
        </package>
        <package name="php-common" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-common-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5949e1d794598b17fcce5478305a81377c65cf4cae90d288fce7bafc363239ec</sum>
        </package>
        <package name="php-odbc" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-odbc-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5c772ed0ac4f5d4ca211526c1290e32203600d84d39da640d8a118b1b8e6de04</sum>
        </package>
        <package name="php-pgsql" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-pgsql-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">62770a9a682e155e0d41aeb5cf252d5a933965607b7fcf4dd23a9944be484d56</sum>
        </package>
        <package name="php-enchant" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-enchant-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">66adb79d5a432bf4b511c8f959af38640844589f3b1cdfa1b94da917c022b922</sum>
        </package>
        <package name="php-pdo" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-pdo-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6e04aad57733ef398009562dde8f2c6915caad0ce0e4c9ad6ccb6dce76818cfd</sum>
        </package>
        <package name="php-cli" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-cli-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7a9f9c19e0c0e2bddee678fcf066dc12c6fe4b5ea61334c0101899451a9cd2f4</sum>
        </package>
        <package name="php" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">895f1c873b0bfe008432949b67d984fc9013c1a0a72c1b9fbddefdc982846b6c</sum>
        </package>
        <package name="php-snmp" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-snmp-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">94ab49efe16dfd2f161d635884444e9785f540360c2b4b951aa0107617c54310</sum>
        </package>
        <package name="php-mbstring" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-mbstring-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9904685d9295e56dea2e91029196d55464cd1797228fb8fea7b0e1af231c9c85</sum>
        </package>
        <package name="php-fpm" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-fpm-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">aba925305ce3d7f03fd7fd1eea94db9444769d1a1ecd9326b68deb1285f3486f</sum>
        </package>
        <package name="php-gmp" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-gmp-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d1a754fd94092ee4586b28f40c69228c8e9502f1b1916c200331be2272508d80</sum>
        </package>
        <package name="php-embedded" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-embedded-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d74c11c04acd9bd44327fc437c47384e7d8c78e4c4a4739ad9212f21f35da150</sum>
        </package>
        <package name="php-opcache" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-opcache-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dc6fff0d1351abf59b705d4348a63aa43e4f88007068a0980ae90c69fe12cea8</sum>
        </package>
        <package name="php-gd" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-gd-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ebc5ceedd7590eb86652d7c19d799d049a63f247e6d015f19ef19d6756a6febe</sum>
        </package>
        <package name="php-dbg" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-dbg-8.3.31-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f3c88e11bf6e90314a022fc5b4ca9315189403917cce9107b1e233895b9b39a4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24338</id>
    <title>Important: bind security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-06-08 08:31:29"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>bind security update</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  

Security Fix(es):  

  * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
  * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24338" id="RHSA-2026:24338" type="rhsa" title="RHSA-2026:24338"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3039" id="CVE-2026-3039" type="cve" title="CVE-2026-3039"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5946" id="CVE-2026-5946" type="cve" title="CVE-2026-5946"/>
      <reference href="https://bugzilla.redhat.com/2479767" id="2479767" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479771" id="2479771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24338.html" id="ALSA-2026:24338" type="self" title="ALSA-2026:24338"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="bind-license" version="9.18.33" release="15.el10_2.2" epoch="32" arch="noarch" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-license-9.18.33-15.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">25696570fcae21d95d2b7b7d02efd735482defa1142c62286c36eabb4f6c2997</sum>
        </package>
        <package name="bind-chroot" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-chroot-9.18.33-15.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">2785269ceed1641064eff0afd7da845f597d06d3c82b3eada0bc5a28a65e228e</sum>
        </package>
        <package name="bind" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-9.18.33-15.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">8c86e2cc1f6ad64cf31f9097e32e609b3009ceb5c230c09af1ae0cdf9e4e5bef</sum>
        </package>
        <package name="bind-dnssec-utils" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-15.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">b035af786e8ac011610cf0bfda2a681631e5ffb5e12a65a50ce1dc55d28d8feb</sum>
        </package>
        <package name="bind-utils" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-utils-9.18.33-15.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">f9e5a0d90c86ba9103bc22bc243e948c2f8b89b606c1f3cbf83c87a707f1e3ea</sum>
        </package>
        <package name="bind-libs" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-libs-9.18.33-15.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">fbc6ee50d7c65b61f8d73b5fe81b5e0fd023d24d6ea307f4aa15fa222d06df5f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24347</id>
    <title>Important: frr security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-07-08 11:52:51"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>frr security update</summary>
    <description>FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.   

Security Fix(es):  

  * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)
  * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24347" id="RHSA-2026:24347" type="rhsa" title="RHSA-2026:24347"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-37457" id="CVE-2026-37457" type="cve" title="CVE-2026-37457"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-37459" id="CVE-2026-37459" type="cve" title="CVE-2026-37459"/>
      <reference href="https://bugzilla.redhat.com/2464548" id="2464548" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2466513" id="2466513" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24347.html" id="ALSA-2026:24347" type="self" title="ALSA-2026:24347"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="frr" version="10.4.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="frr-10.4.4-1.el10_2.src.rpm">
          <filename>frr-10.4.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">99818b38a23fb5870031a9ee3634dac0c8cd4d7f77569a57ddce43f327acb2e9</sum>
        </package>
        <package name="frr-selinux" version="10.4.4" release="1.el10_2" epoch="0" arch="noarch" src="frr-10.4.4-1.el10_2.src.rpm">
          <filename>frr-selinux-10.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">e52027fd1714316b10d57ad6d1986270e9103048cce6f181fddac53f9ff01c8c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24348</id>
    <title>Important: postgresql-jdbc security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-08-12 08:48:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql-jdbc security update</summary>
    <description>PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.  

Security Fix(es):  

  * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24348" id="RHSA-2026:24348" type="rhsa" title="RHSA-2026:24348"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42198" id="CVE-2026-42198" type="cve" title="CVE-2026-42198"/>
      <reference href="https://bugzilla.redhat.com/2463857" id="2463857" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24348.html" id="ALSA-2026:24348" type="self" title="ALSA-2026:24348"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="postgresql-jdbc" version="42.7.2" release="1.el10_2.2" epoch="0" arch="noarch" src="postgresql-jdbc-42.7.2-1.el10_2.2.src.rpm">
          <filename>postgresql-jdbc-42.7.2-1.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">12ad5a0377cc543161f693dbedf80444ce6430610d3c37c638d24895a91baf32</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24470</id>
    <title>Important: podman security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-06-11 08:50:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24470" id="RHSA-2026:24470" type="rhsa" title="RHSA-2026:24470"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24470.html" id="ALSA-2026:24470" type="self" title="ALSA-2026:24470"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="podman-remote" version="5.8.2" release="3.el10_2.alma.1" epoch="7" arch="x86_64_v2" src="podman-5.8.2-3.el10_2.alma.1.src.rpm">
          <filename>podman-remote-5.8.2-3.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">aee1eee7dc6b89edf651633fb3a3a59a6abe78843e354549d0a205e13dff5cad</sum>
        </package>
        <package name="podman-docker" version="5.8.2" release="3.el10_2.alma.1" epoch="7" arch="noarch" src="podman-5.8.2-3.el10_2.alma.1.src.rpm">
          <filename>podman-docker-5.8.2-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">e205f2f26c5534f264de80514cb994d72b05f6a8fdd0b52239e7998ed355f6cd</sum>
        </package>
        <package name="podman" version="5.8.2" release="3.el10_2.alma.1" epoch="7" arch="x86_64_v2" src="podman-5.8.2-3.el10_2.alma.1.src.rpm">
          <filename>podman-5.8.2-3.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">f1cca6c3d8586522e357ae5d7ea92fdf3a4b222e868526b420875cdda8b92875</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24758</id>
    <title>Important: libyang security update</title>
    <issued date="2026-06-09 00:00:00"/>
    <updated date="2026-07-08 11:51:32"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libyang security update</summary>
    <description>Libyang is YANG data modeling language parser and toolkit written (and providing API) in C.  

Security Fix(es):  

  * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24758" id="RHSA-2026:24758" type="rhsa" title="RHSA-2026:24758"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44673" id="CVE-2026-44673" type="cve" title="CVE-2026-44673"/>
      <reference href="https://bugzilla.redhat.com/2477617" id="2477617" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24758.html" id="ALSA-2026:24758" type="self" title="ALSA-2026:24758"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libyang" version="2.1.148" release="4.el10_2" epoch="0" arch="x86_64_v2" src="libyang-2.1.148-4.el10_2.src.rpm">
          <filename>libyang-2.1.148-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d2cc6334f49facc52a6ccbb3ea2c9292907efdcb222a73689f7b7095db5deac0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24985</id>
    <title>Important: poppler security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:51:32"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>poppler security update</summary>
    <description>Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.  

Security Fix(es):  

  * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24985" id="RHSA-2026:24985" type="rhsa" title="RHSA-2026:24985"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10118" id="CVE-2026-10118" type="cve" title="CVE-2026-10118"/>
      <reference href="https://bugzilla.redhat.com/2460428" id="2460428" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24985.html" id="ALSA-2026:24985" type="self" title="ALSA-2026:24985"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="poppler-qt6" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-qt6-24.02.0-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">14cde8cc52188ee609acac05c78c653c76c304045a519823140c5673c5bde60c</sum>
        </package>
        <package name="poppler" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-24.02.0-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">38a1245eb58b5004b344676b8f53fbc1ceb9cfde2b6a115ad12aee7632db539f</sum>
        </package>
        <package name="poppler-cpp" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-cpp-24.02.0-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">5c61c163bfbb035fb8b04073120cd844414227d973a43dc2e136b244d2d49415</sum>
        </package>
        <package name="poppler-glib" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-glib-24.02.0-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">89250732893718850ee028135d66bc5ed3babf58ffd2713a76239bcf91051280</sum>
        </package>
        <package name="poppler-utils" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-utils-24.02.0-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">e3b8a6da5f1c1678f661f1ae9947208773140a4054d1170c2477033513670f83</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25111</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:46:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 8.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):  

  * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25111" id="RHSA-2026:25111" type="rhsa" title="RHSA-2026:25111"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591"/>
      <reference href="https://bugzilla.redhat.com/2487164" id="2487164" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487224" id="2487224" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25111.html" id="ALSA-2026:25111" type="self" title="ALSA-2026:25111"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="aspnetcore-runtime-dbg-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2574cf8e66bd166d9cd647f8ec64e86fbe4913160a5a13a742f0aca99c07434c</sum>
        </package>
        <package name="dotnet-templates-8.0" version="8.0.128" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.128-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2af5f7917ee004bc0951bf4b59a4dbd48712c8fc843dd577ce0ba165dc8bf3a8</sum>
        </package>
        <package name="dotnet-runtime-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.28-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">51abcce63bf5e618c43707cc06beb10b71fd2bc499b3ac2d2a6d79617bc7bda5</sum>
        </package>
        <package name="dotnet-sdk-8.0" version="8.0.128" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.128-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">62074cf4c4280ae7305e8e5f734ec0b4e28e7b4d91ac94589fddd308b7d1e3dc</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" version="8.0.128" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.128-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">75cafab568d5f98ea5b1ff766fe1778484fa0cc47538925a831bc955fe0d2386</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.28-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7f66ca428b6fa16ca5b2ce472c72d98eabb149852128b7bdeed6c5170f586b35</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.28-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">941ea62a021741b359f0239213ab99d4744ca89f88367216bfa2047489a57341</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.28-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9be392eb5f229f1e1a9b293b31b4fd644b1b3fa5be410b5bccca179b231fed74</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.28-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b472cb4e663dc65fc86d757ddd46ebb1787e87f6ceee5b62c4212e61fc446f11</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.28-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d63783a7812d995916deb0843fa2747029ee2a2c81ea789a88b5f03e16fa8477</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.28-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fe0cfbb07ffdc5a0d97b8895cfaaf72933086f1eb6aca375d08326422ce1c7f1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25112</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:44:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 9.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):  

  * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25112" id="RHSA-2026:25112" type="rhsa" title="RHSA-2026:25112"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591"/>
      <reference href="https://bugzilla.redhat.com/2487164" id="2487164" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487224" id="2487224" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25112.html" id="ALSA-2026:25112" type="self" title="ALSA-2026:25112"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="aspnetcore-runtime-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">067f2b4c11f16adc80d3a2f6228b1b86ab56c3cda52cac2448a2a8c3cd1f5adb</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2579da610a121a5e9c629af5cc5dade0905c1c0b722820b2fe5e57b74953d9f4</sum>
        </package>
        <package name="dotnet-templates-9.0" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.118-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">343025e058285aa29eb862543d62284f46e8c5ea7e5e3d007df0124deae72b04</sum>
        </package>
        <package name="dotnet-runtime-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3f46da42ea2afc9764a0e67304a24370cd1cf7191013eed69d93bf8dc93c8854</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3ffceb6140cbdc7947a92e2805b7bd31271fafdf78cb0427c20adc7cea351969</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8c7ee2ae55346182b6a966012ecf4ac2fbe172051c5a0089b5c407291278f8a1</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8f8dc63c5e1767e60707766b7a56cd69724d47cefce62ac11cf791bdeb4bb5a4</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.118-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">986a0fa4d033fb7e79fb8153797bcda8eb3efb33dd9c2933e0a685052b1c7fcf</sum>
        </package>
        <package name="dotnet-sdk-9.0" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.118-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b5eb9a6f5519de5959d4c5fd48346bf7e3c7458d662870cc00e6f52a35e91a4a</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.118-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c300e33ce61c58dc6c8bfebf31332e82d9c382fca7b4058a0aefe0ba04ab6bbb</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f0a1a38e7ccb478a687931af8e98efa7fc67ab3acc3992c2f0bb84ac2c5af187</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f844c97ed84a085a8968e54c13dce8a3c2a6b35bd938a58e7b0d584f465a76c4</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.118-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fe1fb20a53d536dad51a28678d42a3e0f846ffa4c81ba8e686f8db094a25f763</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25115</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:43:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 10.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):  

  * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25115" id="RHSA-2026:25115" type="rhsa" title="RHSA-2026:25115"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591"/>
      <reference href="https://bugzilla.redhat.com/2487164" id="2487164" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487224" id="2487224" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25115.html" id="ALSA-2026:25115" type="self" title="ALSA-2026:25115"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dotnet-hostfxr-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1ca57f1f2540dcaa17ef3146944255f599a5afd13d60a8674bec47975e910647</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">29dfd4c0857a95c8215b139643c894234edcd3755df26e8a4f4931fb0cb7da7f</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">96f6c4ebc41a9f8eb9b41a38d19e0022cd631f6bb1c608a1f1ecbfccc73a4ff2</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9e8bbf9ee25f9031a16b605fafab8623a8c930a0c6956be76a2071781677f939</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a0cfceb0db2d1fad25068e6b0e7f639bd4390aa72098e5556aee5f1bbeb800ea</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" version="10.0.109" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.109-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a2a8496e33bbb2960f2c4e65701ea7ae34ead14c8bf0b24396901cf9c0678a00</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b0fce5e40b2bebb55752181986e891badb2262416935631d6b2dd824776e7696</sum>
        </package>
        <package name="dotnet-host" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c2d7f156c3d432b8002cc6fe6de55ccb36cc149de0972a47fbf1f55129060022</sum>
        </package>
        <package name="dotnet-runtime-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c80ecb08315e85b6b073722130ef553b61748bdc110b8e0aafd139e3b5472587</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d8205aee6b6874d8f1aa3fbb6ff7e3da9ee7df7616869a0fab4173cf26603274</sum>
        </package>
        <package name="dotnet-sdk-10.0" version="10.0.109" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.109-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d93b4a95308cea3d8ff49d5328f8ae77ce02aef1337acd9eb034bab70a058db4</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" version="10.0.109" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.109-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f436db69878fc3c482dbfc9c005209542d4d52078b2f945350d22dd41b057a3c</sum>
        </package>
        <package name="dotnet-templates-10.0" version="10.0.109" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.109-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fb1c2a9fdd1f9c3dbbb22e3c5105ca76caa529896542223356bb43940af02319</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25191</id>
    <title>Critical: kernel security update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-06-11 17:37:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
  * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467)
  * kernel: can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CVE-2026-31532)
  * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
  * kernel: ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (CVE-2026-43037)
  * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
  * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25191" id="RHSA-2026:25191" type="rhsa" title="RHSA-2026:25191"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31419" id="CVE-2026-31419" type="cve" title="CVE-2026-31419"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31467" id="CVE-2026-31467" type="cve" title="CVE-2026-31467"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31532" id="CVE-2026-31532" type="cve" title="CVE-2026-31532"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31581" id="CVE-2026-31581" type="cve" title="CVE-2026-31581"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43037" id="CVE-2026-43037" type="cve" title="CVE-2026-43037"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43501" id="CVE-2026-43501" type="cve" title="CVE-2026-43501"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46054" id="CVE-2026-46054" type="cve" title="CVE-2026-46054"/>
      <reference href="https://bugzilla.redhat.com/2457829" id="2457829" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460616" id="2460616" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461107" id="2461107" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461471" id="2461471" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464351" id="2464351" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480457" id="2480457" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482025" id="2482025" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25191.html" id="ALSA-2026:25191" type="self" title="ALSA-2026:25191"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.22.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1cb3d93030aca010c6182c61bd262ffa6d526fb1b80f5cac5d3a4e0ddfd0923a</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.22.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">20c3ac2c2aaca0f20170b75f85396b671aeb48a0a261b6591bc8995edb031c72</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.22.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">374097805cf2416e04d61bd7c3b9d8d4419bf8d927019f57c1545b284ff2f840</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.22.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">480f5246ed270802bb9d8c0413b062c3d8414cf0085d76038f6cd223f56bbdee</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.22.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a330d1903076a9965202b327afdcdb94763db1760021eec8db46c9535cc08c46</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.22.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">aa613cd63a61d8e33b8381b92ea3a55fa79ae5f3e93af7987cceea95cfb4d4de</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.22.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b4a195e658481e21fa669153fd6bf7ea719c20882d491a7a94cc80f2e44b2d5a</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.22.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c8dc36147e3404434f805b8b462620bfecb017df255f213a2fd8bea0eb70114e</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.22.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">de09fcd6ba6aa164da4ae357786cc2a5fe3cc3806643993e8e4faf2e296727cd</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.22.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fdb589f91be0b0336a9d62921d7f246783451f731db913bcd52c0293d0d3b6a9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25216</id>
    <title>Important: valkey security update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-08-13 08:21:05"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>valkey security update</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.  

Security Fix(es):  

  * redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)
  * redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)
  * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25216" id="RHSA-2026:25216" type="rhsa" title="RHSA-2026:25216"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23479" id="CVE-2026-23479" type="cve" title="CVE-2026-23479"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23631" id="CVE-2026-23631" type="cve" title="CVE-2026-23631"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25243" id="CVE-2026-25243" type="cve" title="CVE-2026-25243"/>
      <reference href="https://bugzilla.redhat.com/2466780" id="2466780" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2466788" id="2466788" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2466828" id="2466828" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25216.html" id="ALSA-2026:25216" type="self" title="ALSA-2026:25216"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="valkey" version="8.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="valkey-8.0.9-1.el10_2.src.rpm">
          <filename>valkey-8.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7439c27e4d95d3b500854184556b632a6e5a325eab32142c1b232a580ac44e6a</sum>
        </package>
        <package name="valkey-devel" version="8.0.9" release="1.el10_2" epoch="0" arch="x86_64_v2" src="valkey-8.0.9-1.el10_2.src.rpm">
          <filename>valkey-devel-8.0.9-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c66aef2dd0d626eb3afccd2780a6fc5e4d03f11dab1721a0bf27b84994842ba2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25225</id>
    <title>Important: mod_http2 security update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-06-11 20:30:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>mod_http2 security update</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.  

Security Fix(es):  

  * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25225" id="RHSA-2026:25225" type="rhsa" title="RHSA-2026:25225"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-49975" id="CVE-2026-49975" type="cve" title="CVE-2026-49975"/>
      <reference href="https://bugzilla.redhat.com/2485371" id="2485371" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25225.html" id="ALSA-2026:25225" type="self" title="ALSA-2026:25225"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mod_http2" version="2.0.29" release="4.el10_2.1" epoch="0" arch="x86_64_v2" src="mod_http2-2.0.29-4.el10_2.1.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">d715908169ddbe86dbb7dc171384ab7a218aca1d85b7e2f419fede78119d2399</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25237</id>
    <title>Important: openssl security update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-06-11 18:18:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>openssl security update</summary>
    <description>OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  

Security Fix(es):  

  * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)
  * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)
  * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)
  * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)
  * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)
  * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)
  * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)
  * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)
  * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)
  * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)
  * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)
  * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)
  * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)
  * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)
  * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25237" id="RHSA-2026:25237" type="rhsa" title="RHSA-2026:25237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34180" id="CVE-2026-34180" type="cve" title="CVE-2026-34180"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34181" id="CVE-2026-34181" type="cve" title="CVE-2026-34181"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34182" id="CVE-2026-34182" type="cve" title="CVE-2026-34182"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34183" id="CVE-2026-34183" type="cve" title="CVE-2026-34183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42764" id="CVE-2026-42764" type="cve" title="CVE-2026-42764"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42766" id="CVE-2026-42766" type="cve" title="CVE-2026-42766"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42767" id="CVE-2026-42767" type="cve" title="CVE-2026-42767"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42768" id="CVE-2026-42768" type="cve" title="CVE-2026-42768"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42769" id="CVE-2026-42769" type="cve" title="CVE-2026-42769"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42770" id="CVE-2026-42770" type="cve" title="CVE-2026-42770"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45445" id="CVE-2026-45445" type="cve" title="CVE-2026-45445"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45446" id="CVE-2026-45446" type="cve" title="CVE-2026-45446"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45447" id="CVE-2026-45447" type="cve" title="CVE-2026-45447"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7383" id="CVE-2026-7383" type="cve" title="CVE-2026-7383"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9076" id="CVE-2026-9076" type="cve" title="CVE-2026-9076"/>
      <reference href="https://bugzilla.redhat.com/2481879" id="2481879" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481880" id="2481880" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481881" id="2481881" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481882" id="2481882" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481884" id="2481884" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481885" id="2481885" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481887" id="2481887" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481890" id="2481890" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481891" id="2481891" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481892" id="2481892" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481893" id="2481893" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481894" id="2481894" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481896" id="2481896" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481897" id="2481897" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481898" id="2481898" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25237.html" id="ALSA-2026:25237" type="self" title="ALSA-2026:25237"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="openssl-devel" version="3.5.5" release="4.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="openssl-3.5.5-4.el10_2.alma.1.src.rpm">
          <filename>openssl-devel-3.5.5-4.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1bf2da08983b30e809f0ceb67ee5bf0a4bedca638caebbeadacc422852cb93f9</sum>
        </package>
        <package name="openssl-perl" version="3.5.5" release="4.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="openssl-3.5.5-4.el10_2.alma.1.src.rpm">
          <filename>openssl-perl-3.5.5-4.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b88d5b32017d6a101dedc3bcbc4b7c9fc9058a1efcb98ee7b5272e756834c703</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25341</id>
    <title>Important: tomcat9 update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-07-08 11:54:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>tomcat9 update</summary>
    <description>Certificate revocation bypass due to improper OCSP response validation
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25341" id="RHSA-2026:25341" type="rhsa" title="RHSA-2026:25341"/>
      <reference href="https://bugzilla.redhat.com/2440426" id="2440426" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25341.html" id="ALSA-2026:25341" type="self" title="ALSA-2026:25341"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="tomcat9" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">05aa3bf0312387311b2ebee667eac72d7e7edec61d6304c2887bb89dce956ef9</sum>
        </package>
        <package name="tomcat9-lib" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-lib-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">112016e28c5036aafd2dc2c8c1106032281ee655ecf0ed4660e6a407a2be6530</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">20c189635df0064ff555758bfe0c95f21fb6875882b9d0af0d6a358047d9cf2b</sum>
        </package>
        <package name="tomcat9-webapps" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">4c2a31f2ac55f524c85ddedcf6348fb52bf25e3a8c51aa42bd636a679bc061ba</sum>
        </package>
        <package name="tomcat9-docs-webapp" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">69e8e77be4f060182be8e233a029cdac2dc6d78e5dede107e51f129760e53834</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8f03c1fb22b9b899ba5241ba26943941828f4092d11c3bf45acdfe457b177f1b</sum>
        </package>
        <package name="tomcat9-admin-webapps" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">cc3072eda709f80d8c5d5b108fe2a57d3bcc068e817a6dad877191d45431c79c</sum>
        </package>
        <package name="tomcat9-el-3.0-api" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">e88ff8acc2245391a6ac44a4bfd50bed1fb73d897208fbb93ff98452651fb8d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25902</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-06-15 00:00:00"/>
    <updated date="2026-07-17 10:20:46"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>fence-agents security update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   

Security Fix(es):  

  * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25902" id="RHSA-2026:25902" type="rhsa" title="RHSA-2026:25902"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48526" id="CVE-2026-48526" type="cve" title="CVE-2026-48526"/>
      <reference href="https://bugzilla.redhat.com/2482734" id="2482734" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25902.html" id="ALSA-2026:25902" type="self" title="ALSA-2026:25902"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="ha-cloud-support" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>ha-cloud-support-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">0113f99660888c92e115c3fcde06e4af710b09416785cf04121f29afd9b50323</sum>
        </package>
        <package name="fence-agents-scsi" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-scsi-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">09ff1477d7c24e095b83789574d84696975330f2d0de542d54792c26e7974c16</sum>
        </package>
        <package name="fence-agents-lpar" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-lpar-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">12c9076e50ad52eac0fa9c9653ce73fa79643aee1f969bc507af2d7ff138569a</sum>
        </package>
        <package name="fence-virtd-tcp" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-tcp-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">173fdf0da0e179982c8c34392a8dc6e2f3105b6b2f28e54e1e4c97d04dec7498</sum>
        </package>
        <package name="fence-agents-kdump" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-kdump-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">175655447b15b6a0b111c7577a5ba88b85c73ae65ea73636bec8f9d1751babd0</sum>
        </package>
        <package name="fence-agents-openstack" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-openstack-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">2882b01780985c7c41964ea162e357935f0482e8fe02cb85ce9f63e9844dd423</sum>
        </package>
        <package name="fence-agents-apc-snmp" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">298e8d7a3cc1d82a186ff6a6892e4568c0979e88cd2baebaf8d23a9e24fea0a9</sum>
        </package>
        <package name="fence-agents-eaton-snmp" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3e29269bd4baea6327c3f106e567ba79252914196c7d9d6de1691b9b887f5016</sum>
        </package>
        <package name="fence-agents-ifmib" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3eae36839b0c37587393fedd0a94d391c7c1b32d4e0038aeb872ce77dcbeac65</sum>
        </package>
        <package name="fence-agents-drac5" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-drac5-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3fd2c64de218b8f14a264b6d4c513527490c25f44ac7974c6ef31fb84798dd4c</sum>
        </package>
        <package name="fence-agents-redfish" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-redfish-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">44a74f674cb2ea65cc5e200609eb426cea14bff6ce827d5f64fc621aeed2204c</sum>
        </package>
        <package name="fence-virtd-libvirt" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-libvirt-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">4e8a3f9ea6728c4db89bde63f8e325ff56daf42bb9de59360eb7f88c9a102c8e</sum>
        </package>
        <package name="fence-agents-eps" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-eps-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">50471bc1d7292ee0054f58620f7119f9f2224ef4260b8a953fba66633ec4adc0</sum>
        </package>
        <package name="fence-agents-rhevm" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">526fcda8f27eca140ad19bc1b50f05fde1e332027a94e23cb2595e6544c91903</sum>
        </package>
        <package name="fence-agents-azure-arm" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-azure-arm-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">5b5581bc2f9fcea1e3f20cd9978f90aab4cc0f1de5d01c6bfaf14ae23026f80c</sum>
        </package>
        <package name="fence-agents-cisco-ucs" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">5f0c4629ad31c1b9bd98c26300a2555a858e7da9be98323d3705bb2a17d23d33</sum>
        </package>
        <package name="fence-agents-apc" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-apc-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">600b0a86968f0aaae3296c8da0b70e18f2cc7836e9b007c314dafa38da84a8be</sum>
        </package>
        <package name="fence-agents-ibmblade" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">614315d7378c63e0844826317ca53254844a3938c32f3665bf1df10dacb31d62</sum>
        </package>
        <package name="fence-agents-ilo-mp" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">6731b497ac7785ff2dfa81e440a312e85ac8e725199bb261a3290e15f4a3d6d5</sum>
        </package>
        <package name="fence-agents-ibm-powervs" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">6ce383af0646539baeb184e2641a29ae6df028240286e91f57c016285057771a</sum>
        </package>
        <package name="fence-agents-ipdu" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">8368915fb9a5f0e382da7f974a5e4bad3c7a34142bd9ce52c57c100697a5e366</sum>
        </package>
        <package name="fence-virtd-multicast" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-multicast-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">84a49bc8dababc015caeed73a50fe9b653581aa16a3086c3327d4c32c41659a9</sum>
        </package>
        <package name="fence-agents-kubevirt" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">8eb255ea9752793c5fe191e56ecf08707938e91c29cbb4dbedbe5dd865d77657</sum>
        </package>
        <package name="fence-agents-aliyun" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-aliyun-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">8ff0f83fe41b1456ff44b3b2674946e711ce67a7e783eaa03391f1b0a07b8d35</sum>
        </package>
        <package name="fence-agents-ilo-ssh" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">90c5f69dbd53eaddbb46b7de1584000376afcb442f82782208b63a07ddfc9bdf</sum>
        </package>
        <package name="fence-agents-gce" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-gce-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">90c99b6818842c3c6341f01ea0e34f3182ff57363899f58cad82c771d4ad78bb</sum>
        </package>
        <package name="fence-agents-nutanix-ahv" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-nutanix-ahv-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">970f4b76795e517102ff1e870b5e2a7be172ef477fd8821eb3e190b99f0af539</sum>
        </package>
        <package name="fence-agents-hpblade" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">a12bb2e9542b76485ce1221906f35e37ff7d6a8f2a241d21f6547347683b5a4a</sum>
        </package>
        <package name="fence-agents-vmware-rest" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">a236afaca18d09d042be0d498c52c254bca90aa39d7048b9c3d72fbe2a966a76</sum>
        </package>
        <package name="fence-agents-intelmodular" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">a2bd565e1af480ce00436ca7608818bf704d05480762acfa13b190ec1005bfcf</sum>
        </package>
        <package name="fence-virtd-serial" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-serial-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">ab12d9885a7a99f78ca702e7e452c0d6ccddc46c1d804edbc0abb87d5111c050</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">ab44451f3d94da168a7e3b360f7b9aedaa9e42107bdc97e68befbf4d4ee759d3</sum>
        </package>
        <package name="fence-virtd-cpg" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-cpg-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">ac4563702e1784f5dc36faaa9cbe9646120e6627f28986f6f001323a00da6182</sum>
        </package>
        <package name="fence-agents-common" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-common-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">aca6c4b908c587c1cc8255a9d5e1eb60dcfaa87f3a1416e39dcedcfd24ac14e8</sum>
        </package>
        <package name="fence-agents-mpath" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-mpath-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">b2ccee8dd645e52151c781abd778eb861ab3d54b5f99a252ce703f56bd144800</sum>
        </package>
        <package name="fence-agents-emerson" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-emerson-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">bab15153adfef696f0496913ac9161a048bd71b538b1691aa0bf3c8d8ada5590</sum>
        </package>
        <package name="fence-agents-brocade" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-brocade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">bb0c8a0011dacba56e4874d5634add35a6f754e354513e4b6cd736bfa70e0cf8</sum>
        </package>
        <package name="fence-agents-heuristics-ping" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">bce9f617920cf266311a3e70eabdf9efc748e71a34550fc398f1d09a1f866c3c</sum>
        </package>
        <package name="fence-agents-amt-ws" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">c1311ad03e9d6aaecf221246f0a33f34e04186c91c4f94936a73ce91f0b8db62</sum>
        </package>
        <package name="fence-agents-sbd" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-sbd-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">cf3c3cd8d2407a4b215021e252553d437c3251f3f621c8600b1df2d2bf4c1be4</sum>
        </package>
        <package name="fence-agents-rsb" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rsb-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d1087cec15bbee8464f580cd85448b7b671ec9b6b50e7f414c01cebf25a27af6</sum>
        </package>
        <package name="fence-agents-aws" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-aws-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">d39544a0d0112904c67834b49a0ebd765c5ff6999422fc823cdcd4855ac802d9</sum>
        </package>
        <package name="fence-agents-wti" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-wti-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d4442641c3bdb9695e3303315183f9df36ea59d0979749e0fa73a2dc062a307c</sum>
        </package>
        <package name="fence-agents-virsh" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-virsh-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d4ea6c9d27d6b72c2ec4588d5b86ece102a2e5b5189970f0da144bdea249084d</sum>
        </package>
        <package name="fence-agents-ilo2" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">db55586c824957f510c58c45bb2f1e13b97c5a8e23cec28841a2fde724ad0cd5</sum>
        </package>
        <package name="fence-agents-ipmilan" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">e115cb7a9584a1268df698f1c2808d858f01ae1dcaa9502ab776538cc16b7458</sum>
        </package>
        <package name="fence-agents-rsa" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rsa-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">e50d48d8913ec8dddde456634ae7d0fe1110e61c50c0b31dc281bfc30173a4bb</sum>
        </package>
        <package name="fence-agents-vmware-soap" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">e5953455691ce0520db86e36d4a0520df1aa88bd8345553743a6c5d9eab94360</sum>
        </package>
        <package name="fence-agents-all" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-all-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">e68307cd1927f8c05f52d157a2b99a239e0c6b3884e979b13a55e4a8ed8c61bb</sum>
        </package>
        <package name="fence-virtd" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">eb5197778eb9529e0f972d69f16bc0766ba25842865aeefad161132e64f1e4f9</sum>
        </package>
        <package name="fence-virt" version="4.16.0" release="21.el10_2.2" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virt-4.16.0-21.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">ee9e2aec6fbbd7f20567844c05cb645580c50096a925e709288c91425623fdd2</sum>
        </package>
        <package name="fence-agents-bladecenter" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">f2c5425b489f9273f19850815a2fd2af26422f93e9111fa72c09114aa8974593</sum>
        </package>
        <package name="fence-agents-cisco-mds" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">f65d2ca2ae09bc957279acfab3819afa89a6b4fad45c221655d3f53ba90126d5</sum>
        </package>
        <package name="fence-agents-ibm-vpc" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">f86bf5b2eee3fe4a01366a531f4012957b6b7a9030f7c02c9ebae1fda6d2874f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25930</id>
    <title>Important: postfix security update</title>
    <issued date="2026-06-15 00:00:00"/>
    <updated date="2026-06-15 14:20:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postfix security update</summary>
    <description>The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS.  

Security Fix(es):  

  * postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25930" id="RHSA-2026:25930" type="rhsa" title="RHSA-2026:25930"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43964" id="CVE-2026-43964" type="cve" title="CVE-2026-43964"/>
      <reference href="https://bugzilla.redhat.com/2466488" id="2466488" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25930.html" id="ALSA-2026:25930" type="self" title="ALSA-2026:25930"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="postfix" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64_v2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-3.8.5-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">140fc51d32189a003ee919f901d7d2601ace8c37c9ee08162e3e9dc058db8c5e</sum>
        </package>
        <package name="postfix-cdb" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64_v2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-cdb-3.8.5-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">21efadc6f1b9da65bff6c51474be2fe87c4b6f532e13d4622ddb519511a74987</sum>
        </package>
        <package name="postfix-lmdb" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64_v2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-lmdb-3.8.5-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2503908238192a2a36ddfe3902427b1a4efa7e5c5eb0e3dbe4a7ce8c125124fb</sum>
        </package>
        <package name="postfix-pgsql" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64_v2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-pgsql-3.8.5-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6c21b2395db85876eff9b1cb53735c693a7ef634a888d0d3c1ba0ed5ac6274ae</sum>
        </package>
        <package name="postfix-sqlite" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64_v2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-sqlite-3.8.5-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6c7f55a30eaf66530887e3ae8fc3f44e44899dceeda40ddeeaa536bc9ef0bfbb</sum>
        </package>
        <package name="postfix-perl-scripts" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64_v2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-perl-scripts-3.8.5-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">974c3218bde0323f099914ea73de7f09a1c9424375c31b799abc92fb7715bca1</sum>
        </package>
        <package name="postfix-ldap" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64_v2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-ldap-3.8.5-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a5688e90c6e0fb08b6ade2e5558e325729d4a7b0d867f48bac71ff209f7061a9</sum>
        </package>
        <package name="postfix-pcre" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64_v2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-pcre-3.8.5-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ab6c2f5868c62eb19109c1004a88c5d5ac831a83101ed9314d8ccd0dc8350178</sum>
        </package>
        <package name="postfix-mysql" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64_v2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-mysql-3.8.5-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b5221aba9850c298b89530c072f8361cf9f8413fe54c76f014636ce0309a62e6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25999</id>
    <title>Moderate: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-06-15 00:00:00"/>
    <updated date="2026-08-13 08:14:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>yggdrasil-worker-package-manager security update</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.  

Security Fix(es):  

  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25999" id="RHSA-2026:25999" type="rhsa" title="RHSA-2026:25999"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25999.html" id="ALSA-2026:25999" type="self" title="ALSA-2026:25999"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="yggdrasil-worker-package-manager" version="0.2.3" release="7.el10_2" epoch="0" arch="x86_64_v2" src="yggdrasil-worker-package-manager-0.2.3-7.el10_2.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-7.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">664a020789d16be0523501bbf4b65a7ce1c6d7642fb5dc4b1f431b75a193a50f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:26332</id>
    <title>Important: rsync security, bug fix, and enhancement update</title>
    <issued date="2026-06-16 00:00:00"/>
    <updated date="2026-06-17 09:40:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>rsync security, bug fix, and enhancement update</summary>
    <description>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  

Security Fix(es):  

  * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)
  * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)


Bug Fix(es) and Enhancement(s):  

  * Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:26332" id="RHSA-2026:26332" type="rhsa" title="RHSA-2026:26332"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29518" id="CVE-2026-29518" type="cve" title="CVE-2026-29518"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43618" id="CVE-2026-43618" type="cve" title="CVE-2026-43618"/>
      <reference href="https://bugzilla.redhat.com/2469054" id="2469054" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2469055" id="2469055" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-26332.html" id="ALSA-2026:26332" type="self" title="ALSA-2026:26332"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="rsync-rrsync" version="3.4.4" release="1.el10_2" epoch="0" arch="noarch" src="rsync-3.4.4-1.el10_2.src.rpm">
          <filename>rsync-rrsync-3.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">540a428308cad863c69c33ed960b0bc940301aa9b2b59258a14f1fc3273c97b0</sum>
        </package>
        <package name="rsync-daemon" version="3.4.4" release="1.el10_2" epoch="0" arch="noarch" src="rsync-3.4.4-1.el10_2.src.rpm">
          <filename>rsync-daemon-3.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">c41feb2a21f43ce9aa84fc833bcabb0d96f6b707a7ee6ccbb51ade3b02c7e18a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:26532</id>
    <title>Important: dracut security update</title>
    <issued date="2026-06-17 00:00:00"/>
    <updated date="2026-06-17 13:08:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dracut security update</summary>
    <description>The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.  

Security Fix(es):  

  * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:26532" id="RHSA-2026:26532" type="rhsa" title="RHSA-2026:26532"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6893" id="CVE-2026-6893" type="cve" title="CVE-2026-6893"/>
      <reference href="https://bugzilla.redhat.com/2459963" id="2459963" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-26532.html" id="ALSA-2026:26532" type="self" title="ALSA-2026:26532"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dracut-live" version="107" release="7.el10_2" epoch="0" arch="x86_64_v2" src="dracut-107-7.el10_2.src.rpm">
          <filename>dracut-live-107-7.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0be43fd2ba6a2c4bdad14d5d5f5d67d63c79f5d6d4aee2817dcb56728cde6931</sum>
        </package>
        <package name="dracut-caps" version="107" release="7.el10_2" epoch="0" arch="x86_64_v2" src="dracut-107-7.el10_2.src.rpm">
          <filename>dracut-caps-107-7.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d31095cf782de2ab3ae9f344c4b128af14f3ea330eda897e14ac48e402900bb4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:26566</id>
    <title>Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update</title>
    <issued date="2026-06-17 00:00:00"/>
    <updated date="2026-08-13 08:14:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>xorg-x11-server-Xwayland security, bug fix, and enhancement update</summary>
    <description>Xwayland is an X server for running X clients under Wayland.  

Security Fix(es):  

  * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256)
  * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257)
  * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258)
  * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259)
  * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260)
  * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261)
  * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262)
  * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263)
  * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264)


Bug Fix(es) and Enhancement(s):  

  * [xwayland] Backport other security fixes without a CVE assigned [almalinux-10.2.z] (JIRA:AlmaLinux-184290)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:26566" id="RHSA-2026:26566" type="rhsa" title="RHSA-2026:26566"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50256" id="CVE-2026-50256" type="cve" title="CVE-2026-50256"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50257" id="CVE-2026-50257" type="cve" title="CVE-2026-50257"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50258" id="CVE-2026-50258" type="cve" title="CVE-2026-50258"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50259" id="CVE-2026-50259" type="cve" title="CVE-2026-50259"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50260" id="CVE-2026-50260" type="cve" title="CVE-2026-50260"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50261" id="CVE-2026-50261" type="cve" title="CVE-2026-50261"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50262" id="CVE-2026-50262" type="cve" title="CVE-2026-50262"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50263" id="CVE-2026-50263" type="cve" title="CVE-2026-50263"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50264" id="CVE-2026-50264" type="cve" title="CVE-2026-50264"/>
      <reference href="https://bugzilla.redhat.com/2485380" id="2485380" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485382" id="2485382" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485383" id="2485383" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485384" id="2485384" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485385" id="2485385" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485386" id="2485386" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485387" id="2485387" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485388" id="2485388" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485389" id="2485389" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-26566.html" id="ALSA-2026:26566" type="self" title="ALSA-2026:26566"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="xorg-x11-server-Xwayland" version="24.1.9" release="4.el10_2.2" epoch="0" arch="x86_64_v2" src="xorg-x11-server-Xwayland-24.1.9-4.el10_2.2.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.9-4.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">43ddc3ce0e34f0e076fc1c9673a4521344eacae5b946a34c6dd298534dab5349</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27288</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-19 00:00:00"/>
    <updated date="2026-06-26 17:55:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
  * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
  * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
  * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
  * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
  * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
  * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
  * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
  * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
  * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
  * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
  * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
  * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
  * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
  * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)


Bug Fix(es) and Enhancement(s):  

  * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047)
  * AlmaLinux9.5 crash due to lpfc NULL ndlp-&gt;vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774)
  * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495)
  * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723)
  * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127)
  * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319)
  * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27288" id="RHSA-2026:27288" type="rhsa" title="RHSA-2026:27288"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31474" id="CVE-2026-31474" type="cve" title="CVE-2026-31474"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31641" id="CVE-2026-31641" type="cve" title="CVE-2026-31641"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31669" id="CVE-2026-31669" type="cve" title="CVE-2026-31669"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31772" id="CVE-2026-31772" type="cve" title="CVE-2026-31772"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31786" id="CVE-2026-31786" type="cve" title="CVE-2026-31786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31787" id="CVE-2026-31787" type="cve" title="CVE-2026-31787"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43056" id="CVE-2026-43056" type="cve" title="CVE-2026-43056"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43260" id="CVE-2026-43260" type="cve" title="CVE-2026-43260"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43330" id="CVE-2026-43330" type="cve" title="CVE-2026-43330"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46056" id="CVE-2026-46056" type="cve" title="CVE-2026-46056"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46125" id="CVE-2026-46125" type="cve" title="CVE-2026-46125"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46152" id="CVE-2026-46152" type="cve" title="CVE-2026-46152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46166" id="CVE-2026-46166" type="cve" title="CVE-2026-46166"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46173" id="CVE-2026-46173" type="cve" title="CVE-2026-46173"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46331" id="CVE-2026-46331" type="cve" title="CVE-2026-46331"/>
      <reference href="https://bugzilla.redhat.com/2460646" id="2460646" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461503" id="2461503" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461548" id="2461548" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464092" id="2464092" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464096" id="2464096" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464449" id="2464449" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464502" id="2464502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467083" id="2467083" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468061" id="2468061" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479492" id="2479492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482181" id="2482181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482563" id="2482563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482608" id="2482608" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482634" id="2482634" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482645" id="2482645" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27288.html" id="ALSA-2026:27288" type="self" title="ALSA-2026:27288"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.26.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">11db01dd6e6ddd890f4d22adb09a488c7d4dc0295f2128ecd209e94fadbced54</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.26.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1be6b18e68e5debbe3d4aff9d4d4f421f37391ac2831abc1433ef4a105415962</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.26.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3337363b32856ac5da1466ffd29501836176ac4cfedcddbe8add36075205bc77</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.26.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6641de6f207b9df806bd7929527ac0ca07685d6ff8602b25f06d490f3a9d88fe</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.26.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">97c6adf88d19f39d06ca54a7b07ce033e24fbb07ef58b8b5a7001451fbf6199d</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.26.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b20f585f282ae5e75342f11e4722f7bd8a22177341ec670be40f0253f11b97e7</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.26.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b6513ff4a3a32932ad011077db7cfa549922e1f8f72389ec320c5f7fbd8ac26f</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.26.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d490a10271c7eb4e77ba31a3fad5a936d282d1e22f2897201db871fbcc9f12f5</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.26.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ee45e769d3389ebcece49abfd6cc1e0e08f2c3d5e80bdc917910f004baf0ebcb</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.26.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f890df4e6e3830f103b7c9adbede3a66c1b536c8452bc484d876b86f7eec6850</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27733</id>
    <title>Important: firefox security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:17:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294)
  * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313)
  * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327)
  * firefox: thunderbird: JIT miscompilation in the DOM: Core &amp; HTML component (CVE-2026-12299)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312)
  * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328)
  * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310)
  * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325)
  * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295)
  * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289)
  * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315)
  * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307)
  * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305)
  * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308)
  * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324)
  * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304)
  * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291)
  * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27733" id="RHSA-2026:27733" type="rhsa" title="RHSA-2026:27733"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12289" id="CVE-2026-12289" type="cve" title="CVE-2026-12289"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12290" id="CVE-2026-12290" type="cve" title="CVE-2026-12290"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12291" id="CVE-2026-12291" type="cve" title="CVE-2026-12291"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12292" id="CVE-2026-12292" type="cve" title="CVE-2026-12292"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12294" id="CVE-2026-12294" type="cve" title="CVE-2026-12294"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12295" id="CVE-2026-12295" type="cve" title="CVE-2026-12295"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12296" id="CVE-2026-12296" type="cve" title="CVE-2026-12296"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12297" id="CVE-2026-12297" type="cve" title="CVE-2026-12297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12298" id="CVE-2026-12298" type="cve" title="CVE-2026-12298"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12299" id="CVE-2026-12299" type="cve" title="CVE-2026-12299"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12302" id="CVE-2026-12302" type="cve" title="CVE-2026-12302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12304" id="CVE-2026-12304" type="cve" title="CVE-2026-12304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12305" id="CVE-2026-12305" type="cve" title="CVE-2026-12305"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12306" id="CVE-2026-12306" type="cve" title="CVE-2026-12306"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12307" id="CVE-2026-12307" type="cve" title="CVE-2026-12307"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12308" id="CVE-2026-12308" type="cve" title="CVE-2026-12308"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12309" id="CVE-2026-12309" type="cve" title="CVE-2026-12309"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12310" id="CVE-2026-12310" type="cve" title="CVE-2026-12310"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12311" id="CVE-2026-12311" type="cve" title="CVE-2026-12311"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12312" id="CVE-2026-12312" type="cve" title="CVE-2026-12312"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12313" id="CVE-2026-12313" type="cve" title="CVE-2026-12313"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12314" id="CVE-2026-12314" type="cve" title="CVE-2026-12314"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12315" id="CVE-2026-12315" type="cve" title="CVE-2026-12315"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12324" id="CVE-2026-12324" type="cve" title="CVE-2026-12324"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12325" id="CVE-2026-12325" type="cve" title="CVE-2026-12325"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12327" id="CVE-2026-12327" type="cve" title="CVE-2026-12327"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12328" id="CVE-2026-12328" type="cve" title="CVE-2026-12328"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12329" id="CVE-2026-12329" type="cve" title="CVE-2026-12329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12330" id="CVE-2026-12330" type="cve" title="CVE-2026-12330"/>
      <reference href="https://bugzilla.redhat.com/2489207" id="2489207" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489208" id="2489208" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489209" id="2489209" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489210" id="2489210" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489211" id="2489211" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489212" id="2489212" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489214" id="2489214" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489215" id="2489215" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489217" id="2489217" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489218" id="2489218" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489220" id="2489220" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489221" id="2489221" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489223" id="2489223" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489224" id="2489224" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489225" id="2489225" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489226" id="2489226" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489229" id="2489229" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489231" id="2489231" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489232" id="2489232" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489233" id="2489233" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489234" id="2489234" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489235" id="2489235" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489236" id="2489236" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489237" id="2489237" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489239" id="2489239" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489240" id="2489240" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489243" id="2489243" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489244" id="2489244" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489248" id="2489248" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27733.html" id="ALSA-2026:27733" type="self" title="ALSA-2026:27733"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.12.0" release="1.el10_2" epoch="0" arch="x86_64_v2" src="firefox-140.12.0-1.el10_2.src.rpm">
          <filename>firefox-140.12.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9d70448273c1af22a299d2204265d4671fae685f4744e086febb9fff602e6168</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27742</id>
    <title>Important: postgresql18 security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-08-12 08:48:28"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql18 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475)
  * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)
  * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)
  * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27742" id="RHSA-2026:27742" type="rhsa" title="RHSA-2026:27742"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6473" id="CVE-2026-6473" type="cve" title="CVE-2026-6473"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6475" id="CVE-2026-6475" type="cve" title="CVE-2026-6475"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6477" id="CVE-2026-6477" type="cve" title="CVE-2026-6477"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6478" id="CVE-2026-6478" type="cve" title="CVE-2026-6478"/>
      <reference href="https://bugzilla.redhat.com/2477439" id="2477439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477442" id="2477442" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477447" id="2477447" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477448" id="2477448" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27742.html" id="ALSA-2026:27742" type="self" title="ALSA-2026:27742"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="postgresql18-server" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-server-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1ec150d8522056d1cb224718840492db2497675d4ccaca1797396691483c0dde</sum>
        </package>
        <package name="postgresql18-static" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-static-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2d163ec5fd9ea65ef359919f21c3e5217395dcb8f21a3e901b141737cd1641ea</sum>
        </package>
        <package name="postgresql18-private-libs" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-private-libs-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">306dcd7b016eeceef7674632b9d1bf6c1c485bcf65cda256514038ebeb07060a</sum>
        </package>
        <package name="postgresql18-plperl" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-plperl-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">386a8973db026feb4044ed4439e38bc49284a218e4f23f94d4c68095a0428de4</sum>
        </package>
        <package name="postgresql18-docs" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-docs-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3daa9751b0ae65c170e648744b756c97a28d70f018f7df06127021bc6c5c2284</sum>
        </package>
        <package name="postgresql18-contrib" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-contrib-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6f0afb3fa4c71476ad93fd74424cdaad542ec52bc45884db98b0c31f404886fa</sum>
        </package>
        <package name="postgresql18" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">82096761bb4497f97a56a4903c7465135d0523174eb6a782370038e7c19f3ab0</sum>
        </package>
        <package name="postgresql18-upgrade" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-upgrade-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">89d6ca29b7a3276b804d8c751af09cd6318b2fd27da92dd45fc42c59f79c4e56</sum>
        </package>
        <package name="postgresql18-upgrade-devel" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-upgrade-devel-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ab0a4d798e5ecea5099ad9d597f82ef4af6c4ddc6c293241bb5aeff07fb36a2e</sum>
        </package>
        <package name="postgresql18-plpython3" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-plpython3-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d63c40121b2d9d4bcdd5eeaf07f81624e6752d1e2edbb018822af561f7770799</sum>
        </package>
        <package name="postgresql18-private-devel" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-private-devel-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d70cb83a70e4fa7e823805ad8b168627d43adc79cce752e75c0127d6c720e9d3</sum>
        </package>
        <package name="postgresql18-server-devel" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-server-devel-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ee918307c9348394ad3bfe7c96f6bab5fcb27d03656989f65230697f9b982ac8</sum>
        </package>
        <package name="postgresql18-test" version="18.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-test-18.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ef8bc17dd914e66f23688e93f17ed14ada8c9d54c225b23ba8193a3fbbfda6dc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27743</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:14:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql16 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475)
  * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)
  * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)
  * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27743" id="RHSA-2026:27743" type="rhsa" title="RHSA-2026:27743"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6473" id="CVE-2026-6473" type="cve" title="CVE-2026-6473"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6475" id="CVE-2026-6475" type="cve" title="CVE-2026-6475"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6477" id="CVE-2026-6477" type="cve" title="CVE-2026-6477"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6478" id="CVE-2026-6478" type="cve" title="CVE-2026-6478"/>
      <reference href="https://bugzilla.redhat.com/2477439" id="2477439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477442" id="2477442" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477447" id="2477447" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477448" id="2477448" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27743.html" id="ALSA-2026:27743" type="self" title="ALSA-2026:27743"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="postgresql-server" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-server-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">00fa22a135d72911ce7986756892ceccd6967d189412698b7b379e0e748f46cc</sum>
        </package>
        <package name="postgresql-docs" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-docs-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">27867af6868f01f1e723a36e5e502a1d96784f2212cd9ffdae073230c54bfb6a</sum>
        </package>
        <package name="postgresql-plpython3" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-plpython3-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">296e4bb62688e678ed7aab282cdfa4e24b464c180b56a4918f63e6da9df5e563</sum>
        </package>
        <package name="postgresql-upgrade" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2c3d9284330417884d6280988c67ebcda3fc357e556a0820136d4f7114a24e2f</sum>
        </package>
        <package name="postgresql-contrib" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-contrib-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2e748207c224fc88407bdc0395ae52b653fbeb8b1408891c0e47a0247d5495c2</sum>
        </package>
        <package name="postgresql-pltcl" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-pltcl-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">45e4fb3525a97f216f0563bcc24e9ae15c3f491f32a04624a884b51daadda1c4</sum>
        </package>
        <package name="postgresql-private-libs" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-private-libs-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">584cb4bed4c44d79cc2e9f31889825855cb94eb07f6a7cbbe7dbcd7f8911b8a2</sum>
        </package>
        <package name="postgresql-upgrade-devel" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-devel-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5d94556b4da6d50f9f87d4fa32d7e51702284e4a1351fbf72053497313673307</sum>
        </package>
        <package name="postgresql-test" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-test-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">77ddd9c2f4bcefcf80242f569f7ee6c19462b42d27413508d1b3de054e464496</sum>
        </package>
        <package name="postgresql-private-devel" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-private-devel-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">89ff78f4b0e58bcdaeca01f15db501c3b7de2ae3fd997a3cac8a08a1c422d552</sum>
        </package>
        <package name="postgresql-static" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-static-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8a6f1d2f45aa825096b9755061dd3440279eb4a9c28fb2881e385db73367dda2</sum>
        </package>
        <package name="postgresql" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b63e31b29e4b0b656025c9581b0e7adfce121702dcf26875f04e33c01f8cb0e2</sum>
        </package>
        <package name="postgresql-server-devel" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-server-devel-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b7e27beb3890078cc73848481b3fee68356bbf2e49e28880730265283c730237</sum>
        </package>
        <package name="postgresql-plperl" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-plperl-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cc14ab4fde544e6111f0b1a1e6e867bad1524d6148ba340de66a2e920bf3cbc4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27842</id>
    <title>Important: memcached security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:11:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>memcached security update</summary>
    <description>memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.   

Security Fix(es):  

  * memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27842" id="RHSA-2026:27842" type="rhsa" title="RHSA-2026:27842"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47783" id="CVE-2026-47783" type="cve" title="CVE-2026-47783"/>
      <reference href="https://bugzilla.redhat.com/2480089" id="2480089" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27842.html" id="ALSA-2026:27842" type="self" title="ALSA-2026:27842"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="memcached-selinux" version="1.6.23" release="7.el10_2.1" epoch="0" arch="x86_64_v2" src="memcached-1.6.23-7.el10_2.1.src.rpm">
          <filename>memcached-selinux-1.6.23-7.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">2cf04e65428287f153351788dbbaabecb82387f6a159c65a8bb36d78546eae9a</sum>
        </package>
        <package name="memcached" version="1.6.23" release="7.el10_2.1" epoch="0" arch="x86_64_v2" src="memcached-1.6.23-7.el10_2.1.src.rpm">
          <filename>memcached-1.6.23-7.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7cfa85c9405fc603626263a4f2b1fb3472dbe09810d078d0f53859fece6f44c0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27929</id>
    <title>Important: python3.14-urllib3 security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:10:05"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14-urllib3 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)
  * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27929" id="RHSA-2026:27929" type="rhsa" title="RHSA-2026:27929"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44431" id="CVE-2026-44431" type="cve" title="CVE-2026-44431"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44432" id="CVE-2026-44432" type="cve" title="CVE-2026-44432"/>
      <reference href="https://bugzilla.redhat.com/2477154" id="2477154" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477167" id="2477167" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27929.html" id="ALSA-2026:27929" type="self" title="ALSA-2026:27929"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3.14-urllib3" version="2.6.3" release="2.el10_2" epoch="0" arch="noarch" src="python3.14-urllib3-2.6.3-2.el10_2.src.rpm">
          <filename>python3.14-urllib3-2.6.3-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">57130c6cb8bb3cf561d8de37fc42674c447fb5b7868aa36aa521c9f85eb9cdd9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28233</id>
    <title>Moderate: libpng security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:25:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libpng security update</summary>
    <description>The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.  

Security Fix(es):  

  * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
  * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28233" id="RHSA-2026:28233" type="rhsa" title="RHSA-2026:28233"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636"/>
      <reference href="https://bugzilla.redhat.com/2451805" id="2451805" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451819" id="2451819" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28233.html" id="ALSA-2026:28233" type="self" title="ALSA-2026:28233"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libpng-devel" version="1.6.40" release="11.el10_2.1" epoch="2" arch="x86_64_v2" src="libpng-1.6.40-11.el10_2.1.src.rpm">
          <filename>libpng-devel-1.6.40-11.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">6e09119dceec5719e20cc6015ac050b3885b59bf528d35a26b11ec6bfce43e99</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28234</id>
    <title>Low: libxml2 security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:26:49"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>libxml2 security update</summary>
    <description>The libxml2 library is a development toolbox providing the implementation of various XML standards.  

Security Fix(es):  

  * libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c (CVE-2024-34459)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28234" id="RHSA-2026:28234" type="rhsa" title="RHSA-2026:28234"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-34459" id="CVE-2024-34459" type="cve" title="CVE-2024-34459"/>
      <reference href="https://bugzilla.redhat.com/2280532" id="2280532" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28234.html" id="ALSA-2026:28234" type="self" title="ALSA-2026:28234"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libxml2-devel" version="2.12.5" release="10.el10_2.1" epoch="0" arch="x86_64_v2" src="libxml2-2.12.5-10.el10_2.1.src.rpm">
          <filename>libxml2-devel-2.12.5-10.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">935a9ff0cbdf596acdbfe5698b99a9a776ce99e30548600f7627e41224704a89</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28235</id>
    <title>Low: libtasn1 security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:25:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>libtasn1 security update</summary>
    <description>A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions.  

Security Fix(es):  

  * libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string (CVE-2025-13151)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28235" id="RHSA-2026:28235" type="rhsa" title="RHSA-2026:28235"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13151" id="CVE-2025-13151" type="cve" title="CVE-2025-13151"/>
      <reference href="https://bugzilla.redhat.com/2427698" id="2427698" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28235.html" id="ALSA-2026:28235" type="self" title="ALSA-2026:28235"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libtasn1-tools" version="4.20.0" release="5.el10_2" epoch="0" arch="x86_64_v2" src="libtasn1-4.20.0-5.el10_2.src.rpm">
          <filename>libtasn1-tools-4.20.0-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6087696f874919c9b7940341a1c872b870efcc922bda34f62a436b10a4ab5839</sum>
        </package>
        <package name="libtasn1-devel" version="4.20.0" release="5.el10_2" epoch="0" arch="x86_64_v2" src="libtasn1-4.20.0-5.el10_2.src.rpm">
          <filename>libtasn1-devel-4.20.0-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fdbe765d1ac2e295e1503e8d52e109cb5e4b4c76b9152410a158bcd34cd0951f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28236</id>
    <title>Moderate: libsolv security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:24:32"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libsolv security update</summary>
    <description>The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm.  

Security Fix(es):  

  * libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150)
  * libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (CVE-2026-9149)
  * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28236" id="RHSA-2026:28236" type="rhsa" title="RHSA-2026:28236"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48864" id="CVE-2026-48864" type="cve" title="CVE-2026-48864"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9149" id="CVE-2026-9149" type="cve" title="CVE-2026-9149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9150" id="CVE-2026-9150" type="cve" title="CVE-2026-9150"/>
      <reference href="https://bugzilla.redhat.com/2460379" id="2460379" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460380" id="2460380" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460425" id="2460425" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28236.html" id="ALSA-2026:28236" type="self" title="ALSA-2026:28236"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3-solv" version="0.7.33" release="5.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libsolv-0.7.33-5.el10_2.alma.1.src.rpm">
          <filename>python3-solv-0.7.33-5.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">d56e1078d09d8f30d9b0b2f04a74af4c9db55c5f74db6aca4e8520c09127fa33</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28581</id>
    <title>Important: python3.14 security, bug fix, and enhancement update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:23:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security, bug fix, and enhancement update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
  * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)


Bug Fix(es) and Enhancement(s):  

  * [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28581" id="RHSA-2026:28581" type="rhsa" title="RHSA-2026:28581"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6019" id="CVE-2026-6019" type="cve" title="CVE-2026-6019"/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460869" id="2460869" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28581.html" id="ALSA-2026:28581" type="self" title="ALSA-2026:28581"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3.14-tkinter" version="3.14.5" release="1.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.5-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1a5040a9d33bc7e064a240517699a3af0cfeb9704818ca0ac2540c8649efe130</sum>
        </package>
        <package name="python3.14" version="3.14.5" release="1.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-3.14.5-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2cc55bbac9a2a94c2957ed54e9172cbcb72ffc421a68fcce0d4837a06ca05ded</sum>
        </package>
        <package name="python3.14-libs" version="3.14.5" release="1.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.5-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">57f61771305c1c1934c72c2be0028fee24241912b780bc48951b4d96b4cb5dcd</sum>
        </package>
        <package name="python3.14-devel" version="3.14.5" release="1.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.5-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b29d4b3bd332cd0bcf9825cc26dcec24582b7f45bdc3e2d05d6c910264ed46c4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28582</id>
    <title>Moderate: keylime security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-08-13 08:14:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>keylime security update</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.  

Security Fix(es):  

  * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28582" id="RHSA-2026:28582" type="rhsa" title="RHSA-2026:28582"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6420" id="CVE-2026-6420" type="cve" title="CVE-2026-6420"/>
      <reference href="https://bugzilla.redhat.com/2458889" id="2458889" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28582.html" id="ALSA-2026:28582" type="self" title="ALSA-2026:28582"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="keylime" version="7.14.1" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-7.14.1-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1b1367ced566707e37fe1708297631a1c7e1dcd80fb664f53f5454ca96477b4c</sum>
        </package>
        <package name="keylime-base" version="7.14.1" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-base-7.14.1-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4eb62bd33dee595e8cda8773469696804a8c423cbaffdb7a127b06ae5287fe48</sum>
        </package>
        <package name="keylime-registrar" version="7.14.1" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-registrar-7.14.1-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">77bef8955aa78ae262f8974f44634e51123424f7e8984cc1d05b526c886cbc52</sum>
        </package>
        <package name="keylime-verifier" version="7.14.1" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-verifier-7.14.1-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7f54eb0faa1eda49969397d3b956c22f691fe00f54426eeeef1ce7d3a7b09a10</sum>
        </package>
        <package name="python3-keylime" version="7.14.1" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>python3-keylime-7.14.1-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b54322c9265eadf34404e7565566f3603bbea0ddffe1ae1f00e790dc069d6668</sum>
        </package>
        <package name="keylime-tenant" version="7.14.1" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-tenant-7.14.1-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">cc4b1b1ace432ad69b751aa4b6d82908255377819bccb76d75a7dcba2021ed0c</sum>
        </package>
        <package name="keylime-selinux" version="7.14.1" release="5.el10_2.1" epoch="0" arch="noarch" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-selinux-7.14.1-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">d087cd9f6da8c7f7422c92a84a47ffcc48661ffb612541d27410ec43622a490a</sum>
        </package>
        <package name="keylime-tools" version="7.14.1" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-tools-7.14.1-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">fddc6cc5b42386a2964d24db70feb5dc9185e4a0a0624923100e4915bdcb3744</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28584</id>
    <title>Moderate: libxslt security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:22:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libxslt security update</summary>
    <description>libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism.   

Security Fix(es):  

  * libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28584" id="RHSA-2026:28584" type="rhsa" title="RHSA-2026:28584"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-10911" id="CVE-2025-10911" type="cve" title="CVE-2025-10911"/>
      <reference href="https://bugzilla.redhat.com/2397838" id="2397838" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28584.html" id="ALSA-2026:28584" type="self" title="ALSA-2026:28584"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libxslt-devel" version="1.1.39" release="8.el10_2.1" epoch="0" arch="x86_64_v2" src="libxslt-1.1.39-8.el10_2.1.src.rpm">
          <filename>libxslt-devel-1.1.39-8.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1d9fdf995f6b45e6db71af3d9ac7547720ad404ed2bb8ecf651ae6ecf364dbed</sum>
        </package>
        <package name="libxslt" version="1.1.39" release="8.el10_2.1" epoch="0" arch="x86_64_v2" src="libxslt-1.1.39-8.el10_2.1.src.rpm">
          <filename>libxslt-1.1.39-8.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">bd0261e5ece10f3e91a0002507440f045a13d36bb294d36fdde43867d8a8611e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29035</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-06-24 00:00:00"/>
    <updated date="2026-06-25 10:06:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>skopeo security update</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.   

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29035" id="RHSA-2026:29035" type="rhsa" title="RHSA-2026:29035"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29035.html" id="ALSA-2026:29035" type="self" title="ALSA-2026:29035"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="skopeo" version="1.22.2" release="2.el10_2" epoch="2" arch="x86_64_v2" src="skopeo-1.22.2-2.el10_2.src.rpm">
          <filename>skopeo-1.22.2-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1fafaf114e5871acc504165258d14248e11072d251f61dd3f64c2e414192a0e4</sum>
        </package>
        <package name="skopeo-tests" version="1.22.2" release="2.el10_2" epoch="2" arch="x86_64_v2" src="skopeo-1.22.2-2.el10_2.src.rpm">
          <filename>skopeo-tests-1.22.2-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b045497ca0091ea144e214a47842febf59a23734f1b69370e32594f976e5e86b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29195</id>
    <title>Important: buildah security update</title>
    <issued date="2026-06-24 00:00:00"/>
    <updated date="2026-06-25 10:06:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>buildah security update</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29195" id="RHSA-2026:29195" type="rhsa" title="RHSA-2026:29195"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29195.html" id="ALSA-2026:29195" type="self" title="ALSA-2026:29195"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="buildah-tests" version="1.43.1" release="2.el10_2" epoch="2" arch="x86_64_v2" src="buildah-1.43.1-2.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a0c9735253d203822ffa794adb37394e5c3075f176c1eb4a22387da1d1625a2a</sum>
        </package>
        <package name="buildah" version="1.43.1" release="2.el10_2" epoch="2" arch="x86_64_v2" src="buildah-1.43.1-2.el10_2.src.rpm">
          <filename>buildah-1.43.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c4e7e8ae64143e695cc281c2c9a0e03c2505a014edf771a4c1d359b074089abe</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29874</id>
    <title>Important: nginx security update</title>
    <issued date="2026-06-25 00:00:00"/>
    <updated date="2026-06-26 12:49:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29874" id="RHSA-2026:29874" type="rhsa" title="RHSA-2026:29874"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9256" id="CVE-2026-9256" type="cve" title="CVE-2026-9256"/>
      <reference href="https://bugzilla.redhat.com/2480746" id="2480746" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29874.html" id="ALSA-2026:29874" type="self" title="ALSA-2026:29874"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nginx-mod-mail" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">2d2748b8a40ce4be5703a81cccbdbd366a84f458ab4a61225a2c0d31c27e75b1</sum>
        </package>
        <package name="nginx" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">37c1521119a6e98f7a29a11b166928d604fcffedcaf4c1f4f6e9fe1cf05c8b82</sum>
        </package>
        <package name="nginx-mod-http-image-filter" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">4cb622cc98417f5fc5573d41f7f3e62a4f368f148d433dfc879ad9fa77c45910</sum>
        </package>
        <package name="nginx-all-modules" version="1.26.3" release="6.el10_2.4" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">562b83c5c4657fa12e3561c30f43284f0fbc49e4d410c9f9b7f57f8dffef487c</sum>
        </package>
        <package name="nginx-filesystem" version="1.26.3" release="6.el10_2.4" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">9f23da9e2b3a022ca250a77c0fe4ad02e555ea9d6fc291bd81545b117d01a511</sum>
        </package>
        <package name="nginx-mod-http-perl" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">a90f9757438135a4897cffa5201c06773aa3902a258abc2a8c7d7c27c3c7d3be</sum>
        </package>
        <package name="nginx-mod-stream" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">e376147a8444373f17f8f97c29eb5fcb4e11deaa2e5921fa8756a7cbc6f8a0ef</sum>
        </package>
        <package name="nginx-core" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">e8943c6d4352d70164daa9b7591ea7759a618a066098068a002d359b2dc3bf24</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">f813b4b102649ca33506a470c2701111840eb4b5f1e91e11b586cf5cd1fc365d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29980</id>
    <title>Moderate: golang security, bug fix, and enhancement update</title>
    <issued date="2026-06-25 00:00:00"/>
    <updated date="2026-06-27 15:22:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>golang security, bug fix, and enhancement update</summary>
    <description>The golang packages provide the Go programming language compiler.  

Security Fix(es):  

  * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)


Bug Fix(es) and Enhancement(s):  

  * Update Go to version 1.26.4+1 [almalinux-10.2.z] (JIRA:AlmaLinux-183347)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29980" id="RHSA-2026:29980" type="rhsa" title="RHSA-2026:29980"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42507" id="CVE-2026-42507" type="cve" title="CVE-2026-42507"/>
      <reference href="https://bugzilla.redhat.com/2484205" id="2484205" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29980.html" id="ALSA-2026:29980" type="self" title="ALSA-2026:29980"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="golang-tests" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-tests-1.26.4-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">3726ef009f97fa8d5d3a2547243c897a2ad61b3d3bf8c47c5d2bf97663366857</sum>
        </package>
        <package name="golang-race" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-race-1.26.4-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">3bcb60481158d4c3bb4854db6dcd77aabf5fdcbf71b17bf9d9b553b52058d5aa</sum>
        </package>
        <package name="go-toolset" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>go-toolset-1.26.4-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">57dfb1db80dcee09537bed05ff063d028437c16313466e20e3a9b51250ad6cba</sum>
        </package>
        <package name="golang-docs" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-docs-1.26.4-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">833fa429b2a24d184ef4308625d865d9e06a1d3211c741a966b78c83ea469dd4</sum>
        </package>
        <package name="golang-misc" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-misc-1.26.4-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">902dcd6c5009e267bf17ad6a17c944bab1e8d0806d3951286a1e40c6bed7d271</sum>
        </package>
        <package name="golang-bin" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-bin-1.26.4-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9a014f4f2af2edbbb93b963a8f56751d22afa2f3b6d7d0fd4001f6ed0a76d547</sum>
        </package>
        <package name="golang-src" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-src-1.26.4-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">cfe20b9d0486e89e04d2f4b28058235230bff4d282b1571fc4c5279579e60d21</sum>
        </package>
        <package name="golang" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-1.26.4-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">d4c1722bc73076267a14837ef68ff8bc559422b04f1088c24093f4c574d3e670</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30129</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-25 00:00:00"/>
    <updated date="2026-06-27 12:59:51"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)
  * kernel: ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
  * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
  * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
  * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)
  * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
  * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
  * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)
  * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)


Bug Fix(es) and Enhancement(s):  

  * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30129" id="RHSA-2026:30129" type="rhsa" title="RHSA-2026:30129"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31636" id="CVE-2026-31636" type="cve" title="CVE-2026-31636"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43038" id="CVE-2026-43038" type="cve" title="CVE-2026-43038"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43198" id="CVE-2026-43198" type="cve" title="CVE-2026-43198"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43414" id="CVE-2026-43414" type="cve" title="CVE-2026-43414"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45898" id="CVE-2026-45898" type="cve" title="CVE-2026-45898"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46117" id="CVE-2026-46117" type="cve" title="CVE-2026-46117"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46135" id="CVE-2026-46135" type="cve" title="CVE-2026-46135"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46145" id="CVE-2026-46145" type="cve" title="CVE-2026-46145"/>
      <reference href="https://bugzilla.redhat.com/2461510" id="2461510" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464397" id="2464397" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467228" id="2467228" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468155" id="2468155" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482031" id="2482031" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482576" id="2482576" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482581" id="2482581" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482654" id="2482654" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30129.html" id="ALSA-2026:30129" type="self" title="ALSA-2026:30129"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3-perf" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.28.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">166619b4665dc8c4601668daf0762da81113f5b07aa822342b262d04379cd431</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.28.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">34f5e7d3e4004f8699de7e91de1428968ad9ced68bdf8ccdff86cfdb5473c486</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.28.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3886e14ac731a1dca19cce503de58ef3fc92cb2d5f092b9af9369e6b3963e862</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.28.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">679097924ce53640c4cc4124cba318fed64e6cfa1ce883d5118a272db4c3b681</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.28.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6def64e7998cfb5fdf439afa47519ddd880a39d50abb33c5098d3527dc0edcd9</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.28.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">7017f858229dac25fead46f7a86ea9f48bda9ff21527d8dafd2ca37464130d2e</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.28.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">77ca2b834409da2a07351695afd3211bc3d211ad67504b4ca7c96bc717c4adac</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.28.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">820e0a8eabff7653e0f12c5aa9492d72bda56fea3bcf07a0c3f0b421e1f5b86e</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.28.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">998bfb77a13b0c62809cfdcd16a6d838e87283725574ca68465bc1a5584331ef</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.28.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">abebc6a91be54cde259dc83a3d09a6a8e383fb366075b21091c3104c642e2ac6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30845</id>
    <title>Moderate: mod_md security update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 10:39:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>mod_md security update</summary>
    <description>This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.  

Security Fix(es):  

  * httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30845" id="RHSA-2026:30845" type="rhsa" title="RHSA-2026:30845"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29168" id="CVE-2026-29168" type="cve" title="CVE-2026-29168"/>
      <reference href="https://bugzilla.redhat.com/2466753" id="2466753" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30845.html" id="ALSA-2026:30845" type="self" title="ALSA-2026:30845"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mod_md" version="2.4.26" release="5.el10_2.1" epoch="1" arch="x86_64_v2" src="mod_md-2.4.26-5.el10_2.1.src.rpm">
          <filename>mod_md-2.4.26-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">523d61c77972b7497df3868dbc3686aa5e51a180e6f20dc3dc63743fd3ed44dc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30846</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-29 08:29:54"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>thunderbird security update</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.  

Security Fix(es):  

  * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294)
  * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313)
  * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327)
  * firefox: thunderbird: JIT miscompilation in the DOM: Core &amp; HTML component (CVE-2026-12299)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312)
  * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328)
  * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310)
  * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325)
  * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295)
  * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289)
  * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315)
  * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307)
  * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305)
  * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308)
  * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324)
  * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304)
  * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291)
  * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30846" id="RHSA-2026:30846" type="rhsa" title="RHSA-2026:30846"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12289" id="CVE-2026-12289" type="cve" title="CVE-2026-12289"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12290" id="CVE-2026-12290" type="cve" title="CVE-2026-12290"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12291" id="CVE-2026-12291" type="cve" title="CVE-2026-12291"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12292" id="CVE-2026-12292" type="cve" title="CVE-2026-12292"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12294" id="CVE-2026-12294" type="cve" title="CVE-2026-12294"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12295" id="CVE-2026-12295" type="cve" title="CVE-2026-12295"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12296" id="CVE-2026-12296" type="cve" title="CVE-2026-12296"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12297" id="CVE-2026-12297" type="cve" title="CVE-2026-12297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12298" id="CVE-2026-12298" type="cve" title="CVE-2026-12298"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12299" id="CVE-2026-12299" type="cve" title="CVE-2026-12299"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12302" id="CVE-2026-12302" type="cve" title="CVE-2026-12302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12304" id="CVE-2026-12304" type="cve" title="CVE-2026-12304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12305" id="CVE-2026-12305" type="cve" title="CVE-2026-12305"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12306" id="CVE-2026-12306" type="cve" title="CVE-2026-12306"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12307" id="CVE-2026-12307" type="cve" title="CVE-2026-12307"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12308" id="CVE-2026-12308" type="cve" title="CVE-2026-12308"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12309" id="CVE-2026-12309" type="cve" title="CVE-2026-12309"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12310" id="CVE-2026-12310" type="cve" title="CVE-2026-12310"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12311" id="CVE-2026-12311" type="cve" title="CVE-2026-12311"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12312" id="CVE-2026-12312" type="cve" title="CVE-2026-12312"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12313" id="CVE-2026-12313" type="cve" title="CVE-2026-12313"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12314" id="CVE-2026-12314" type="cve" title="CVE-2026-12314"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12315" id="CVE-2026-12315" type="cve" title="CVE-2026-12315"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12324" id="CVE-2026-12324" type="cve" title="CVE-2026-12324"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12325" id="CVE-2026-12325" type="cve" title="CVE-2026-12325"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12327" id="CVE-2026-12327" type="cve" title="CVE-2026-12327"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12328" id="CVE-2026-12328" type="cve" title="CVE-2026-12328"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12329" id="CVE-2026-12329" type="cve" title="CVE-2026-12329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12330" id="CVE-2026-12330" type="cve" title="CVE-2026-12330"/>
      <reference href="https://bugzilla.redhat.com/2489207" id="2489207" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489208" id="2489208" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489209" id="2489209" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489210" id="2489210" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489211" id="2489211" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489212" id="2489212" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489214" id="2489214" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489215" id="2489215" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489217" id="2489217" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489218" id="2489218" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489220" id="2489220" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489221" id="2489221" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489223" id="2489223" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489224" id="2489224" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489225" id="2489225" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489226" id="2489226" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489229" id="2489229" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489231" id="2489231" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489232" id="2489232" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489233" id="2489233" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489234" id="2489234" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489235" id="2489235" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489236" id="2489236" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489237" id="2489237" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489239" id="2489239" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489240" id="2489240" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489243" id="2489243" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489244" id="2489244" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489248" id="2489248" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30846.html" id="ALSA-2026:30846" type="self" title="ALSA-2026:30846"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="thunderbird" version="140.12.0" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="thunderbird-140.12.0-1.el10_2.alma.1.src.rpm">
          <filename>thunderbird-140.12.0-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">e8d5362229b3799983becba2823c5e9f7350877c6273155e7034be882fcce3a6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30855</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 10:36:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>git-lfs security update</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.  

Security Fix(es):  

  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30855" id="RHSA-2026:30855" type="rhsa" title="RHSA-2026:30855"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30855.html" id="ALSA-2026:30855" type="self" title="ALSA-2026:30855"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="git-lfs" version="3.7.1" release="5.el10_2.5" epoch="0" arch="x86_64_v2" src="git-lfs-3.7.1-5.el10_2.5.src.rpm">
          <filename>git-lfs-3.7.1-5.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">7a06f8183578a8ac07c3714f55b73bd56afe31eb1174e1cd6f27e2b8af0533c2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30857</id>
    <title>Important: perl-Archive-Tar security update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 10:44:29"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-Archive-Tar security update</summary>
    <description>Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.  

Security Fix(es):  

  * perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30857" id="RHSA-2026:30857" type="rhsa" title="RHSA-2026:30857"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42496" id="CVE-2026-42496" type="cve" title="CVE-2026-42496"/>
      <reference href="https://bugzilla.redhat.com/2481314" id="2481314" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30857.html" id="ALSA-2026:30857" type="self" title="ALSA-2026:30857"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="perl-Archive-Tar" version="3.02" release="512.el10_2.1" epoch="0" arch="noarch" src="perl-Archive-Tar-3.02-512.el10_2.1.src.rpm">
          <filename>perl-Archive-Tar-3.02-512.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e6efbbe6db7984a333245143097f48825a68f0f7cc2d488c57fd1eec9db1d08b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30860</id>
    <title>Important: perl-IO-Compress security update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 10:35:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-IO-Compress security update</summary>
    <description>This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. IO-Compress supports reading and writing of bzip2, RFC 1950, RFC 1951, RFC 1952 (i.e. gzip) and zip files/buffers. The following modules used to be distributed separately, but are now included with the IO-Compress distribution:  

  * Compress-Zlib
  * IO-Compress-Zlib
  * IO-Compress-Bzip2
  * IO-Compress-Base


Security Fix(es):  

  * perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30860" id="RHSA-2026:30860" type="rhsa" title="RHSA-2026:30860"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48962" id="CVE-2026-48962" type="cve" title="CVE-2026-48962"/>
      <reference href="https://bugzilla.redhat.com/2481767" id="2481767" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30860.html" id="ALSA-2026:30860" type="self" title="ALSA-2026:30860"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="perl-IO-Compress" version="2.212" release="512.el10_2.1" epoch="0" arch="noarch" src="perl-IO-Compress-2.212-512.el10_2.1.src.rpm">
          <filename>perl-IO-Compress-2.212-512.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">741508f5ad1fac081838f6f573ee7ee5aed1ab60be165fde7eab4c556b6b2f28</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33092</id>
    <title>Moderate: glibc security, bug fix, and enhancement update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 13:43:32"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security, bug fix, and enhancement update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450)


Bug Fix(es) and Enhancement(s):  

  * Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on AlmaLinux 10 [almalinux-10] (JIRA:AlmaLinux-174869)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33092" id="RHSA-2026:33092" type="rhsa" title="RHSA-2026:33092"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5450" id="CVE-2026-5450" type="cve" title="CVE-2026-5450"/>
      <reference href="https://bugzilla.redhat.com/2459853" id="2459853" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33092.html" id="ALSA-2026:33092" type="self" title="ALSA-2026:33092"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="glibc-doc" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-126.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">07f1c0fec3d86d729f94febb97a600a9829176f2de6b4eac4354dc95cf165db1</sum>
        </package>
        <package name="glibc-locale-source" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>glibc-locale-source-2.39-126.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">6c8e88fa2173545ef508eba54e6366f2ac809cd6737f39bddb44622ef1fac972</sum>
        </package>
        <package name="glibc-utils" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>glibc-utils-2.39-126.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9e97be68cb5aca9f2fe5ef963dc08457780a5d3c3fdd39f57116030649a45555</sum>
        </package>
        <package name="glibc-devel" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>glibc-devel-2.39-126.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">f10c872ef48d0904637dfaaaabf788dcf19bf7c378fb66adf2174466211d646e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33093</id>
    <title>Important: mariadb10.11 security, bug fix, and enhancement update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 10:36:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>mariadb10.11 security, bug fix, and enhancement update</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.  

Security Fix(es):  

  * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)


Bug Fix(es) and Enhancement(s):  

  * Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux10 (JIRA:AlmaLinux-183086)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33093" id="RHSA-2026:33093" type="rhsa" title="RHSA-2026:33093"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-49261" id="CVE-2026-49261" type="cve" title="CVE-2026-49261"/>
      <reference href="https://bugzilla.redhat.com/2487957" id="2487957" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33093.html" id="ALSA-2026:33093" type="self" title="ALSA-2026:33093"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mariadb-server-galera" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-server-galera-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">257517092416bb97bbfc4b236006cdb0309282b682bafecdaee09bde42a65de8</sum>
        </package>
        <package name="mariadb-client-utils" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-client-utils-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">2cdbcd312899147909ed6d6988350b3389283e5ee148d2fb5ff8bf2588d1c777</sum>
        </package>
        <package name="mariadb-oqgraph-engine" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-oqgraph-engine-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">3bde01f09e48272100fe36765e394a87f581c1a796af305416728df73d768e18</sum>
        </package>
        <package name="mariadb-test" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-test-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">49bc1c8cf85548f0a35b68c0ae07323d0b54496d59ddba01ef4bb261e3353d42</sum>
        </package>
        <package name="mariadb" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4bb48e1c6270648f32591f3d9aba6a1ad48c2327d947bcd3a231ee3816f8893a</sum>
        </package>
        <package name="mariadb-embedded-devel" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-embedded-devel-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4cc5c6fb7aa4378254f0db05c0dfe006b8a39fa4855ef3a7b4097d3fc97b5cd2</sum>
        </package>
        <package name="mariadb-common" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="noarch" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-common-10.11.18-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">681f8ea6830f9775d238ef434fe0cb1d7ae292f04e23bb51b564dd3396b48a53</sum>
        </package>
        <package name="mariadb-errmsg" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="noarch" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-errmsg-10.11.18-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">714e7719347d3e47e8ad2c0770a97c3dca85f00f5f67c30868bbc81cbeae8dea</sum>
        </package>
        <package name="mariadb-gssapi-server" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-gssapi-server-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">8457a4413ad6441c4533fb5f3e6eb025af8f28c10824dbf556e70aeb3f0840dc</sum>
        </package>
        <package name="mariadb-embedded" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-embedded-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">8c429704c3213a03eb6f1ccf248eb69373e1c7e96cb2bdab0ad2d44d2afe5e41</sum>
        </package>
        <package name="mariadb-pam" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-pam-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9493e05b18d2c743377c03cb691666531cfd858d0be5abc82ab485d1d8c6cb0e</sum>
        </package>
        <package name="mariadb-backup" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-backup-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">989d48ff744efe0e267e9956b806ecfa63964197900e0c49114cfcfc34eee7b5</sum>
        </package>
        <package name="mariadb-server-utils" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-server-utils-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">ca460ed61fb5badad77d5f11229575b080a91ff2e1825856d294bf9cf7d6afd5</sum>
        </package>
        <package name="mariadb-devel" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-devel-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">dea2546406679212d3caaa85ba9b158863340a093b1a6b7a14668c84e916efde</sum>
        </package>
        <package name="mariadb-server" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="x86_64_v2" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-server-10.11.18-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">fa3829147dc8f1142109f8dbbc718cb9fcf6c3977fe23dc6e6bc6145ad0ca5c3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33412</id>
    <title>Important: galera and mariadb11.8 security, bug fix, and enhancement update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-06-30 10:34:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>galera and mariadb11.8 security, bug fix, and enhancement update</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.  

Security Fix(es):  

  * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)


Bug Fix(es) and Enhancement(s):  

  * Rebase MariaDB 11.8 to 11.8.8 in AlmaLinux10 (JIRA:AlmaLinux-183084)
  * Rebase Galera to 26.4.27 in AlmaLinux10 (JIRA:AlmaLinux-183259)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33412" id="RHSA-2026:33412" type="rhsa" title="RHSA-2026:33412"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-49261" id="CVE-2026-49261" type="cve" title="CVE-2026-49261"/>
      <reference href="https://bugzilla.redhat.com/2487957" id="2487957" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33412.html" id="ALSA-2026:33412" type="self" title="ALSA-2026:33412"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mariadb11.8-test" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-test-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0d5336f75633c3e99ac54fb294be19de6329703e01a6f819ce5aa887eae78992</sum>
        </package>
        <package name="mariadb11.8-embedded" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-embedded-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">119b8635a3df4135b1e45b524dd9cf111c7b2c1c83e409f9d42b05053346311d</sum>
        </package>
        <package name="mariadb11.8-embedded-devel" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-embedded-devel-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1a193ea137287b97c274bedbebfc09bc5e4a6f9dd266543bbaa07997f6ab3535</sum>
        </package>
        <package name="mariadb11.8-client-utils" version="11.8.8" release="1.el10_2" epoch="3" arch="noarch" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-client-utils-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1b8213a94b5a803fee91159889715d18dce58d1206715acfe2ca987d9c88560c</sum>
        </package>
        <package name="mariadb11.8-backup" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-backup-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">298d1fda34be69112c9a3f762ac718dcd333d0f6e522b19bca87e46c15d3c037</sum>
        </package>
        <package name="mariadb11.8" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">475bd090087cfe499aa3993bf8b00c60a72f1e71b259d23e9814ae678039d24d</sum>
        </package>
        <package name="mariadb11.8-pam" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-pam-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5526a2b9b56c6600ec99a60f00490ff6d90ec10f03dad771136bc83b8d927041</sum>
        </package>
        <package name="mariadb11.8-server-galera" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-server-galera-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6db62f194e6877f25d1b65258c0b30629b1ce1fcef324266243206e3030af61f</sum>
        </package>
        <package name="mariadb11.8-oqgraph-engine" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-oqgraph-engine-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">853688e781256d6a26e0a9ec7f467ee5916a627dfb46fbc72b0932ff5aed24f1</sum>
        </package>
        <package name="mariadb11.8-server-utils" version="11.8.8" release="1.el10_2" epoch="3" arch="noarch" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-server-utils-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">9b959318939709d585735442a771104817080a3fa715a214b85e0185a5e94ac0</sum>
        </package>
        <package name="mariadb11.8-common" version="11.8.8" release="1.el10_2" epoch="3" arch="noarch" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-common-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">bf247857f833df313151be70c72cf6cc08b2708a50410ff68503d30347ea33e0</sum>
        </package>
        <package name="mariadb11.8-gssapi-server" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-gssapi-server-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c5c8bf9b3037eed4bc7e1322df2d05d051ce673848e8d60c9ff51471125178a0</sum>
        </package>
        <package name="mariadb11.8-errmsg" version="11.8.8" release="1.el10_2" epoch="3" arch="noarch" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-errmsg-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">cedb5ef493d966e6486d252d6067e6b53503d8ae6ebdb7dd3e8f68edfd7f05aa</sum>
        </package>
        <package name="mariadb11.8-devel" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-devel-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d8ab80bd89cd9d37b5b98788837ea1038417011375135494a1ee7c5a0fc2be16</sum>
        </package>
        <package name="mariadb11.8-server" version="11.8.8" release="1.el10_2" epoch="3" arch="x86_64_v2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-server-11.8.8-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dac45bed8beac340c99f5b062f30bf832f447f162ac17ecc315007ba3473ed5e</sum>
        </package>
        <package name="galera" version="26.4.27" release="1.el10_2" epoch="0" arch="x86_64_v2" src="galera-26.4.27-1.el10_2.src.rpm">
          <filename>galera-26.4.27-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dc0896eaff1cd93699ed6cfc179acfc1bf19c1b1aef15ccf158ed0ceb496b586</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33502</id>
    <title>Important: giflib security update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 10:17:59"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>giflib security update</summary>
    <description>giflib is a library for reading and writing gif images.  

Security Fix(es):  

  * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33502" id="RHSA-2026:33502" type="rhsa" title="RHSA-2026:33502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-26740" id="CVE-2026-26740" type="cve" title="CVE-2026-26740"/>
      <reference href="https://bugzilla.redhat.com/2448747" id="2448747" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33502.html" id="ALSA-2026:33502" type="self" title="ALSA-2026:33502"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="giflib" version="5.2.1" release="25.el10_2" epoch="0" arch="x86_64_v2" src="giflib-5.2.1-25.el10_2.src.rpm">
          <filename>giflib-5.2.1-25.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">105331590cc4914340b453820476b102cb584e054f312be2100fe9b538461922</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33540</id>
    <title>Important: ruby4.0 security update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 10:18:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ruby4.0 security update</summary>
    <description>Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.  

Security Fix(es):  

  * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245)
  * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258)
  * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33540" id="RHSA-2026:33540" type="rhsa" title="RHSA-2026:33540"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42245" id="CVE-2026-42245" type="cve" title="CVE-2026-42245"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42246" id="CVE-2026-42246" type="cve" title="CVE-2026-42246"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42258" id="CVE-2026-42258" type="cve" title="CVE-2026-42258"/>
      <reference href="https://bugzilla.redhat.com/2468495" id="2468495" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468498" id="2468498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468499" id="2468499" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33540.html" id="ALSA-2026:33540" type="self" title="ALSA-2026:33540"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="ruby4.0-devel" version="4.0.3" release="35.el10_2" epoch="0" arch="x86_64_v2" src="ruby4.0-4.0.3-35.el10_2.src.rpm">
          <filename>ruby4.0-devel-4.0.3-35.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">438c6d829ff8b81f0fabefbc80ea3cbb56e1c540b8a7c565f62d7fafe703d70a</sum>
        </package>
        <package name="ruby4.0-rubygem-pg" version="1.6.3" release="35.el10_2" epoch="0" arch="x86_64_v2" src="ruby4.0-4.0.3-35.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-pg-1.6.3-35.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7374ca8aaeb8bcc851ca7b24ac4cd7ec356dd68afacc9e7acef5ea6f9f715d2a</sum>
        </package>
        <package name="ruby4.0" version="4.0.3" release="35.el10_2" epoch="0" arch="x86_64_v2" src="ruby4.0-4.0.3-35.el10_2.src.rpm">
          <filename>ruby4.0-4.0.3-35.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a1ba6fa724f91eceec3596f29f004befad4497ba71dfb2b9c35759462e26852d</sum>
        </package>
        <package name="ruby4.0-rubygem-mysql2" version="0.5.7" release="35.el10_2" epoch="0" arch="x86_64_v2" src="ruby4.0-4.0.3-35.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-mysql2-0.5.7-35.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f3a29b92372f2ec396217d8487e726bc0ee4c36cb90eaa22148e12f28ca9775d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33565</id>
    <title>Important: ruby security update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 10:23:46"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ruby security update</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  

Security Fix(es):  

  * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245)
  * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258)
  * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33565" id="RHSA-2026:33565" type="rhsa" title="RHSA-2026:33565"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42245" id="CVE-2026-42245" type="cve" title="CVE-2026-42245"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42246" id="CVE-2026-42246" type="cve" title="CVE-2026-42246"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42258" id="CVE-2026-42258" type="cve" title="CVE-2026-42258"/>
      <reference href="https://bugzilla.redhat.com/2468495" id="2468495" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468498" id="2468498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468499" id="2468499" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33565.html" id="ALSA-2026:33565" type="self" title="ALSA-2026:33565"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="rubygem-json" version="2.7.2" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-json-2.7.2-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">082b9260884c14e32599b0906c89597147ddeb0bd6ddabd625b1c22b98f547c6</sum>
        </package>
        <package name="ruby" version="3.3.10" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-3.3.10-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">10db0c2029ce388bd73f69dc7b656e4bcae588e40db85e3a69f00f758e553b92</sum>
        </package>
        <package name="rubygems" version="3.5.22" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygems-3.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">2f09c90f0b4981535ebbe0b5b7b4ba60dd9bf5785c27f0948403aee04d0d5b28</sum>
        </package>
        <package name="ruby-default-gems" version="3.3.10" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-default-gems-3.3.10-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">39ee09200809903651fa2e054e18cb445e9dae3f0c19984efe4045642eba7d34</sum>
        </package>
        <package name="rubygem-psych" version="5.1.2" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-psych-5.1.2-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">446dbb33edb93c9089409a5548ccdbd84cd6e410ca35d3538491c8aac6b9a787</sum>
        </package>
        <package name="rubygem-irb" version="1.13.1" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-irb-1.13.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">5fe9dfe4760320749f19a851ab422764bf54367af0eb5510c9e54a95549daba8</sum>
        </package>
        <package name="rubygem-bigdecimal" version="3.1.5" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">69cc4911cb60537197c62875303c352f9fdb23991508ecdc41eb0a56a4ea26f0</sum>
        </package>
        <package name="rubygem-rbs" version="3.4.0" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rbs-3.4.0-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">70b5fc4ed7ea7e0800b1eb50aed03ace2a368f9f48233da558d23e5f13787fe9</sum>
        </package>
        <package name="rubygem-rss" version="0.3.1" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rss-0.3.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">77dbae3e8147ddc42bab5b6ea0d18c2e4118e0105e415dcfe6fde5793202bb0a</sum>
        </package>
        <package name="rubygem-rdoc" version="6.6.3.1" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">84f1915103438280abdc5b9e57ca39fb26ffae2bf1bc21027bd6ffc6d79f3a9b</sum>
        </package>
        <package name="rubygem-test-unit" version="3.6.1" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-test-unit-3.6.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">866eeea21e0bb345ada37a03f5d13b57a0399196476d646d5eb5506909bc81d2</sum>
        </package>
        <package name="rubygem-minitest" version="5.20.0" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-minitest-5.20.0-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">8d9d188779b8666f560bb68d91edd4391c9dc0cf440b9130fc0564c11966ea8f</sum>
        </package>
        <package name="rubygem-io-console" version="0.7.1" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-io-console-0.7.1-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">96e80d605662fadd7465fba9c0dda67772fc062fed12747cda382e7e3c341571</sum>
        </package>
        <package name="rubygem-rake" version="13.1.0" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rake-13.1.0-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">9b79c2f558b1658de031381b86dd753b030592a6199883a0022919c04b379525</sum>
        </package>
        <package name="rubygems-devel" version="3.5.22" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygems-devel-3.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">9c2bdfcca295e0d66484e9c97a77cd7f3e0ac57cfdb203043fc7933c70d2ca71</sum>
        </package>
        <package name="ruby-libs" version="3.3.10" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-libs-3.3.10-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c1acbfbfc8283d813780f230f96bd7b3909c16dda7c3f86d473094fe0df20e48</sum>
        </package>
        <package name="ruby-bundled-gems" version="3.3.10" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-bundled-gems-3.3.10-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c75a14af70b8d35511da4a7abc49cae5e543eff6aa3eb29302c3d748fb4c4d3f</sum>
        </package>
        <package name="rubygem-typeprof" version="0.21.9" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-typeprof-0.21.9-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">d3a54b16ced51c5e321382a648a7fb7a1a9cac1940df6d3e2b907de4669c5d3e</sum>
        </package>
        <package name="rubygem-bundler" version="2.5.22" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-bundler-2.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">dd71e0f69e1f86a3e4c35e6fd46db1e3360041d19976243b46e4612a81b06606</sum>
        </package>
        <package name="ruby-devel" version="3.3.10" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-devel-3.3.10-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e9b594d1361646116d6a69355a2bb92d1c6340de298c3ea352266950d39173ae</sum>
        </package>
        <package name="rubygem-power_assert" version="2.0.3" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-power_assert-2.0.3-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">ed105a1583192586a2f3343deb1cbc054e85193e938c0fb1822c3397f0e7ffa2</sum>
        </package>
        <package name="rubygem-racc" version="1.7.3" release="13.el10_2" epoch="0" arch="x86_64_v2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-racc-1.7.3-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f00ad97f9cb5ec2efebed5e87760e92b488d7a670d7a1c54e89518cf25bc0d89</sum>
        </package>
        <package name="rubygem-rexml" version="3.4.4" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rexml-3.4.4-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">f59082b3a7963f92107e82ec2557edc1e4be848f32ef1752978e61ea1311d1c2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33685</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 20:19:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
  * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
  * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
  * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)


Bug Fix(es) and Enhancement(s):  

  * CLONE - [AlmaLinux 10.2 Bug] qla2xxx flash image validation failure [almalinux-10.2.z] (JIRA:AlmaLinux-181887)
  * tegra-se fixes and updates [almalinux-10.2.z] (JIRA:AlmaLinux-182759)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33685" id="RHSA-2026:33685" type="rhsa" title="RHSA-2026:33685"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43279" id="CVE-2026-43279" type="cve" title="CVE-2026-43279"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46090" id="CVE-2026-46090" type="cve" title="CVE-2026-46090"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46176" id="CVE-2026-46176" type="cve" title="CVE-2026-46176"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46189" id="CVE-2026-46189" type="cve" title="CVE-2026-46189"/>
      <reference href="https://bugzilla.redhat.com/2467215" id="2467215" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481980" id="2481980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482588" id="2482588" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482594" id="2482594" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33685.html" id="ALSA-2026:33685" type="self" title="ALSA-2026:33685"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-devel-matched" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.29.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0f59af5bd9f617cb0433b8ba7484b287cd5ec78503996c958ee1777250bbd809</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.29.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">461f673b2e5965ca0e40573df0a19d600f125bacd4470e57ade9f8f0ff1f0704</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.29.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5d3a18aae0442d49f0579d2277279b2e86fef392b67ccff97b7ca235a77ada33</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.29.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9c8d7366ab12b07c08d8601d8f1cabb3ca160f02f381a13c35ffbd53af232352</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.29.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b836e329534f6755772c1ddbdf8b9206b050a9efd1b92e1c01c0d98fdd9037c7</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.29.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c60d7ddf6a7d9201d34ea1473a730a69065c1c8c97808fdfdeb282a7ab500149</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.29.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e4c5717341254125d2ac2b454268d7655ed18c90e783c2e3ba3ee4d108e8aca8</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.29.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e60a57186577895e009511904f86776601df14d286ae2064270184c2eed0c578</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.29.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ea6613de340e68b662bd6f4a3821692473703a63cc1955ee79f1066b4e8b2d4a</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.29.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f63ce723b72705bf735c6f90dd6e5f55b475c2c38d82ee0ec5c9ece62e4af15f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33731</id>
    <title>Moderate: rrdtool security update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 10:20:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>rrdtool security update</summary>
    <description>The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.  

Security Fix(es):  

  * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33731" id="RHSA-2026:33731" type="rhsa" title="RHSA-2026:33731"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43958" id="CVE-2026-43958" type="cve" title="CVE-2026-43958"/>
      <reference href="https://bugzilla.redhat.com/2460932" id="2460932" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33731.html" id="ALSA-2026:33731" type="self" title="ALSA-2026:33731"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="rrdtool-perl" version="1.8.0" release="21.el10_2" epoch="0" arch="x86_64_v2" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-perl-1.8.0-21.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7b830fa8121ddc7ab63039ff8ccb264eb5ebb18b140defd426502379141fba1e</sum>
        </package>
        <package name="rrdtool" version="1.8.0" release="21.el10_2" epoch="0" arch="x86_64_v2" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-1.8.0-21.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cb237cc54d7397373ad57ea7da45da7dfe44c0b82efef9e489a92e513752993e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:34109</id>
    <title>Important: httpd security, bug fix, and enhancement update</title>
    <issued date="2026-07-01 00:00:00"/>
    <updated date="2026-07-01 12:00:28"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>httpd security, bug fix, and enhancement update</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  

Security Fix(es):  

  * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
  * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
  * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
  * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)
  * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)


Bug Fix(es) and Enhancement(s):  

  * address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:34109" id="RHSA-2026:34109" type="rhsa" title="RHSA-2026:34109"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-42516" id="CVE-2024-42516" type="cve" title="CVE-2024-42516"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29169" id="CVE-2026-29169" type="cve" title="CVE-2026-29169"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34355" id="CVE-2026-34355" type="cve" title="CVE-2026-34355"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34356" id="CVE-2026-34356" type="cve" title="CVE-2026-34356"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42536" id="CVE-2026-42536" type="cve" title="CVE-2026-42536"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44185" id="CVE-2026-44185" type="cve" title="CVE-2026-44185"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44631" id="CVE-2026-44631" type="cve" title="CVE-2026-44631"/>
      <reference href="https://bugzilla.redhat.com/2374549" id="2374549" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2465296" id="2465296" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486395" id="2486395" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486397" id="2486397" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486399" id="2486399" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486411" id="2486411" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486414" id="2486414" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-34109.html" id="ALSA-2026:34109" type="self" title="ALSA-2026:34109"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="httpd" version="2.4.63" release="13.el10_2.4" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-2.4.63-13.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">0c8068e1fa62e7652c059228ec35a1bc83c6543d7a7a0c89bb29a05edc0fb18d</sum>
        </package>
        <package name="httpd-filesystem" version="2.4.63" release="13.el10_2.4" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">30a9431c19d9b0eaee77dd0b3a9c83a8c8a3a28bd86f1779bae9f85de7bc9f30</sum>
        </package>
        <package name="httpd-devel" version="2.4.63" release="13.el10_2.4" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-devel-2.4.63-13.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">3bdd366b7547e822654bd67cf36c0a8f7c4ae92486a46e3d015cc76e3fd3af88</sum>
        </package>
        <package name="mod_ssl" version="2.4.63" release="13.el10_2.4" epoch="1" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_ssl-2.4.63-13.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">4f38e6a427108fce27fb47d7b7d68aa07ea72f9c38b150e3d27a4390af3a2b67</sum>
        </package>
        <package name="httpd-manual" version="2.4.63" release="13.el10_2.4" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">5e32be7a095c8c1c4519272d18d660a3422b7a943ac850a731cff5f11027152d</sum>
        </package>
        <package name="mod_ldap" version="2.4.63" release="13.el10_2.4" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_ldap-2.4.63-13.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">8c589f88ee7ab86e438b4de2c2c31f6c13d9a93127549fa1944ba49390883b3c</sum>
        </package>
        <package name="httpd-core" version="2.4.63" release="13.el10_2.4" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-core-2.4.63-13.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">b1cf3d4dd0357a486e67b7ae7f4dd7562e5ae555000f02e591e22476e89db7d1</sum>
        </package>
        <package name="mod_lua" version="2.4.63" release="13.el10_2.4" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_lua-2.4.63-13.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">e4d8fe3d5d17e449235fc20b7809e2d3e9aad91ffd85edb600343be47b3252cd</sum>
        </package>
        <package name="httpd-tools" version="2.4.63" release="13.el10_2.4" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-tools-2.4.63-13.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">ea1d92826f861f6341fe6a2995f6e448bebf8b82a57e18fa36b31eac716b30af</sum>
        </package>
        <package name="mod_session" version="2.4.63" release="13.el10_2.4" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_session-2.4.63-13.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">f8f5e0c9ec3d3529ca6fe0cc1989239cf6a5df5bd2ac0699f9a90331ddb62717</sum>
        </package>
        <package name="mod_proxy_html" version="2.4.63" release="13.el10_2.4" epoch="1" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_proxy_html-2.4.63-13.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">fbccc71139e64fd2db3a5ca01e784671494816549e69f17b0cedc7d8da685857</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:34355</id>
    <title>Moderate: mod_http2 security, bug fix, and enhancement update</title>
    <issued date="2026-07-01 00:00:00"/>
    <updated date="2026-07-02 08:48:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>mod_http2 security, bug fix, and enhancement update</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.  

Security Fix(es):  

  * httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913)
  * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)


Bug Fix(es) and Enhancement(s):  

  * address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:AlmaLinux-188008)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:34355" id="RHSA-2026:34355" type="rhsa" title="RHSA-2026:34355"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43951" id="CVE-2026-43951" type="cve" title="CVE-2026-43951"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48913" id="CVE-2026-48913" type="cve" title="CVE-2026-48913"/>
      <reference href="https://bugzilla.redhat.com/2486405" id="2486405" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486415" id="2486415" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-34355.html" id="ALSA-2026:34355" type="self" title="ALSA-2026:34355"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mod_http2" version="2.0.29" release="4.el10_2.2" epoch="0" arch="x86_64_v2" src="mod_http2-2.0.29-4.el10_2.2.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">dc344983f24347a2ae39fc97bbafb7f309e40e10f7d0fe68c99a2d661570dc34</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:34357</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2026-07-01 00:00:00"/>
    <updated date="2026-07-07 10:24:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>opentelemetry-collector security update</summary>
    <description>Collector with the supported components for a AlmaLinux build of OpenTelemetry  

Security Fix(es):  

  * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)
  * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
  * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:34357" id="RHSA-2026:34357" type="rhsa" title="RHSA-2026:34357"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25681" id="CVE-2026-25681" type="cve" title="CVE-2026-25681"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42151" id="CVE-2026-42151" type="cve" title="CVE-2026-42151"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42154" id="CVE-2026-42154" type="cve" title="CVE-2026-42154"/>
      <reference href="https://bugzilla.redhat.com/2466505" id="2466505" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2466507" id="2466507" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467822" id="2467822" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480761" id="2480761" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484207" id="2484207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-34357.html" id="ALSA-2026:34357" type="self" title="ALSA-2026:34357"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="opentelemetry-collector" version="0.152.1" release="1.el10_2" epoch="0" arch="x86_64_v2" src="opentelemetry-collector-0.152.1-1.el10_2.src.rpm">
          <filename>opentelemetry-collector-0.152.1-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">327c8b1e895816a7310080360c68d9d13eae3611247704f2a134fe5b98d68ccb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:34911</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-02 00:00:00"/>
    <updated date="2026-07-04 22:30:01"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
  * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)
  * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209)
  * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
  * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263)
  * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)
  * kernel: kernel: ipv6 frag escape ()


Bug Fix(es) and Enhancement(s):  

  * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z] (JIRA:AlmaLinux-182537)
  * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:34911" id="RHSA-2026:34911" type="rhsa" title="RHSA-2026:34911"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-10263" id="CVE-2025-10263" type="cve" title="CVE-2025-10263"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43112" id="CVE-2026-43112" type="cve" title="CVE-2026-43112"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45998" id="CVE-2026-45998" type="cve" title="CVE-2026-45998"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46209" id="CVE-2026-46209" type="cve" title="CVE-2026-46209"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46244" id="CVE-2026-46244" type="cve" title="CVE-2026-46244"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46316" id="CVE-2026-46316" type="cve" title="CVE-2026-46316"/>
      <reference href="https://bugzilla.redhat.com/2467015" id="2467015" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482024" id="2482024" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482636" id="2482636" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484451" id="2484451" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486958" id="2486958" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486982" id="2486982" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-34911.html" id="ALSA-2026:34911" type="self" title="ALSA-2026:34911"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="rv" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.30.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">07443fe124a747f5173f0d00f24eb0ac77d2d09a24cb8d0a3461814058cebbad</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.30.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">262c921f3e4e4bf4a18a19a527481cf2b1c4ad875df2233c61146cf1909d7401</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.30.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">37071c47ef6d33902382a8ed775082ac0e87202627db8e9d81a39e5f0fbdfabc</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.30.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">38bfbab01e176f619a419e07360c6cb5259c29cd4aa5487edc9c3475749f6cd6</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.30.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5dc80686d54b8231cc50960405bb0679ea3c7d2c38ad35f57579150a63e8ea0f</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.30.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a4514336f97559a027e041c82f4616c63a51df444a04ba2f6410b7be63cc692f</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.30.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a6896bb251a048319d7c50ed0f5f5dd83ebb77c74e28ac4f7df1d5a05b3b6046</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.30.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d070a979ea007b96ba43a69aa1270b550924a2995a2782b1c14d4af986c436e6</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.30.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dc4674fe8cd089e79a5b6563af52e86f1f3b23758f8e27e0f522bb1c1086ed9d</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.30.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f7bd1a54d0eda4387d146371801354e37de0dc5305b4ae56fa608cc95726c302</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:35826</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-07-06 00:00:00"/>
    <updated date="2026-07-22 13:48:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>grafana-pcp security update</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.  

Security Fix(es):  

  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:35826" id="RHSA-2026:35826" type="rhsa" title="RHSA-2026:35826"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-35826.html" id="ALSA-2026:35826" type="self" title="ALSA-2026:35826"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="grafana-pcp" version="5.3.0" release="7.el10_2" epoch="0" arch="x86_64_v2" src="grafana-pcp-5.3.0-7.el10_2.src.rpm">
          <filename>grafana-pcp-5.3.0-7.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">020526a8ed3af14c9d11aefdfa46117422467dc92eb5144e2366068eed9504d1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:35827</id>
    <title>Important: grafana security update</title>
    <issued date="2026-07-06 00:00:00"/>
    <updated date="2026-07-22 13:37:57"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>grafana security update</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.   

Security Fix(es):  

  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:35827" id="RHSA-2026:35827" type="rhsa" title="RHSA-2026:35827"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-35827.html" id="ALSA-2026:35827" type="self" title="ALSA-2026:35827"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="grafana" version="10.2.6" release="27.el10_2" epoch="0" arch="x86_64_v2" src="grafana-10.2.6-27.el10_2.src.rpm">
          <filename>grafana-10.2.6-27.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">24f66be41e51d1efa45993daf4516adad53c12d46439d83c9bdf8fb63680bd58</sum>
        </package>
        <package name="grafana-selinux" version="10.2.6" release="27.el10_2" epoch="0" arch="x86_64_v2" src="grafana-10.2.6-27.el10_2.src.rpm">
          <filename>grafana-selinux-10.2.6-27.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b6a3efccdcc826c77504e359ca8735225d23f43c96701dadcd53b40163be3156</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:35832</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-07-06 00:00:00"/>
    <updated date="2026-07-22 13:38:51"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>golang-github-openprinting-ipp-usb security update</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables  
driverless support for USB devices capable of using IPP-over-USB protocol.  

Security Fix(es):  

  * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:35832" id="RHSA-2026:35832" type="rhsa" title="RHSA-2026:35832"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811"/>
      <reference href="https://bugzilla.redhat.com/2467822" id="2467822" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484207" id="2484207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-35832.html" id="ALSA-2026:35832" type="self" title="ALSA-2026:35832"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="ipp-usb" version="0.9.27" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="golang-github-openprinting-ipp-usb-0.9.27-7.el10_2.2.src.rpm">
          <filename>ipp-usb-0.9.27-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">ede13f4cfbb2ccf8c0f5f76257570b12cebfb798d01228c235509c0439192965</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:35841</id>
    <title>Important: nodejs24 security, bug fix, and enhancement update</title>
    <issued date="2026-07-06 00:00:00"/>
    <updated date="2026-07-06 12:42:48"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs24 security, bug fix, and enhancement update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  

Security Fix(es):  

  * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)


Bug Fix(es) and Enhancement(s):  

  * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:35841" id="RHSA-2026:35841" type="rhsa" title="RHSA-2026:35841"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11525" id="CVE-2026-11525" type="cve" title="CVE-2026-11525"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12151" id="CVE-2026-12151" type="cve" title="CVE-2026-12151"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42338" id="CVE-2026-42338" type="cve" title="CVE-2026-42338"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48615" id="CVE-2026-48615" type="cve" title="CVE-2026-48615"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48618" id="CVE-2026-48618" type="cve" title="CVE-2026-48618"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48619" id="CVE-2026-48619" type="cve" title="CVE-2026-48619"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48928" id="CVE-2026-48928" type="cve" title="CVE-2026-48928"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48930" id="CVE-2026-48930" type="cve" title="CVE-2026-48930"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48933" id="CVE-2026-48933" type="cve" title="CVE-2026-48933"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48934" id="CVE-2026-48934" type="cve" title="CVE-2026-48934"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48935" id="CVE-2026-48935" type="cve" title="CVE-2026-48935"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6733" id="CVE-2026-6733" type="cve" title="CVE-2026-6733"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6734" id="CVE-2026-6734" type="cve" title="CVE-2026-6734"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9678" id="CVE-2026-9678" type="cve" title="CVE-2026-9678"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9697" id="CVE-2026-9697" type="cve" title="CVE-2026-9697"/>
      <reference href="https://bugzilla.redhat.com/2476810" id="2476810" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489980" id="2489980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490000" id="2490000" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490006" id="2490006" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490008" id="2490008" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490018" id="2490018" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490024" id="2490024" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493325" id="2493325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493326" id="2493326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493329" id="2493329" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493331" id="2493331" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493332" id="2493332" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493333" id="2493333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493335" id="2493335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493337" id="2493337" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-35841.html" id="ALSA-2026:35841" type="self" title="ALSA-2026:35841"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs24-full-i18n" version="24.18.0" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-full-i18n-24.18.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">08d248d0366424283a36c4d41caefb0a267fcbfc2c15e2e0cb53c1dbe3b195de</sum>
        </package>
        <package name="nodejs24-devel" version="24.18.0" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-devel-24.18.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4629aa154c61579c81590af2e2091e4dcf8f5d7b2fe171df3beb7bca754115f9</sum>
        </package>
        <package name="nodejs24-libs" version="24.18.0" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-libs-24.18.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5c6dd1f3184bb3e275340ac4d3cd0c84f017b53e8419498b184591fe9e3a6775</sum>
        </package>
        <package name="nodejs24" version="24.18.0" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-24.18.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7e96823ac209b3a25a6476f7c93577215ad982f94e1e086b7cdfffcbd92029a6</sum>
        </package>
        <package name="nodejs24-npm" version="11.16.0" release="1.24.18.0.1.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-npm-11.16.0-1.24.18.0.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b26d8267ca66276f7e691e6ae46d36fc0beaccc3064246c73bf7e97f5437ff7d</sum>
        </package>
        <package name="nodejs24-docs" version="24.18.0" release="1.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-docs-24.18.0-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">cfbfb133600350bcd79f384de1fe77fa2508bf7bbac0e804b4b4b5991450e772</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:35842</id>
    <title>Important: nodejs22 security, bug fix, and enhancement update</title>
    <issued date="2026-07-06 00:00:00"/>
    <updated date="2026-07-06 12:41:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs22 security, bug fix, and enhancement update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.  

Security Fix(es):  

  * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)


Bug Fix(es) and Enhancement(s):  

  * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:35842" id="RHSA-2026:35842" type="rhsa" title="RHSA-2026:35842"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11525" id="CVE-2026-11525" type="cve" title="CVE-2026-11525"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12151" id="CVE-2026-12151" type="cve" title="CVE-2026-12151"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42338" id="CVE-2026-42338" type="cve" title="CVE-2026-42338"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48615" id="CVE-2026-48615" type="cve" title="CVE-2026-48615"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48618" id="CVE-2026-48618" type="cve" title="CVE-2026-48618"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48619" id="CVE-2026-48619" type="cve" title="CVE-2026-48619"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48928" id="CVE-2026-48928" type="cve" title="CVE-2026-48928"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48930" id="CVE-2026-48930" type="cve" title="CVE-2026-48930"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48933" id="CVE-2026-48933" type="cve" title="CVE-2026-48933"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48934" id="CVE-2026-48934" type="cve" title="CVE-2026-48934"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48935" id="CVE-2026-48935" type="cve" title="CVE-2026-48935"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6733" id="CVE-2026-6733" type="cve" title="CVE-2026-6733"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9678" id="CVE-2026-9678" type="cve" title="CVE-2026-9678"/>
      <reference href="https://bugzilla.redhat.com/2476810" id="2476810" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489980" id="2489980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490000" id="2490000" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490006" id="2490006" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490008" id="2490008" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493325" id="2493325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493326" id="2493326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493329" id="2493329" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493331" id="2493331" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493332" id="2493332" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493333" id="2493333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493335" id="2493335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493337" id="2493337" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-35842.html" id="ALSA-2026:35842" type="self" title="ALSA-2026:35842"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs-docs" version="22.23.1" release="2.el10_2" epoch="1" arch="noarch" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">492a598f325fdb1de667b1cf3eb563ff290a931816399634238410c6852efc36</sum>
        </package>
        <package name="nodejs-devel" version="22.23.1" release="2.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-devel-22.23.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">612cd6c9de0b97daf6e49e5372da7a52ed473bd9109ee63064897b9627add65d</sum>
        </package>
        <package name="nodejs" version="22.23.1" release="2.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-22.23.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8e165c811ea33e096da8c3e3681905445bb32774c0222dc236bb5cff1e9c376c</sum>
        </package>
        <package name="nodejs-full-i18n" version="22.23.1" release="2.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-full-i18n-22.23.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">92e75bd8afb8e88921484104c1f1e97e5b75cf24eef8fa2b73b572d1e223a973</sum>
        </package>
        <package name="nodejs-libs" version="22.23.1" release="2.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-libs-22.23.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d9cb56c263742f90529ac451a9a4ed79d6194c2ba1a40d971250e797f4dab54b</sum>
        </package>
        <package name="nodejs-npm" version="10.9.8" release="1.22.23.1.2.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-npm-10.9.8-1.22.23.1.2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f170bb98fccc6befd780dd7a8003d9457ed0fd7dc187f5ee35a38b6c0c9761e8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36193</id>
    <title>Important: python3.14-pip security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-08 11:49:46"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14-pip security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36193" id="RHSA-2026:36193" type="rhsa" title="RHSA-2026:36193"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8643" id="CVE-2026-8643" type="cve" title="CVE-2026-8643"/>
      <reference href="https://bugzilla.redhat.com/2460927" id="2460927" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36193.html" id="ALSA-2026:36193" type="self" title="ALSA-2026:36193"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3.14-pip-wheel" version="25.2" release="3.el10_2.5" epoch="0" arch="noarch" src="python3.14-pip-25.2-3.el10_2.5.src.rpm">
          <filename>python3.14-pip-wheel-25.2-3.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">80456c6bf4f96a398309a5858cf83bf96d5c0f655b8b581a95e3ff83b8664e80</sum>
        </package>
        <package name="python3.14-pip" version="25.2" release="3.el10_2.5" epoch="0" arch="noarch" src="python3.14-pip-25.2-3.el10_2.5.src.rpm">
          <filename>python3.14-pip-25.2-3.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">927cdfb0565ce93516e52106bc6c1092e3eb33f3170f0a74c8dfae46233929be</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36196</id>
    <title>Important: 389-ds-base security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-21 13:11:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>389-ds-base security update</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.  

Security Fix(es):  

  * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
  * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36196" id="RHSA-2026:36196" type="rhsa" title="RHSA-2026:36196"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11610" id="CVE-2026-11610" type="cve" title="CVE-2026-11610"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11774" id="CVE-2026-11774" type="cve" title="CVE-2026-11774"/>
      <reference href="https://bugzilla.redhat.com/2484414" id="2484414" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484916" id="2484916" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36196.html" id="ALSA-2026:36196" type="self" title="ALSA-2026:36196"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="389-ds-base" version="3.2.0" release="8.el10_2" epoch="0" arch="x86_64_v2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-3.2.0-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1b15156afad499f8a025bfca3b8fd627eb8d112ddeea16d6511ad676c38721ca</sum>
        </package>
        <package name="389-ds-base-libs" version="3.2.0" release="8.el10_2" epoch="0" arch="x86_64_v2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-libs-3.2.0-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6ef82e6b350dd79c55c22d8110b14f9268de5401871be7e75e7e7744baf82213</sum>
        </package>
        <package name="389-ds-base-snmp" version="3.2.0" release="8.el10_2" epoch="0" arch="x86_64_v2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-snmp-3.2.0-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">81b1c626025d5166ff53c592ca1aafd86ae19338666826709875e9142f41827b</sum>
        </package>
        <package name="python3-lib389" version="3.2.0" release="8.el10_2" epoch="0" arch="noarch" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>python3-lib389-3.2.0-8.el10_2.noarch.rpm</filename>
          <sum type="sha256">db8acba0242228f0760021708fbba6f09ec6c3ed8b57470de69e594a8a184aa0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36199</id>
    <title>Important: buildah security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-08 11:48:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>buildah security update</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   

Security Fix(es):  

  * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
  * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
  * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
  * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36199" id="RHSA-2026:36199" type="rhsa" title="RHSA-2026:36199"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39829" id="CVE-2026-39829" type="cve" title="CVE-2026-39829"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39830" id="CVE-2026-39830" type="cve" title="CVE-2026-39830"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39832" id="CVE-2026-39832" type="cve" title="CVE-2026-39832"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39835" id="CVE-2026-39835" type="cve" title="CVE-2026-39835"/>
      <reference href="https://bugzilla.redhat.com/2480680" id="2480680" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480681" id="2480681" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480684" id="2480684" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480685" id="2480685" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36199.html" id="ALSA-2026:36199" type="self" title="ALSA-2026:36199"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="buildah" version="1.43.1" release="3.el10_2" epoch="2" arch="x86_64_v2" src="buildah-1.43.1-3.el10_2.src.rpm">
          <filename>buildah-1.43.1-3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3a06c40f2eb79af3cface670923700405e3f04c99fb64e89f8f1727824fcd549</sum>
        </package>
        <package name="buildah-tests" version="1.43.1" release="3.el10_2" epoch="2" arch="x86_64_v2" src="buildah-1.43.1-3.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">47ff7288fe4e243cc9ba0f2ee2a838ec311543f5e65aeb8c5f1c656522633588</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36203</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-21 13:10:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>freerdp security update</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.  

Security Fix(es):  

  * freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033)
  * freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422)
  * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700)
  * freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421)
  * freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36203" id="RHSA-2026:36203" type="rhsa" title="RHSA-2026:36203"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40033" id="CVE-2026-40033" type="cve" title="CVE-2026-40033"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44420" id="CVE-2026-44420" type="cve" title="CVE-2026-44420"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44421" id="CVE-2026-44421" type="cve" title="CVE-2026-44421"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44422" id="CVE-2026-44422" type="cve" title="CVE-2026-44422"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45700" id="CVE-2026-45700" type="cve" title="CVE-2026-45700"/>
      <reference href="https://bugzilla.redhat.com/2481473" id="2481473" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483467" id="2483467" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483470" id="2483470" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483471" id="2483471" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483480" id="2483480" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36203.html" id="ALSA-2026:36203" type="self" title="ALSA-2026:36203"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="freerdp" version="3.10.3" release="12.el10_2.6" epoch="2" arch="x86_64_v2" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>freerdp-3.10.3-12.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">7931a06d0d8c60d5a6b753ff70fcf6df89cd6a5c5f6846f0082ed026f3a0520d</sum>
        </package>
        <package name="libwinpr" version="3.10.3" release="12.el10_2.6" epoch="2" arch="x86_64_v2" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>libwinpr-3.10.3-12.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">bdfd5f73ca8875fffce192b76c4d26265d5e10900d4d6ef9275cb46d3fba4bd5</sum>
        </package>
        <package name="freerdp-libs" version="3.10.3" release="12.el10_2.6" epoch="2" arch="x86_64_v2" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>freerdp-libs-3.10.3-12.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">f33069672433525f4759eee3093269ced01ed2584d48e93addbbc7aecc79d8d4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36211</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-13 09:47:29"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>freeipmi security update</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.  

Security Fix(es):  

  * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36211" id="RHSA-2026:36211" type="rhsa" title="RHSA-2026:36211"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50031" id="CVE-2026-50031" type="cve" title="CVE-2026-50031"/>
      <reference href="https://bugzilla.redhat.com/2484296" id="2484296" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36211.html" id="ALSA-2026:36211" type="self" title="ALSA-2026:36211"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="freeipmi-bmc-watchdog" version="1.6.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-bmc-watchdog-1.6.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">33e419f4aa178b05e4ac57bca07890db2a6690915788350e39fe4ba5270cb475</sum>
        </package>
        <package name="freeipmi-ipmiseld" version="1.6.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-ipmiseld-1.6.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">402eed286a212a26f0d56df3767b3dc062e42ba79330128fffefb9794d34b401</sum>
        </package>
        <package name="freeipmi" version="1.6.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-1.6.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a472509ddc73e884f166a578c995de080001a79248e7678e61578e9ac508c259</sum>
        </package>
        <package name="freeipmi-ipmidetectd" version="1.6.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-ipmidetectd-1.6.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c39dfeec3a49030afc0b90db72fe28b9335eb1d0d093043c2eb8894e945d4986</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36320</id>
    <title>Important: unbound security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-31 12:39:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)
  * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)
  * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)
  * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36320" id="RHSA-2026:36320" type="rhsa" title="RHSA-2026:36320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40622" id="CVE-2026-40622" type="cve" title="CVE-2026-40622"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41292" id="CVE-2026-41292" type="cve" title="CVE-2026-41292"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42534" id="CVE-2026-42534" type="cve" title="CVE-2026-42534"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44390" id="CVE-2026-44390" type="cve" title="CVE-2026-44390"/>
      <reference href="https://bugzilla.redhat.com/2480125" id="2480125" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480130" id="2480130" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480131" id="2480131" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36320.html" id="ALSA-2026:36320" type="self" title="ALSA-2026:36320"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3-unbound" version="1.24.2" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.2.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">1cc08043c7070c51a21a6e91e45f7e21afdcd12cddc3fe8a23971cf11ab6f400</sum>
        </package>
        <package name="unbound" version="1.24.2" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.2.src.rpm">
          <filename>unbound-1.24.2-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">736c271ff30e175fb4b24e7556109f99f75c46b910fa0b42074ffbee69c9ec1c</sum>
        </package>
        <package name="unbound-anchor" version="1.24.2" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.2.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">a25b65a9c5850efeb45f45c60dacf28afb206ff0add570bbe54ab02925178b59</sum>
        </package>
        <package name="unbound-dracut" version="1.24.2" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.2.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">b5ce2c4524fdaf419da313774ce66b2eb4dd3c8e83f643ade97d3a2bf2594d42</sum>
        </package>
        <package name="unbound-libs" version="1.24.2" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.2.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">bf87fcd37db68b49af2bb9ec7552e773614ea74233f8ee2f4fb03d152183f723</sum>
        </package>
        <package name="unbound-utils" version="1.24.2" release="7.el10_2.2" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.2.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">fed491521f3f5a7096c7b38cd7613d8b91605796577be21c0d1372b144f95669</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36364</id>
    <title>Important: nginx security, bug fix, and enhancement update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-08 11:42:28"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nginx security, bug fix, and enhancement update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055)


Bug Fix(es) and Enhancement(s):  

  * "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-10.2.z] (JIRA:AlmaLinux-191778)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36364" id="RHSA-2026:36364" type="rhsa" title="RHSA-2026:36364"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42055" id="CVE-2026-42055" type="cve" title="CVE-2026-42055"/>
      <reference href="https://bugzilla.redhat.com/2489866" id="2489866" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36364.html" id="ALSA-2026:36364" type="self" title="ALSA-2026:36364"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nginx-mod-stream" version="1.26.3" release="6.el10_2.5" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">1a799b5777ccb396f446d6fc3ce679b7e71442c079a057f2f92c1bf66db6d035</sum>
        </package>
        <package name="nginx-all-modules" version="1.26.3" release="6.el10_2.5" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">63783f2757ef9f4c14eb7739660124c6c7d8094475d4b3333f54aa552c72f0fd</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" version="1.26.3" release="6.el10_2.5" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">74d33d79a2624cac0988e7b6b9b5c3b824637e7fd57aa0a540cd09919387708e</sum>
        </package>
        <package name="nginx-mod-http-perl" version="1.26.3" release="6.el10_2.5" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">79f5464576f3e429b4d727bc825fbbec31128892f242e932f0236d871e833c54</sum>
        </package>
        <package name="nginx" version="1.26.3" release="6.el10_2.5" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">a9c2539f65028262d9e4ad27dd2f1a6ce598671c4c8dd1a74bb703954478dfc9</sum>
        </package>
        <package name="nginx-mod-mail" version="1.26.3" release="6.el10_2.5" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">bba519b65a069f3044bfba3642cf0abb84d35f4d6060f68cc4ed648fa6675e5f</sum>
        </package>
        <package name="nginx-mod-http-image-filter" version="1.26.3" release="6.el10_2.5" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">ca70abc675dc4e28cf491f87231f03e3dfb3fdf59de5b5210a8013d6572f2956</sum>
        </package>
        <package name="nginx-core" version="1.26.3" release="6.el10_2.5" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">cf064e1321fe46ea4e6d92a1ea56b58c2940ebb2a688669ded0345d9bd5d43cb</sum>
        </package>
        <package name="nginx-filesystem" version="1.26.3" release="6.el10_2.5" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">e33cd1bd4272896159c0e7c1cd3fb48f85a85d98e7641fd3ac67aa121ff5fae5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36541</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-09 11:20:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)
  * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
  * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)
  * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
  * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)
  * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)


Bug Fix(es) and Enhancement(s):  

  * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z] (JIRA:AlmaLinux-162140)
  * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z] (JIRA:AlmaLinux-182770)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36541" id="RHSA-2026:36541" type="rhsa" title="RHSA-2026:36541"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43074" id="CVE-2026-43074" type="cve" title="CVE-2026-43074"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43276" id="CVE-2026-43276" type="cve" title="CVE-2026-43276"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43341" id="CVE-2026-43341" type="cve" title="CVE-2026-43341"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46155" id="CVE-2026-46155" type="cve" title="CVE-2026-46155"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46242" id="CVE-2026-46242" type="cve" title="CVE-2026-46242"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46259" id="CVE-2026-46259" type="cve" title="CVE-2026-46259"/>
      <reference href="https://bugzilla.redhat.com/2467019" id="2467019" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467113" id="2467113" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468097" id="2468097" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482660" id="2482660" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483519" id="2483519" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484477" id="2484477" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36541.html" id="ALSA-2026:36541" type="self" title="ALSA-2026:36541"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3-perf" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.31.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">015be0c7ca616d764246c074bebb7389eb263143a80f7b3b72f0149af9e01511</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.31.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1e8dfe6b7791726ca291f364dfe5919bf0aebdb3dc5dadf22fa2eb39a40fcce1</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.31.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3c528a7d5b3f5127837ce1bf3eb6bcfe66c3a6bce4b6ae5b8848dfcdfb929b46</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.31.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5ae8c71dafdce501b550a0f69ab8638aa5a3748b22d9f21b818b59d5d4c55f21</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.31.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">82d6a36bea59710c56159fff3d547051312a5af82ca5602f413eec070d7cb7cf</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.31.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">89b91f15b9a6c2c75be8b2c7e16409d5457cac0e17efe5cccd145ffe6964e501</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.31.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">964b9b59c87224b1320764bf44c4d66e427b927d27aa3e7d31c3084ac18f1ef4</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.31.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9d860109190af039fa8e25aeaf1c9815ae370581fa8c853709780490705fe297</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.31.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">aac40662d0e83830253ea7c7d5b8f5938147d38bf9b3aed8ffbc647619a9a87d</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.31.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c3d24d33bdfb3d22d36b4bf249cbcfa0cc82d09a01760a6efaa9923c307f48c9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36673</id>
    <title>Moderate: gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-21 13:10:00"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>gstreamer1-plugins-ugly-free security update</summary>
    <description>GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.  

Security Fix(es):  

  * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36673" id="RHSA-2026:36673" type="rhsa" title="RHSA-2026:36673"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53703" id="CVE-2026-53703" type="cve" title="CVE-2026-53703"/>
      <reference href="https://bugzilla.redhat.com/2487613" id="2487613" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36673.html" id="ALSA-2026:36673" type="self" title="ALSA-2026:36673"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-ugly-free" version="1.26.7" release="2.el10_2.1" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">cd381e19dfe9e64be713e2552253dfece7ab9bc262e24a28dedd91cdc2104eed</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36675</id>
    <title>Important: gstreamer1-plugins-good security update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-21 13:12:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-good security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  

Security Fix(es):  

  * gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36675" id="RHSA-2026:36675" type="rhsa" title="RHSA-2026:36675"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53705" id="CVE-2026-53705" type="cve" title="CVE-2026-53705"/>
      <reference href="https://bugzilla.redhat.com/2487615" id="2487615" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36675.html" id="ALSA-2026:36675" type="self" title="ALSA-2026:36675"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-good-gtk" version="1.26.7" release="2.el10_2.1" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">34a635ab1f9b8bdf8192d0c287c0e29bfdc6b927c287fbd28ef7652a07c9124e</sum>
        </package>
        <package name="gstreamer1-plugins-good" version="1.26.7" release="2.el10_2.1" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">ea03b5588f66af91b5227498f0a438a7b72b426a85f0e84d2cd8cb92e13f9d10</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36749</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-09 11:10:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-bad-free security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  

Security Fix(es):  

  * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)
  * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)
  * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)
  * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36749" id="RHSA-2026:36749" type="rhsa" title="RHSA-2026:36749"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52718" id="CVE-2026-52718" type="cve" title="CVE-2026-52718"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52719" id="CVE-2026-52719" type="cve" title="CVE-2026-52719"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52720" id="CVE-2026-52720" type="cve" title="CVE-2026-52720"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52722" id="CVE-2026-52722" type="cve" title="CVE-2026-52722"/>
      <reference href="https://bugzilla.redhat.com/2486328" id="2486328" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486353" id="2486353" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486731" id="2486731" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486733" id="2486733" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36749.html" id="ALSA-2026:36749" type="self" title="ALSA-2026:36749"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-bad-free" version="1.26.7" release="2.el10_2.4" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">0487b1962425322691569d9e0b3053aa0cc0ab81fc5b9ac6281d142d973b2e49</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" version="1.26.7" release="2.el10_2.4" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">c0f6906438421e1607d54faa1d6909c86f19a15514e67b5d7ada1e85c2e6c39c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36782</id>
    <title>Moderate: aardvark-dns security update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-09 11:14:54"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>aardvark-dns security update</summary>
    <description>Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in `src/backend/mod.rs`.  

Security Fix(es):  

  * aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset (CVE-2026-35406)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36782" id="RHSA-2026:36782" type="rhsa" title="RHSA-2026:36782"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35406" id="CVE-2026-35406" type="cve" title="CVE-2026-35406"/>
      <reference href="https://bugzilla.redhat.com/2456280" id="2456280" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36782.html" id="ALSA-2026:36782" type="self" title="ALSA-2026:36782"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="aardvark-dns" version="1.17.1" release="1.el10_2" epoch="2" arch="x86_64_v2" src="aardvark-dns-1.17.1-1.el10_2.src.rpm">
          <filename>aardvark-dns-1.17.1-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7cdd16314ee1d93f8d8a71d36b831533ee2cf3a78fc8bfc7aa229b9f9e209a5b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36788</id>
    <title>Important: tomcat security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-13 09:45:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>tomcat security, bug fix, and enhancement update</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  

Security Fix(es):  

  * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
  * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)


Bug Fix(es) and Enhancement(s):  

  * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36788" id="RHSA-2026:36788" type="rhsa" title="RHSA-2026:36788"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29146" id="CVE-2026-29146" type="cve" title="CVE-2026-29146"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34486" id="CVE-2026-34486" type="cve" title="CVE-2026-34486"/>
      <reference href="https://bugzilla.redhat.com/2457020" id="2457020" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457027" id="2457027" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36788.html" id="ALSA-2026:36788" type="self" title="ALSA-2026:36788"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="tomcat-jsp-3.1-api" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">1819dbffc1a4bca43680dfb716f9f6bfca480b2c4603395e77e0a419a58fbf40</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">2554b1cd27aae45d566ee543e529a7f8b631976f3dc644dccaa3151198093639</sum>
        </package>
        <package name="tomcat-el-5.0-api" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">4b09a49a6a830ea70914354fdb2180be3d73be82a0bebb83bdfefc3d3432cb85</sum>
        </package>
        <package name="tomcat" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">7a52ade066f085dc82c61eb86e4ef336c98d2ac6ba70eff0127686795e779fa3</sum>
        </package>
        <package name="tomcat-lib" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-lib-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8493861578941c0333c0447a8fba9719aa909187e4dfce1eb7ea6f9689eb73f4</sum>
        </package>
        <package name="tomcat-webapps" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8545fc47344bf1f124375700093b8bd550c7b5bbd3885316391a2c6901779bf3</sum>
        </package>
        <package name="tomcat-docs-webapp" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">cd529a071ef3d5271bd60e65c7097b158dc762889174cff1d29908a19942df9b</sum>
        </package>
        <package name="tomcat-admin-webapps" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">f1ca32a57c82c415745065d6ad5dee139ea70ca3e4b206c2c5213577fb413f9f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36790</id>
    <title>Important: tomcat9 security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-08-07 12:55:00"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>tomcat9 security, bug fix, and enhancement update</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.  

Security Fix(es):  

  * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
  * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)


Bug Fix(es) and Enhancement(s):  

  * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36790" id="RHSA-2026:36790" type="rhsa" title="RHSA-2026:36790"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29146" id="CVE-2026-29146" type="cve" title="CVE-2026-29146"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34486" id="CVE-2026-34486" type="cve" title="CVE-2026-34486"/>
      <reference href="https://bugzilla.redhat.com/2457020" id="2457020" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457027" id="2457027" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36790.html" id="ALSA-2026:36790" type="self" title="ALSA-2026:36790"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2025-66614.html" id="CVE-2025-66614" type="cve" title="CVE-2025-66614"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-24733.html" id="CVE-2026-24733" type="cve" title="CVE-2026-24733"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-24734.html" id="CVE-2026-24734" type="cve" title="CVE-2026-24734"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-24880.html" id="CVE-2026-24880" type="cve" title="CVE-2026-24880"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-25854.html" id="CVE-2026-25854" type="cve" title="CVE-2026-25854"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-29129.html" id="CVE-2026-29129" type="cve" title="CVE-2026-29129"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-29145.html" id="CVE-2026-29145" type="cve" title="CVE-2026-29145"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-32990.html" id="CVE-2026-32990" type="cve" title="CVE-2026-32990"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-34483.html" id="CVE-2026-34483" type="cve" title="CVE-2026-34483"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-34487.html" id="CVE-2026-34487" type="cve" title="CVE-2026-34487"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-34500.html" id="CVE-2026-34500" type="cve" title="CVE-2026-34500"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="tomcat9-el-3.0-api" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">1e7a1f290d83d33dca1568da1d68c956d2ff9d703a7b398d2955f8f881f6c51c</sum>
        </package>
        <package name="tomcat9-admin-webapps" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">35f74b44de15b3b04a6bc454a111d3dfb26dfee6c7ad16644fb1a88130dce735</sum>
        </package>
        <package name="tomcat9-webapps" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">3682120341af35136b188a86d60de457c2c5936026aea99b5a7b1317d71f90f2</sum>
        </package>
        <package name="tomcat9-lib" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-lib-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">3a1e23335ca4fc1ca27006743516d5c74f7da734dc74dcdc72f5a4bed710668b</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">42f01e89a5d4c20d96e5212710be93238f72ce04851d86ae714c53b925109a88</sum>
        </package>
        <package name="tomcat9" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">7b18a53d3580ad05f99f8ee76bc0a5408bc9f0a2ca45465fd3446184546c2cb9</sum>
        </package>
        <package name="tomcat9-docs-webapp" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">a59f4bad7f545f5287804da402c7f5be36cbae0c74cf7b8b5f691c3473fe68b6</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">ac4d0fe0045a2723cfb5b6f43bdf719a027a0d7e5f26985bc08e3b4c1c91feb3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36956</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-09 00:00:00"/>
    <updated date="2026-07-10 09:20:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066)
  * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
  * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)
  * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36956" id="RHSA-2026:36956" type="rhsa" title="RHSA-2026:36956"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71066" id="CVE-2025-71066" type="cve" title="CVE-2025-71066"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46113" id="CVE-2026-46113" type="cve" title="CVE-2026-46113"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46227" id="CVE-2026-46227" type="cve" title="CVE-2026-46227"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53359" id="CVE-2026-53359" type="cve" title="CVE-2026-53359"/>
      <reference href="https://bugzilla.redhat.com/2429036" id="2429036" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482564" id="2482564" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482587" id="2482587" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2497033" id="2497033" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36956.html" id="ALSA-2026:36956" type="self" title="ALSA-2026:36956"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-devel-matched" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.32.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">19b9545aad7edbcbaa4bcd3e6733881597a12517bff741171ad60dd352bfcb20</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.32.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3a05d91dc9616a1b80a1815f89d58467dec691e218232a428f233fc5ec89c116</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.32.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">4f6f025dca58da64c2300881e18f8767aa214eab6914aec981f04cad4cabb279</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.32.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">545febc87556ec16c279c26230fb883b148859cc22d37c47ed177b5eaf947e5e</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.32.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5ba40b9cc85bb96a75da0e9211a338c40abd7af21408c8937866824a4e3367c2</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.32.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">752c40f246fcc5ff3120a15a14dd51d87699c40a8bff0dd3f11964cb9ba5bbc8</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.32.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bc3568c3aa20a323156fab1380e53369fb181b1053ec555fe7a46760c1144963</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.32.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ca7be4b3206d8013941d92bf705e6b488bdc0dd6a8a0a2093cc3ae9a0a6cf9fd</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.32.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f5b6b119459888681ff76f11f4fe6bc6ddd2799e94e0ebbd8f909ac370ccd220</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.32.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f620aa48c01aa2c20075967f40ff6aa4a4271bf0c2d595039196415484741cc6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:37436</id>
    <title>Important: golang security, bug fix, and enhancement update</title>
    <issued date="2026-07-09 00:00:00"/>
    <updated date="2026-08-07 12:55:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>golang security, bug fix, and enhancement update</summary>
    <description>The golang packages provide the Go programming language compiler.  

Security Fix(es):  

  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)


Bug Fix(es) and Enhancement(s):  

  * Update Go to version 1.26.5+1 [almalinux-10.2.z] (JIRA:AlmaLinux-193473)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:37436" id="RHSA-2026:37436" type="rhsa" title="RHSA-2026:37436"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822"/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-37436.html" id="ALSA-2026:37436" type="self" title="ALSA-2026:37436"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-42505.html" id="CVE-2026-42505" type="cve" title="CVE-2026-42505"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="golang-race" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-race-1.26.5-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1cbc991bfa4a6ec99710a35e42664973cfa342027ab24531211da4d4dbadc94d</sum>
        </package>
        <package name="golang-bin" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-bin-1.26.5-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">542beb74da91ed137790a16c21e393398806c6ba7ca08f0c1792cdce64bf9742</sum>
        </package>
        <package name="go-toolset" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>go-toolset-1.26.5-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">613da6b6cf04438a7a695c602d3f4791b89456ad9fe4e1adcdcbeca2a02197de</sum>
        </package>
        <package name="golang-misc" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-misc-1.26.5-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8b1baa3232557c008b80897b0d878d2d32cb781b8cc9b3418c2541f114ab8bd2</sum>
        </package>
        <package name="golang" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-1.26.5-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">e1166f3fef5f21e4d793e4662fa7b28c2cfb0946536a43bb063399e734502503</sum>
        </package>
        <package name="golang-docs" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-docs-1.26.5-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">e79232aca5b77e65b500df22bd8d4d8328e0c2dce6833e3fc94730d5830a9c07</sum>
        </package>
        <package name="golang-tests" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-tests-1.26.5-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">e793fc42fe1650f9a19106e8b5b7a3d9bdb7d8d0204ee5e5af2c808d2d66a9bc</sum>
        </package>
        <package name="golang-src" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-src-1.26.5-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">ec33bba2e56c497962b088c3e47106cc014d357d9e7a0743489c3b9f1da82635</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38492</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-13 20:55:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
  * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
  * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38492" id="RHSA-2026:38492" type="rhsa" title="RHSA-2026:38492"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43163" id="CVE-2026-43163" type="cve" title="CVE-2026-43163"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43499" id="CVE-2026-43499" type="cve" title="CVE-2026-43499"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53166" id="CVE-2026-53166" type="cve" title="CVE-2026-53166"/>
      <reference href="https://bugzilla.redhat.com/2467059" id="2467059" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480453" id="2480453" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492805" id="2492805" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38492.html" id="ALSA-2026:38492" type="self" title="ALSA-2026:38492"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-debug-devel" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.33.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0d713c8112c12798b7d9f7249a55efad849ddac4baf31f7563196f2e0b62f697</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.33.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">39510ffe709a537c061e58e6f8e14b1aab0d75674621609f22506226e6da12cb</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.33.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4fce53c5c4992faeeabab874bf1f81d543402cd5696e687f4b3603d3e7d4e540</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.33.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5097c603457cd68b68c4646d462c2440b6051becbb2f16065c8f03c477a4d3be</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.33.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5624f9977c31127058404cc757433edcc061bc58277e4acc8e28f33b09f84d80</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.33.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">62c6e74e5f6a6b23cdba7137e93ce4115f6d12e2502a23a6bd552a51b329dbcd</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.33.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7458381f7b5f1b6ef1bfdb98741998e9ece8725e0d10bc22c157e95ce6cf719e</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.33.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ba7b70ff80444d6cd41c6892bcec8897e54bd41cad9bebd8d1b419c6ba880590</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.33.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">cb6b5ac15159f9f1673206a9a80d24ed89608d643c0b10f5ae9295c1579474e0</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.33.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dd3a20066774bab0ae3c0d836c82031f9905f2a9e9ec90fd5c27134cb3102f8c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38494</id>
    <title>Important: buildah security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-14 08:57:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>buildah security update</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   

Security Fix(es):  

  * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38494" id="RHSA-2026:38494" type="rhsa" title="RHSA-2026:38494"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822"/>
      <reference href="https://bugzilla.redhat.com/2498152" id="2498152" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38494.html" id="ALSA-2026:38494" type="self" title="ALSA-2026:38494"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="buildah" version="1.43.1" release="4.el10_2" epoch="2" arch="x86_64_v2" src="buildah-1.43.1-4.el10_2.src.rpm">
          <filename>buildah-1.43.1-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a82021e09dd848ca54e4c32414c4a2142c4e4684e514e137aa3beb8ae7a1d5dc</sum>
        </package>
        <package name="buildah-tests" version="1.43.1" release="4.el10_2" epoch="2" arch="x86_64_v2" src="buildah-1.43.1-4.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ba5e03c3835b02f0509453038342ef23f509e04ad3f14245a972fc6119cee782</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38495</id>
    <title>Important: podman security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-14 08:52:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38495" id="RHSA-2026:38495" type="rhsa" title="RHSA-2026:38495"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822"/>
      <reference href="https://bugzilla.redhat.com/2498152" id="2498152" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38495.html" id="ALSA-2026:38495" type="self" title="ALSA-2026:38495"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="podman" version="5.8.2" release="5.el10_2.alma.1" epoch="7" arch="x86_64_v2" src="podman-5.8.2-5.el10_2.alma.1.src.rpm">
          <filename>podman-5.8.2-5.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">632f46af926fd00a939ebe765469e37d8d291ad078d2dbe977868aeea8954e64</sum>
        </package>
        <package name="podman-docker" version="5.8.2" release="5.el10_2.alma.1" epoch="7" arch="noarch" src="podman-5.8.2-5.el10_2.alma.1.src.rpm">
          <filename>podman-docker-5.8.2-5.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">6d642e7bf54d7d8737244e959bd94e167100278c8303a9671587b40898d8f8a0</sum>
        </package>
        <package name="podman-remote" version="5.8.2" release="5.el10_2.alma.1" epoch="7" arch="x86_64_v2" src="podman-5.8.2-5.el10_2.alma.1.src.rpm">
          <filename>podman-remote-5.8.2-5.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">deaf61ef369e1c9a70ade6241a9d8fd787eedfacd302b99a507f5fd24094790f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38499</id>
    <title>Important: openexr security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-14 08:51:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>openexr security update</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.  

Security Fix(es):  

  * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142)
  * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38499" id="RHSA-2026:38499" type="rhsa" title="RHSA-2026:38499"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41142" id="CVE-2026-41142" type="cve" title="CVE-2026-41142"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42216" id="CVE-2026-42216" type="cve" title="CVE-2026-42216"/>
      <reference href="https://bugzilla.redhat.com/2467623" id="2467623" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467633" id="2467633" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38499.html" id="ALSA-2026:38499" type="self" title="ALSA-2026:38499"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="openexr" version="3.1.10" release="8.el10_2.3" epoch="0" arch="x86_64_v2" src="openexr-3.1.10-8.el10_2.3.src.rpm">
          <filename>openexr-3.1.10-8.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">422a266407251cc04240c86fd5f7b3dee937f8c8ca75b65213907068dcee7f87</sum>
        </package>
        <package name="openexr-libs" version="3.1.10" release="8.el10_2.3" epoch="0" arch="x86_64_v2" src="openexr-3.1.10-8.el10_2.3.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">ed9b3c64de669c6b9ab6ce83043f40e4798d692eff95eb75360cc09a95961b86</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38509</id>
    <title>Important: vim security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-08-13 08:05:34"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>vim security update</summary>
    <description>Vim (Vi IMproved) is an updated and improved version of the vi editor.  

Security Fix(es):  

  * vim: command injection when decompressing .tgz archives (CVE-2026-46483)
  * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162)
  * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858)
  * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38509" id="RHSA-2026:38509" type="rhsa" title="RHSA-2026:38509"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46483" id="CVE-2026-46483" type="cve" title="CVE-2026-46483"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47162" id="CVE-2026-47162" type="cve" title="CVE-2026-47162"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47167" id="CVE-2026-47167" type="cve" title="CVE-2026-47167"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52858" id="CVE-2026-52858" type="cve" title="CVE-2026-52858"/>
      <reference href="https://bugzilla.redhat.com/2477915" id="2477915" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487964" id="2487964" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38509.html" id="ALSA-2026:38509" type="self" title="ALSA-2026:38509"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="vim-X11" version="9.1.083" release="9.el10_2.7" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.7.src.rpm">
          <filename>vim-X11-9.1.083-9.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">260ecf6a4cd51cd6b13a22a0bb827c83bbf3bdd15acb86b40e1224a8fb81198f</sum>
        </package>
        <package name="vim-enhanced" version="9.1.083" release="9.el10_2.7" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.7.src.rpm">
          <filename>vim-enhanced-9.1.083-9.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">57e1a1f02300d87eb8b3dfe91fbb69c6d95847cdf36b482f976cdf6a0b6f74b6</sum>
        </package>
        <package name="vim-common" version="9.1.083" release="9.el10_2.7" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.7.src.rpm">
          <filename>vim-common-9.1.083-9.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">de2d57b57c3a5985910afd4e7df7a2c65fe669a04ad3fcb90b9bd41af867b9c9</sum>
        </package>
        <package name="xxd" version="9.1.083" release="9.el10_2.7" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.7.src.rpm">
          <filename>xxd-9.1.083-9.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">e8054467483a2f4c3cb5b06dc05e52e23e140cdc5649902934112bc4ec605012</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38513</id>
    <title>Important: perl-DBI security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-08-07 12:55:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-DBI security update</summary>
    <description>DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  

Security Fix(es):  

  * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38513" id="RHSA-2026:38513" type="rhsa" title="RHSA-2026:38513"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9698" id="CVE-2026-9698" type="cve" title="CVE-2026-9698"/>
      <reference href="https://bugzilla.redhat.com/2486734" id="2486734" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38513.html" id="ALSA-2026:38513" type="self" title="ALSA-2026:38513"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-10879.html" id="CVE-2026-10879" type="cve" title="CVE-2026-10879"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="perl-DBI" version="1.643" release="26.el10_2.1" epoch="0" arch="x86_64_v2" src="perl-DBI-1.643-26.el10_2.1.src.rpm">
          <filename>perl-DBI-1.643-26.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">5b9206b592ef895f76c3ba4cbb314ebff20d9973e1fcd2837652b4f731e6963c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38514</id>
    <title>Important: plexus-utils security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-14 08:49:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>plexus-utils security update</summary>
    <description>The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage.  

Security Fix(es):  

  * org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38514" id="RHSA-2026:38514" type="rhsa" title="RHSA-2026:38514"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-67030" id="CVE-2025-67030" type="cve" title="CVE-2025-67030"/>
      <reference href="https://bugzilla.redhat.com/2451409" id="2451409" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38514.html" id="ALSA-2026:38514" type="self" title="ALSA-2026:38514"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="plexus-utils" version="3.5.1" release="9.el10_2" epoch="0" arch="noarch" src="plexus-utils-3.5.1-9.el10_2.src.rpm">
          <filename>plexus-utils-3.5.1-9.el10_2.noarch.rpm</filename>
          <sum type="sha256">0e05d395f8b55a153026dfa3c8010ad4245d0439c34d80e42db758da41ab8738</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39183</id>
    <title>Important: python3.12 security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 08:44:08"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.12 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39183" id="RHSA-2026:39183" type="rhsa" title="RHSA-2026:39183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15308" id="CVE-2026-15308" type="cve" title="CVE-2026-15308"/>
      <reference href="https://bugzilla.redhat.com/2498608" id="2498608" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39183.html" id="ALSA-2026:39183" type="self" title="ALSA-2026:39183"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python-unversioned-command" version="3.12.13" release="2.el10_2.1" epoch="0" arch="noarch" src="python3.12-3.12.13-2.el10_2.1.src.rpm">
          <filename>python-unversioned-command-3.12.13-2.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">01fd0cfaa34357b582559770297e93d57c2b9e0ffb6f529c89ba4cd34d50ce96</sum>
        </package>
        <package name="python3-devel" version="3.12.13" release="2.el10_2.1" epoch="0" arch="x86_64_v2" src="python3.12-3.12.13-2.el10_2.1.src.rpm">
          <filename>python3-devel-3.12.13-2.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">a666629529d0714d232dc7eaae7e936e85b45e2c7c79bf3ce0c09b010ff32ef3</sum>
        </package>
        <package name="python3-tkinter" version="3.12.13" release="2.el10_2.1" epoch="0" arch="x86_64_v2" src="python3.12-3.12.13-2.el10_2.1.src.rpm">
          <filename>python3-tkinter-3.12.13-2.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">d6a8f03da143bb04f00805b27de2fdf8ba19d61e6b9e41262a3f5dd52812823b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39272</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 10:04:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>git-lfs security update</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.  

Security Fix(es):  

  * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39272" id="RHSA-2026:39272" type="rhsa" title="RHSA-2026:39272"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811"/>
      <reference href="https://bugzilla.redhat.com/2467822" id="2467822" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39272.html" id="ALSA-2026:39272" type="self" title="ALSA-2026:39272"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="git-lfs" version="3.7.1" release="5.el10_2.6" epoch="0" arch="x86_64_v2" src="git-lfs-3.7.1-5.el10_2.6.src.rpm">
          <filename>git-lfs-3.7.1-5.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">e1cc99c6df527b7ca90d7c1ca3856051e578026b22ddbff8a9e90673f0ba640e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39296</id>
    <title>Moderate: libinput security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 08:42:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libinput security update</summary>
    <description>libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices.  

Security Fix(es):  

  * libinput: local privilege escalation via crafted uinput devices (CVE-2026-50292)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39296" id="RHSA-2026:39296" type="rhsa" title="RHSA-2026:39296"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50292" id="CVE-2026-50292" type="cve" title="CVE-2026-50292"/>
      <reference href="https://bugzilla.redhat.com/2485390" id="2485390" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39296.html" id="ALSA-2026:39296" type="self" title="ALSA-2026:39296"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libinput" version="1.30.1" release="2.el10_2" epoch="0" arch="x86_64_v2" src="libinput-1.30.1-2.el10_2.src.rpm">
          <filename>libinput-1.30.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">15063957f45eef42384618e7af39ade2cb381ee09c1f48ded3dc044eb00aa982</sum>
        </package>
        <package name="libinput-utils" version="1.30.1" release="2.el10_2" epoch="0" arch="x86_64_v2" src="libinput-1.30.1-2.el10_2.src.rpm">
          <filename>libinput-utils-1.30.1-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6ebdb727e613467b8b481e73b9e77d08164e7aec1d51e2ac54625957ce98704f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39297</id>
    <title>Moderate: edk2 security, bug fix, and enhancement update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-08-13 08:05:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>edk2 security, bug fix, and enhancement update</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   

Security Fix(es):  

  * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)
  * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)


Bug Fix(es) and Enhancement(s):  

  * edk2/x64: re-enable legacy kernel loader [almalinux-10.2.z] (JIRA:AlmaLinux-182421)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39297" id="RHSA-2026:39297" type="rhsa" title="RHSA-2026:39297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-28390" id="CVE-2026-28390" type="cve" title="CVE-2026-28390"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31790" id="CVE-2026-31790" type="cve" title="CVE-2026-31790"/>
      <reference href="https://bugzilla.redhat.com/2451094" id="2451094" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456314" id="2456314" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39297.html" id="ALSA-2026:39297" type="self" title="ALSA-2026:39297"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="edk2-ovmf" version="20251114" release="5.el10_2.2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.2.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">15c2aa72562324380757fa4e4264b27e8d215a4ead60505448e6556096472823</sum>
        </package>
        <package name="edk2-aarch64" version="20251114" release="5.el10_2.2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.2.src.rpm">
          <filename>edk2-aarch64-20251114-5.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">5ebf1586f73cdbb4f6af4b6fac8634e21e96c81337572dd52d11cb6022b477ab</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39302</id>
    <title>Moderate: cups security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 08:41:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>cups security update</summary>
    <description>The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.  

Security Fix(es):  

  * cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVE-2026-34980)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39302" id="RHSA-2026:39302" type="rhsa" title="RHSA-2026:39302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34980" id="CVE-2026-34980" type="cve" title="CVE-2026-34980"/>
      <reference href="https://bugzilla.redhat.com/2454954" id="2454954" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39302.html" id="ALSA-2026:39302" type="self" title="ALSA-2026:39302"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="cups-client" version="2.4.10" release="18.el10_2" epoch="1" arch="x86_64_v2" src="cups-2.4.10-18.el10_2.src.rpm">
          <filename>cups-client-2.4.10-18.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0accd6275be42ffe6394fa9d3ca1e6a905844e9481e5b3d4b1e0548672a3793d</sum>
        </package>
        <package name="cups-printerapp" version="2.4.10" release="18.el10_2" epoch="1" arch="x86_64_v2" src="cups-2.4.10-18.el10_2.src.rpm">
          <filename>cups-printerapp-2.4.10-18.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">76d2bac4bf175154ba7237c800d3e0fa31f17ccf80477692ba086853ebf831a9</sum>
        </package>
        <package name="cups-ipptool" version="2.4.10" release="18.el10_2" epoch="1" arch="x86_64_v2" src="cups-2.4.10-18.el10_2.src.rpm">
          <filename>cups-ipptool-2.4.10-18.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9dbbe06af9aa38dc10f4a1081f4c80414dd4f5c13b77211dafd641033e03d9e7</sum>
        </package>
        <package name="cups" version="2.4.10" release="18.el10_2" epoch="1" arch="x86_64_v2" src="cups-2.4.10-18.el10_2.src.rpm">
          <filename>cups-2.4.10-18.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b3b673987c8ecfa27357f873b93120b39231c081129efcc46e24cdb0c2f3c159</sum>
        </package>
        <package name="cups-lpd" version="2.4.10" release="18.el10_2" epoch="1" arch="x86_64_v2" src="cups-2.4.10-18.el10_2.src.rpm">
          <filename>cups-lpd-2.4.10-18.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d04e6afa6daa7639465e73572a5788943be2aefb2e6e610712428258a0437a56</sum>
        </package>
        <package name="cups-devel" version="2.4.10" release="18.el10_2" epoch="1" arch="x86_64_v2" src="cups-2.4.10-18.el10_2.src.rpm">
          <filename>cups-devel-2.4.10-18.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e8901fc973ec37afb159a9c4cb75bce71ac04c4d589bbf5d8acf9119c43cb8b5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39304</id>
    <title>Low: libxml2 security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 08:40:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>libxml2 security update</summary>
    <description>The libxml2 library is a development toolbox providing the implementation of various XML standards.  

Security Fix(es):  

  * libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling (CVE-2025-6170)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39304" id="RHSA-2026:39304" type="rhsa" title="RHSA-2026:39304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-6170" id="CVE-2025-6170" type="cve" title="CVE-2025-6170"/>
      <reference href="https://bugzilla.redhat.com/2372952" id="2372952" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39304.html" id="ALSA-2026:39304" type="self" title="ALSA-2026:39304"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libxml2-devel" version="2.12.5" release="10.el10_2.2" epoch="0" arch="x86_64_v2" src="libxml2-2.12.5-10.el10_2.2.src.rpm">
          <filename>libxml2-devel-2.12.5-10.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">0d4f565cac1bdc27b73a3a740b4724b33a6913784d8c9c89062a04a5ba040890</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39494</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-08-07 12:56:48"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
  * kernel: XFS data corruption using reflink ()


Bug Fix(es) and Enhancement(s):  

  * [Exploits (KEV)] kernel: XFS data corruption using reflink [almalinux-10.2.z] (JIRA:AlmaLinux-193945)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39494" id="RHSA-2026:39494" type="rhsa" title="RHSA-2026:39494"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53016" id="CVE-2026-53016" type="cve" title="CVE-2026-53016"/>
      <reference href="https://bugzilla.redhat.com/2492269" id="2492269" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498915" id="2498915" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39494.html" id="ALSA-2026:39494" type="self" title="ALSA-2026:39494"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-64600.html" id="CVE-2026-64600" type="cve" title="CVE-2026-64600"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-devel" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.34.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0364f47b3ce64b1890776e98f7fb4038608bf4e8a12035819366d2f8acbf3c18</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.34.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1b1860d2e35bfe429be5e14b275d8eb100dbdf6736c8fc21e3f5985e4c704827</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.34.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">46397efbfa10316e813cdc4f62e541223f2c81bc1c79b21228eba271c0adeed1</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.34.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7672c079d6b53c843a1bac816ec35358bc7d581cb0c5e8da0222822633657af0</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.34.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">840737602a1fbdd843258e04077e3c1cbf1d1449a1243c2c2c7c4cc65622489b</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.34.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a4829cf1a8eda25780757481520773b5a1b4a0e276121886e63a4695ae98c213</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.34.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b4adf5da379c08594043dd2e213ba949e0aa9b1f496db6fbf92f347e7bce0be8</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.34.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cc522ff1a7ee1efd4cfbb6bfa66a30337d9680ae8738468d9127b05226091442</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.34.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dc0dcaf70d81c1f3d9e4963dcf70c17960cf6404b36d968f95cb269783cace5a</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.34.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">f70c0c028135ad9c40726ef7b16d8d2b3251fe80614da1fb1532d5c0d7eb97a4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39547</id>
    <title>Important: perl-XML-LibXML security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-21 13:11:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-XML-LibXML security update</summary>
    <description>This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation.  

Security Fix(es):  

  * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39547" id="RHSA-2026:39547" type="rhsa" title="RHSA-2026:39547"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8177" id="CVE-2026-8177" type="cve" title="CVE-2026-8177"/>
      <reference href="https://bugzilla.redhat.com/2468684" id="2468684" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39547.html" id="ALSA-2026:39547" type="self" title="ALSA-2026:39547"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="perl-XML-LibXML" version="2.0210" release="4.el10_2.1" epoch="1" arch="x86_64_v2" src="perl-XML-LibXML-2.0210-4.el10_2.1.src.rpm">
          <filename>perl-XML-LibXML-2.0210-4.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">2fdf8956a0f66725af8180de7186359cf3b1416d5e1bb5d82558ef83fd18acf1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39573</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-21 13:11:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>yggdrasil security update</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.  

Security Fix(es):  

  * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39573" id="RHSA-2026:39573" type="rhsa" title="RHSA-2026:39573"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://bugzilla.redhat.com/2467822" id="2467822" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484207" id="2484207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39573.html" id="ALSA-2026:39573" type="self" title="ALSA-2026:39573"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="yggdrasil" version="0.4.9.2" release="1.el10_2" epoch="0" arch="x86_64_v2" src="yggdrasil-0.4.9.2-1.el10_2.src.rpm">
          <filename>yggdrasil-0.4.9.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cf212c0717f037fd48ffaa6af569695e835c4ecfca94ed8a44316751400a7da6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39976</id>
    <title>Important: hplip security update</title>
    <issued date="2026-07-15 00:00:00"/>
    <updated date="2026-07-21 13:13:59"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>hplip security update</summary>
    <description>The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.  

Security Fix(es):  

  * HPLIP: Incomplete Fix for CVE-2026-8631 (CVE-2026-14544)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39976" id="RHSA-2026:39976" type="rhsa" title="RHSA-2026:39976"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14544" id="CVE-2026-14544" type="cve" title="CVE-2026-14544"/>
      <reference href="https://bugzilla.redhat.com/2496772" id="2496772" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39976.html" id="ALSA-2026:39976" type="self" title="ALSA-2026:39976"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="hplip" version="3.23.12" release="10.el10_2.5" epoch="0" arch="x86_64_v2" src="hplip-3.23.12-10.el10_2.5.src.rpm">
          <filename>hplip-3.23.12-10.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">0b8511bdcf0f3a91c0e27a6b281da84aa8a1236e4fcb4fe02f7b5c37406ee88c</sum>
        </package>
        <package name="hplip-common" version="3.23.12" release="10.el10_2.5" epoch="0" arch="x86_64_v2" src="hplip-3.23.12-10.el10_2.5.src.rpm">
          <filename>hplip-common-3.23.12-10.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">4c4ee80ec33b594b411b120da96d1d455252d6071e959c868a49320f1d9841dc</sum>
        </package>
        <package name="hplip-libs" version="3.23.12" release="10.el10_2.5" epoch="0" arch="x86_64_v2" src="hplip-3.23.12-10.el10_2.5.src.rpm">
          <filename>hplip-libs-3.23.12-10.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">f9fc2df65613ff1b8c3e8a68c91d42f0c05c1cc74a7a8e92e83716a1cf5441df</sum>
        </package>
        <package name="libsane-hpaio" version="3.23.12" release="10.el10_2.5" epoch="0" arch="x86_64_v2" src="hplip-3.23.12-10.el10_2.5.src.rpm">
          <filename>libsane-hpaio-3.23.12-10.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">fe4d025c6f7d0238232c83d904c614a4901fa65fe8c336f08c62065dc494bb16</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:40833</id>
    <title>Important: pacemaker security update</title>
    <issued date="2026-07-16 00:00:00"/>
    <updated date="2026-08-13 08:05:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>pacemaker security update</summary>
    <description>The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures.   

Security Fix(es):  

  * pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:40833" id="RHSA-2026:40833" type="rhsa" title="RHSA-2026:40833"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10649" id="CVE-2026-10649" type="cve" title="CVE-2026-10649"/>
      <reference href="https://bugzilla.redhat.com/2462817" id="2462817" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-40833.html" id="ALSA-2026:40833" type="self" title="ALSA-2026:40833"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="pacemaker-schemas" version="3.0.1" release="5.el10_2.1" epoch="0" arch="noarch" src="pacemaker-3.0.1-5.el10_2.1.src.rpm">
          <filename>pacemaker-schemas-3.0.1-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6e3da70c121af183095ce7a58c2b0a382194143758f71b5c897c62fa60a07c53</sum>
        </package>
        <package name="pacemaker-cluster-libs" version="3.0.1" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="pacemaker-3.0.1-5.el10_2.1.src.rpm">
          <filename>pacemaker-cluster-libs-3.0.1-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">6f8fb526df2f8e63e300214c5f4f26152156690de76d2f620ea977d8f3a2719e</sum>
        </package>
        <package name="pacemaker-libs" version="3.0.1" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="pacemaker-3.0.1-5.el10_2.1.src.rpm">
          <filename>pacemaker-libs-3.0.1-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b040c830bf367a7a17ae8fe57970f036094a8dc81596da80b2b19887006e6001</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:40856</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-07-16 00:00:00"/>
    <updated date="2026-07-17 07:54:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:40856" id="RHSA-2026:40856" type="rhsa" title="RHSA-2026:40856"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15308" id="CVE-2026-15308" type="cve" title="CVE-2026-15308"/>
      <reference href="https://bugzilla.redhat.com/2498608" id="2498608" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-40856.html" id="ALSA-2026:40856" type="self" title="ALSA-2026:40856"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3.14" version="3.14.5" release="1.el10_2.1" epoch="0" arch="x86_64_v2" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-3.14.5-1.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">03e493c9eff5a45c6ae9336101f91df59fc4df5a7aa4ed8d64552bdc1a2464a7</sum>
        </package>
        <package name="python3.14-devel" version="3.14.5" release="1.el10_2.1" epoch="0" arch="x86_64_v2" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-devel-3.14.5-1.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0e641d8847270e0e79c852c705e529badf283fd3e7a795468bd996b40ea3a7b5</sum>
        </package>
        <package name="python3.14-tkinter" version="3.14.5" release="1.el10_2.1" epoch="0" arch="x86_64_v2" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-tkinter-3.14.5-1.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">c8dfe8822fb76a11d968e0a636c69fa4bd43ca9bf6f1ea3e46aad50deb2c24e0</sum>
        </package>
        <package name="python3.14-libs" version="3.14.5" release="1.el10_2.1" epoch="0" arch="x86_64_v2" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-libs-3.14.5-1.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">eb97b7254d358fc5ad83da9e62df20a3b35fcc3d6378a8ec44c1d840677e782b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41892</id>
    <title>Important: libtiff security, bug fix, and enhancement update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-20 11:48:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libtiff security, bug fix, and enhancement update</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.  

Security Fix(es):  

  * libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)
  * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)


Bug Fix(es) and Enhancement(s):  

  * Reintroduce the `tiffcp -i` option (JIRA:AlmaLinux-185328)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41892" id="RHSA-2026:41892" type="rhsa" title="RHSA-2026:41892"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2023-52355" id="CVE-2023-52355" type="cve" title="CVE-2023-52355"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12912" id="CVE-2026-12912" type="cve" title="CVE-2026-12912"/>
      <reference href="https://bugzilla.redhat.com/2251326" id="2251326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492871" id="2492871" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41892.html" id="ALSA-2026:41892" type="self" title="ALSA-2026:41892"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libtiff-devel" version="4.6.0" release="8.el10_2.4" epoch="0" arch="x86_64_v2" src="libtiff-4.6.0-8.el10_2.4.src.rpm">
          <filename>libtiff-devel-4.6.0-8.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">8b13ab18868edbbad1f250c53345c2120e3adf12a46979a085c14e6bc0492309</sum>
        </package>
        <package name="libtiff" version="4.6.0" release="8.el10_2.4" epoch="0" arch="x86_64_v2" src="libtiff-4.6.0-8.el10_2.4.src.rpm">
          <filename>libtiff-4.6.0-8.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">cdbd80887d980d5bef58853094b48aa7a48560bb501799b674f143ae8c228e15</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41893</id>
    <title>Important: .NET 8.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-31 12:34:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 8.0 security, bug fix, and enhancement update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.  

Security Fix(es):  

  * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-10.2.z] (JIRA:AlmaLinux-192468)
  * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192329)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41893" id="RHSA-2026:41893" type="rhsa" title="RHSA-2026:41893"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50525" id="CVE-2026-50525" type="cve" title="CVE-2026-50525"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108"/>
      <reference href="https://bugzilla.redhat.com/2499217" id="2499217" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500109" id="2500109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500189" id="2500189" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500492" id="2500492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500502" id="2500502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500509" id="2500509" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500515" id="2500515" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500556" id="2500556" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500562" id="2500562" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500563" id="2500563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500565" id="2500565" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500577" id="2500577" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500580" id="2500580" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500581" id="2500581" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500587" id="2500587" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500593" id="2500593" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41893.html" id="ALSA-2026:41893" type="self" title="ALSA-2026:41893"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dotnet-hostfxr-8.0" version="8.0.29" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.29-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0e010a8e82eb3e8d6a005904c8705de1718d4f678b32fd26bdccb86899fa838a</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" version="8.0.29" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.29-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">294819d619d5983353fe9f148fe0978edc308fbf4a6e06ecb54c60cb50e38cc4</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" version="8.0.29" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.29-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3d954260f083c0688ba829d63220296e639fd4dc93edefd61177c2282af6a425</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" version="8.0.29" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.29-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8015f97f82960613227d975ddf5cdf8d7e139073c24d031c44cf9c263921a44a</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" version="8.0.129" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.129-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9c43c35c8ec4ceb5462d2703e3bd42f973280d57a501cc9b5dde3e6f93b8ceb7</sum>
        </package>
        <package name="dotnet-runtime-8.0" version="8.0.29" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.29-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a7d76c909082c1dfd25f891c965f089ebe456424179d6cafd0d46bdcd1002ac8</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" version="8.0.29" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.29-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ab37c5882c6ef03169197270515cd8b6779931412a9858ed4c8fd5e1fe495907</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" version="8.0.29" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.29-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">abc28728eaa3720f90b2746113fee5eccf6d327d15c36ee16a176c341bb4b72b</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" version="8.0.29" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.29-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b8675dc48e88147b51777a05722bed7a24ff7d77e428617103c26b9c4ed4d44b</sum>
        </package>
        <package name="dotnet-templates-8.0" version="8.0.129" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.129-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e67f6b5ad82daf2df1fd0f46f86663f648de3f178d0acfd2527329c5039f2b55</sum>
        </package>
        <package name="dotnet-sdk-8.0" version="8.0.129" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.129-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f74e8082689fca37a0711270b1bf1dcd685b2a4d6835d4750bde4f53a64ee0ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41895</id>
    <title>Important: .NET 9.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-08-19 21:10:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 9.0 security, bug fix, and enhancement update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.  

Security Fix(es):  

  * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473)
  * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41895" id="RHSA-2026:41895" type="rhsa" title="RHSA-2026:41895"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108"/>
      <reference href="https://bugzilla.redhat.com/2499217" id="2499217" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500109" id="2500109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500189" id="2500189" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500492" id="2500492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500502" id="2500502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500509" id="2500509" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500515" id="2500515" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500556" id="2500556" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500562" id="2500562" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500563" id="2500563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500565" id="2500565" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500577" id="2500577" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500581" id="2500581" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500587" id="2500587" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500593" id="2500593" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41895.html" id="ALSA-2026:41895" type="self" title="ALSA-2026:41895"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-50525.html" id="CVE-2026-50525" type="cve" title="CVE-2026-50525"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dotnet-runtime-9.0" version="9.0.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">13aaccc85931690473adf4bb9fa879162dd18741b980cac620a72aacaa9f2365</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" version="9.0.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3f7267ce9f18ac939e5318acf8dd763663be291984c6a6dd00823a3c8d3fa0ce</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" version="9.0.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4023b6bee27bc557253b6c2429bde98fc6b316e298e034e4cc4adf3d88194de6</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" version="9.0.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4dc358a37f0b94c683a830fc46b5e5dc6b916a8b7e7f8a5e9f4bfbce5b05860e</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" version="9.0.119" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.119-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">555497d4082fd3cd05f9b989231092c2da2c6dd9b5a7f21df7dd3cf34cafa41d</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" version="9.0.119" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">80fab07174c46b8b067182cdb3b030da715e98db3725e7a1d06fcdc3c45d2951</sum>
        </package>
        <package name="dotnet-sdk-9.0" version="9.0.119" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.119-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8cff075bf7e9a5ab20d5e89b980abaddf111d29c07e9f3e8966e00565944a10b</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" version="9.0.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bd15afcb5176243974bef3462e8c1d8433a245c9eb1d689d961ddde30790576b</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" version="9.0.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c931bb88495e0902ec23a28b6a797dfb2796dc538dccf9bef885da602bd047b5</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" version="9.0.119" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.119-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d2823d3af8e77d7fa262e390feaf281902397a09adf35c92407f0368d7a4eabf</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" version="9.0.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d4d62a9c87d4ff79374fa363e423bff5eaf758d5f974be0319ce2c8d6ef0d4ae</sum>
        </package>
        <package name="dotnet-templates-9.0" version="9.0.119" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.119-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e0f088058def4db45d741d69e4e2ebaa4c040c7881dc566e91082b8d50c67e49</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" version="9.0.18" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.18-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e7d6e20b3b62d780037f3d09095080808635c6b6093ffb3395b9b7c415f9445f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41897</id>
    <title>Important: .NET 10.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-08-19 21:10:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 10.0 security, bug fix, and enhancement update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.  

Security Fix(es):  

  * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-10.2.z] (JIRA:AlmaLinux-192463)
  * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192326)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41897" id="RHSA-2026:41897" type="rhsa" title="RHSA-2026:41897"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108"/>
      <reference href="https://bugzilla.redhat.com/2499217" id="2499217" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500109" id="2500109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500189" id="2500189" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500492" id="2500492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500502" id="2500502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500509" id="2500509" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500515" id="2500515" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500556" id="2500556" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500562" id="2500562" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500563" id="2500563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500565" id="2500565" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500577" id="2500577" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500581" id="2500581" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500587" id="2500587" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500593" id="2500593" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41897.html" id="ALSA-2026:41897" type="self" title="ALSA-2026:41897"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-50525.html" id="CVE-2026-50525" type="cve" title="CVE-2026-50525"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="aspnetcore-runtime-10.0" version="10.0.10" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.10-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0aa44f33b5d982ef8d3426041a3ad672b4f7ae9084382c1f9d0085980dd806f8</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" version="10.0.110" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.110-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">24b0536a21ce84ef290e3a92b6568bc8be107507b9951d4c3c1299ea0ff25c45</sum>
        </package>
        <package name="dotnet-host" version="10.0.10" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.10-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2a767f3d5d355afdd2aa61335722ad3776ce1906d8bbedfe4506b16b4ccd0056</sum>
        </package>
        <package name="dotnet-runtime-10.0" version="10.0.10" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.10-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">616de4b2ee46ac6d6db412eb4ba4fa6361a9871d6411477ed3be6790a1137202</sum>
        </package>
        <package name="dotnet-templates-10.0" version="10.0.110" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.110-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7b5643491f52cb0406644afade54703299a3c2098aa727c7622b6e1d5532bf50</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" version="10.0.10" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.10-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ac8bb065cd2096f87b936e5051319f957031885cda0939639ccd8d04e857d1b4</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" version="10.0.10" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.10-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b35f60d85c5507ac6863bfb417d4a8261c58c0477a20f44bec1a7bd11bf2db74</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" version="10.0.10" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.10-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c0e0c85fbd68c4cea8334d66bf381ef029b9f1f17f931e4a856fd82d15f8c7f7</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" version="10.0.10" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.10-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d27a61565baa69e7e058c8a16b3044257735d5a5010e074a511362a6b4fe4b47</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" version="10.0.10" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.10-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ec17169d34ecac71e35e292ae8d372a749297c38d9bb11e0a20a0346529c0623</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" version="10.0.110" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.110-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ee4a4263a79666102c1eed70746173088fa49c6964477697165d0420344f7eab</sum>
        </package>
        <package name="dotnet-sdk-10.0" version="10.0.110" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.110-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f04d9325a27c286066c3ab3629a90d8bf40254fd465baecf5a9342e0ba476e2d</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" version="10.0.10" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.10-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f5eee323ce7c0ec778bfa60b7beba7ed54ab333aa6408bd3ab312ac2c67049d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41937</id>
    <title>Important: sssd security update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-22 13:35:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>sssd security update</summary>
    <description>The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.  

Security Fix(es):  

  * sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474)
  * sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41937" id="RHSA-2026:41937" type="rhsa" title="RHSA-2026:41937"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14474" id="CVE-2026-14474" type="cve" title="CVE-2026-14474"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14476" id="CVE-2026-14476" type="cve" title="CVE-2026-14476"/>
      <reference href="https://bugzilla.redhat.com/2496556" id="2496556" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2496581" id="2496581" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41937.html" id="ALSA-2026:41937" type="self" title="ALSA-2026:41937"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="sssd-idp" version="2.12.0" release="3.el10_2.1" epoch="0" arch="x86_64_v2" src="sssd-2.12.0-3.el10_2.1.src.rpm">
          <filename>sssd-idp-2.12.0-3.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0a14e8e926cbd609f179ef9a3358eecc5a26ccfc3456ccf74d4aa148f3e2ef21</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41988</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-21 10:27:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dovecot security update</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   

Security Fix(es):  

  * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41988" id="RHSA-2026:41988" type="rhsa" title="RHSA-2026:41988"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42006" id="CVE-2026-42006" type="cve" title="CVE-2026-42006"/>
      <reference href="https://bugzilla.redhat.com/2476476" id="2476476" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41988.html" id="ALSA-2026:41988" type="self" title="ALSA-2026:41988"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dovecot" version="2.3.21" release="19.el10_2.1" epoch="1" arch="x86_64_v2" src="dovecot-2.3.21-19.el10_2.1.src.rpm">
          <filename>dovecot-2.3.21-19.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7b5acf171b3c43c8de8fafb9a136e28b9b72aaa602ed703d3c5acd3bd89d3528</sum>
        </package>
        <package name="dovecot-mysql" version="2.3.21" release="19.el10_2.1" epoch="1" arch="x86_64_v2" src="dovecot-2.3.21-19.el10_2.1.src.rpm">
          <filename>dovecot-mysql-2.3.21-19.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">99d43321e8cb84b4c06d2d1a9cb4deb1192e0356d32c7ed15b04221a6c2d094c</sum>
        </package>
        <package name="dovecot-pigeonhole" version="2.3.21" release="19.el10_2.1" epoch="1" arch="x86_64_v2" src="dovecot-2.3.21-19.el10_2.1.src.rpm">
          <filename>dovecot-pigeonhole-2.3.21-19.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b9b3c6713abda18d9a888ed048ed35f164dda7108c0be701efde378cba325b89</sum>
        </package>
        <package name="dovecot-pgsql" version="2.3.21" release="19.el10_2.1" epoch="1" arch="x86_64_v2" src="dovecot-2.3.21-19.el10_2.1.src.rpm">
          <filename>dovecot-pgsql-2.3.21-19.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">cdc546a2e3fb28025497fed9daa51035b2961f33a1d35622f238c3ff8106a2c4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42063</id>
    <title>Important: glib2 security update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-21 10:25:25"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>glib2 security update</summary>
    <description>GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.  

Security Fix(es):  

  * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42063" id="RHSA-2026:42063" type="rhsa" title="RHSA-2026:42063"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58016" id="CVE-2026-58016" type="cve" title="CVE-2026-58016"/>
      <reference href="https://bugzilla.redhat.com/2492257" id="2492257" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42063.html" id="ALSA-2026:42063" type="self" title="ALSA-2026:42063"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="glib2-tests" version="2.80.4" release="12.el10_2.14" epoch="0" arch="x86_64_v2" src="glib2-2.80.4-12.el10_2.14.src.rpm">
          <filename>glib2-tests-2.80.4-12.el10_2.14.x86_64_v2.rpm</filename>
          <sum type="sha256">6f6a9679baf91804851c01d519bd6bdee4818abe8315d19d86b06dc100edcb5a</sum>
        </package>
        <package name="glib2-devel" version="2.80.4" release="12.el10_2.14" epoch="0" arch="x86_64_v2" src="glib2-2.80.4-12.el10_2.14.src.rpm">
          <filename>glib2-devel-2.80.4-12.el10_2.14.x86_64_v2.rpm</filename>
          <sum type="sha256">b75ae13d51068e2489f63fb5c1e6951d98dd54be565b36f7fc3abbd9547aa48a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42096</id>
    <title>Important: c-ares security update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-21 10:21:34"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>c-ares security update</summary>
    <description>The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.  

Security Fix(es):  

  * c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42096" id="RHSA-2026:42096" type="rhsa" title="RHSA-2026:42096"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33630" id="CVE-2026-33630" type="cve" title="CVE-2026-33630"/>
      <reference href="https://bugzilla.redhat.com/2497686" id="2497686" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42096.html" id="ALSA-2026:42096" type="self" title="ALSA-2026:42096"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="c-ares-devel" version="1.34.6" release="2.el10_2" epoch="0" arch="x86_64_v2" src="c-ares-1.34.6-2.el10_2.src.rpm">
          <filename>c-ares-devel-1.34.6-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4a0537e5ef8f2fce625c7d31ab3b43eb26fba4ebe768697f33a8544393624313</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42694</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-07-21 00:00:00"/>
    <updated date="2026-07-22 13:46:57"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)
  * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
  * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42694" id="RHSA-2026:42694" type="rhsa" title="RHSA-2026:42694"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5435" id="CVE-2026-5435" type="cve" title="CVE-2026-5435"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5928" id="CVE-2026-5928" type="cve" title="CVE-2026-5928"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6238" id="CVE-2026-6238" type="cve" title="CVE-2026-6238"/>
      <reference href="https://bugzilla.redhat.com/2459854" id="2459854" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463465" id="2463465" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463539" id="2463539" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42694.html" id="ALSA-2026:42694" type="self" title="ALSA-2026:42694"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="glibc-devel" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>glibc-devel-2.39-128.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1abe4517ed42e88d24439570e3a0dceff0fec4e2eeed20adb7e6ae06b8c089ac</sum>
        </package>
        <package name="glibc-utils" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>glibc-utils-2.39-128.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">808d1aa8826c6f226b11e0404bf23a7a6d5561341e8e8775c598321eecdb3516</sum>
        </package>
        <package name="glibc-doc" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-128.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">ec6e77a457ba7f13faf9ac4994f0f83f6fa55864f6690c7cb0495903d28a82f2</sum>
        </package>
        <package name="glibc-locale-source" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>glibc-locale-source-2.39-128.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">f2f0a2f1c3b39e8fd33de62c1d5e2ecd4f63ef29cef257d38d4affdd90649739</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42739</id>
    <title>Important: acl security update</title>
    <issued date="2026-07-21 00:00:00"/>
    <updated date="2026-07-22 11:00:27"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>acl security update</summary>
    <description>Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.  

Security Fix(es):  

  * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
  * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42739" id="RHSA-2026:42739" type="rhsa" title="RHSA-2026:42739"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-54369" id="CVE-2026-54369" type="cve" title="CVE-2026-54369"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-54370" id="CVE-2026-54370" type="cve" title="CVE-2026-54370"/>
      <reference href="https://bugzilla.redhat.com/2490277" id="2490277" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490279" id="2490279" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42739.html" id="ALSA-2026:42739" type="self" title="ALSA-2026:42739"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libacl-devel" version="2.4.0" release="1.el10_2" epoch="0" arch="x86_64_v2" src="acl-2.4.0-1.el10_2.src.rpm">
          <filename>libacl-devel-2.4.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">41f2f7ee3a99cf1b0bd64f61d898b2f0b7e3708e37a94c325848114444509dd3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42895</id>
    <title>Important: java-21-openjdk security update</title>
    <issued date="2026-07-22 00:00:00"/>
    <updated date="2026-07-24 08:12:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>java-21-openjdk security update</summary>
    <description>The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.  

Security Fix(es):  

  * JDK: Enhance TLS certificate handling (CVE-2026-46968)
  * JDK: Improve DTLS handshaking (CVE-2026-46917)
  * JDK: Enhance JPEG handling (CVE-2026-47010)
  * JDK: Enhance XBM image support (CVE-2026-47021)
  * JDK: Enhance Jar file processing (CVE-2026-47027)
  * JDK: Improve certification checking (CVE-2026-60147)
  * JDK: Enhance AWT ImagingLib (CVE-2026-47059)
  * JDK: Enhance Jar handling (CVE-2026-47063)
  * JDK: Update LCMS to 2.19 (CVE-2026-41254)


Enhancement(s):  

  * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343)


Bug Fix(es):  

  * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42895" id="RHSA-2026:42895" type="rhsa" title="RHSA-2026:42895"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41254" id="CVE-2026-41254" type="cve" title="CVE-2026-41254"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46917" id="CVE-2026-46917" type="cve" title="CVE-2026-46917"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46968" id="CVE-2026-46968" type="cve" title="CVE-2026-46968"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47010" id="CVE-2026-47010" type="cve" title="CVE-2026-47010"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47021" id="CVE-2026-47021" type="cve" title="CVE-2026-47021"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47027" id="CVE-2026-47027" type="cve" title="CVE-2026-47027"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47059" id="CVE-2026-47059" type="cve" title="CVE-2026-47059"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47063" id="CVE-2026-47063" type="cve" title="CVE-2026-47063"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60147" id="CVE-2026-60147" type="cve" title="CVE-2026-60147"/>
      <reference href="https://bugzilla.redhat.com/2459420" id="2459420" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502751" id="2502751" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502782" id="2502782" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502783" id="2502783" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502784" id="2502784" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502791" id="2502791" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502792" id="2502792" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502793" id="2502793" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503636" id="2503636" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42895.html" id="ALSA-2026:42895" type="self" title="ALSA-2026:42895"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="java-21-openjdk" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">22fe1a561bf7948b28b7c917273cc85be60b3a117680464de07ed0973eaec9a7</sum>
        </package>
        <package name="java-21-openjdk-javadoc-zip" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-javadoc-zip-21.0.12.0.8-1.2.el10_2.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">26ca220b233ec7daf00dd0fd1e92aef04c5847d20889804aed6c44e28b8bf207</sum>
        </package>
        <package name="java-21-openjdk-devel" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-devel-21.0.12.0.8-1.2.el10_2.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">27f39011a4d18b3d1cc3abec066a858eb7666da6155fbf283e070be15ba6455e</sum>
        </package>
        <package name="java-21-openjdk-src" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-src-21.0.12.0.8-1.2.el10_2.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">3f39b9925ae16275d254805fbcce7d8ee6340e96999a88ee6cc9f56781fff733</sum>
        </package>
        <package name="java-21-openjdk-static-libs" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-static-libs-21.0.12.0.8-1.2.el10_2.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">540fc85ab5977e34da516a4b865815f2b3be5b66374ce929fff701bad1d13f3c</sum>
        </package>
        <package name="java-21-openjdk-jmods" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-jmods-21.0.12.0.8-1.2.el10_2.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">66164958d886f530e58f348517bf28fc1c21ed03d397367031bd1b98e3fb2644</sum>
        </package>
        <package name="java-21-openjdk-javadoc" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-javadoc-21.0.12.0.8-1.2.el10_2.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">689d8705c7195af10cf629c4786363a189f0618b288068fad466d43e89d57527</sum>
        </package>
        <package name="java-21-openjdk-demo" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-demo-21.0.12.0.8-1.2.el10_2.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">8380dc7efa460235bcf0a69d6e5aabd1625a6dc9a52c23abf616f3bdc611e619</sum>
        </package>
        <package name="java-21-openjdk-headless" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-headless-21.0.12.0.8-1.2.el10_2.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">bb6aa50dfbd2c166666f4774decce791ec87ca537bae84bbec8f3e49e11c4897</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42899</id>
    <title>Important: java-25-openjdk security update</title>
    <issued date="2026-07-22 00:00:00"/>
    <updated date="2026-08-06 14:43:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>java-25-openjdk security update</summary>
    <description>The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.  

Security Fix(es):  

  * JDK: Enhance TLS certificate handling (CVE-2026-46968)
  * JDK: Improve DTLS handshaking (CVE-2026-46917)
  * JDK: Enhance JPEG handling (CVE-2026-47010)
  * JDK: Enhance XBM image support (CVE-2026-47021)
  * JDK: Enhance Jar file processing (CVE-2026-47027)
  * JDK: Improve certification checking (CVE-2026-60147)
  * JDK: Enhance AWT ImagingLib (CVE-2026-47059)
  * JDK: Enhance Jar handling (CVE-2026-47063)
  * JDK: Update LCMS to 2.19 (CVE-2026-41254)


Enhancement(s):  

  * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048)


Bug Fix(es):  

  * The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052)
  * On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42899" id="RHSA-2026:42899" type="rhsa" title="RHSA-2026:42899"/>
      <reference href="https://bugzilla.redhat.com/2459420" id="2459420" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502751" id="2502751" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502782" id="2502782" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502783" id="2502783" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502784" id="2502784" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502791" id="2502791" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502792" id="2502792" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502793" id="2502793" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503636" id="2503636" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42899.html" id="ALSA-2026:42899" type="self" title="ALSA-2026:42899"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-41254.html" id="CVE-2026-41254" type="cve" title="CVE-2026-41254"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-46917.html" id="CVE-2026-46917" type="cve" title="CVE-2026-46917"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-46968.html" id="CVE-2026-46968" type="cve" title="CVE-2026-46968"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47010.html" id="CVE-2026-47010" type="cve" title="CVE-2026-47010"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47021.html" id="CVE-2026-47021" type="cve" title="CVE-2026-47021"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47027.html" id="CVE-2026-47027" type="cve" title="CVE-2026-47027"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47059.html" id="CVE-2026-47059" type="cve" title="CVE-2026-47059"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47063.html" id="CVE-2026-47063" type="cve" title="CVE-2026-47063"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-60147.html" id="CVE-2026-60147" type="cve" title="CVE-2026-60147"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="java-25-openjdk-static-libs" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-static-libs-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1b0e59ab250fbde005bb44cdc6f05470b88e9b68481ce19c3b4018ef62c3fa46</sum>
        </package>
        <package name="java-25-openjdk-crypto-adapter" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-crypto-adapter-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">3f95ba2fff1f4aaf7c8ea63d77e6098095c3221d914bdb2a7ba9492821fc2661</sum>
        </package>
        <package name="java-25-openjdk-jmods" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-jmods-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">576b02b12b18a5445e7c87b1002a8b95e113f4260b78bd187ada9440b137723d</sum>
        </package>
        <package name="java-25-openjdk-demo" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-demo-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">5f2a75e5599fadb76be0013df1df78575ca4fdd28f194d974789cb099cafdb80</sum>
        </package>
        <package name="java-25-openjdk" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">6e7a6f010cfb13a1c1c64fef49ae98c6c466fa07f3b80e2086f579a593832113</sum>
        </package>
        <package name="java-25-openjdk-javadoc-zip" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-javadoc-zip-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">7a7d42c111ed1593ae3b1f96ba92f688d29649d78495d0419e1cca20016b2139</sum>
        </package>
        <package name="java-25-openjdk-src" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-src-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9abca4a8a4c25c8a0936ebac40ed670a49b4bdeb4e5f59aa5f3107a5a0c7b670</sum>
        </package>
        <package name="java-25-openjdk-headless" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-headless-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9c4ebbbae9f47203a0ca95a53722b438266a5cd9214bf30ed4ca8640ce4f6965</sum>
        </package>
        <package name="java-25-openjdk-devel" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-devel-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">c1e1cc0866385f4fe491705f2c31d9e4454348378eb33077ae37d5bbceafff38</sum>
        </package>
        <package name="java-25-openjdk-javadoc" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-javadoc-25.0.4.0.7-1.1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">c405c898de55359b9d34ef33a2fa1f8153084e272876da468725b30e70bbd435</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42919</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-21 00:00:00"/>
    <updated date="2026-07-24 10:19:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)
  * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
  * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)
  * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)
  * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
  * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
  * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)
  * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)
  * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)
  * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)
  * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)
  * kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()


Bug Fix(es) and Enhancement(s):  

  * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:AlmaLinux-173103)
  * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975)
  * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [almalinux-10.2.z] (JIRA:AlmaLinux-186311)
  * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42919" id="RHSA-2026:42919" type="rhsa" title="RHSA-2026:42919"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71113" id="CVE-2025-71113" type="cve" title="CVE-2025-71113"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71147" id="CVE-2025-71147" type="cve" title="CVE-2025-71147"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23168" id="CVE-2026-23168" type="cve" title="CVE-2026-23168"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31530" id="CVE-2026-31530" type="cve" title="CVE-2026-31530"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46116" id="CVE-2026-46116" type="cve" title="CVE-2026-46116"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46150" id="CVE-2026-46150" type="cve" title="CVE-2026-46150"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46215" id="CVE-2026-46215" type="cve" title="CVE-2026-46215"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52950" id="CVE-2026-52950" type="cve" title="CVE-2026-52950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52976" id="CVE-2026-52976" type="cve" title="CVE-2026-52976"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53009" id="CVE-2026-53009" type="cve" title="CVE-2026-53009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53071" id="CVE-2026-53071" type="cve" title="CVE-2026-53071"/>
      <reference href="https://bugzilla.redhat.com/2429611" id="2429611" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2432366" id="2432366" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439941" id="2439941" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460644" id="2460644" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482523" id="2482523" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482612" id="2482612" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482615" id="2482615" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492284" id="2492284" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492318" id="2492318" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492390" id="2492390" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492458" id="2492458" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42919.html" id="ALSA-2026:42919" type="self" title="ALSA-2026:42919"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-debug-devel" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.37.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">04a04ffbd3b399fed29df7a363081e787e786fb79e30ad0da1bf89392ad43460</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.37.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">172ac57e1d570eac8d785bedf0d35192d92f19e3b377d07191d26e00ccb96afd</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.37.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1bfc9a2095c886c9a459ea2d2887e14b95a2ba7be2970d820e18ca7c879a74aa</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.37.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">63ea6c37f26f0fccdd6b67efeeb79dacc6ae33c6ea5706e9756a3ac549caefa1</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.37.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">87d31242d05551914e981aae0b0f4d898f16e6999a0326758830d5c4a4582d3f</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.37.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b22410211901a77b332c72247652004ba452d2b76685bd61e41f2e921f959693</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.37.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c2ed480c12d85f676c11648b5f65c129186e7614f275f61802b2e74a5a021f25</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.37.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c3f2cdd9e0ab85e9769c806a390a464740ee6fc7b2792eea6e7b734a3a280a83</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.37.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">de2b2fbcd33ad07878a4cc7079e53f35a7ec18cb3ed40878a53b2b9c440995c4</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.37.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e5f35f4d1e51256acbafb6a17c6379adfdef9b1636077ffe26c981bcdcd8ebd4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:43400</id>
    <title>Important: dogtag-pki security update</title>
    <issued date="2026-07-22 00:00:00"/>
    <updated date="2026-07-22 13:34:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dogtag-pki security update</summary>
    <description>IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:   

  * Certificate Authority (CA)
  * Key Recovery Authority (KRA)
  * Online Certificate Status Protocol (OCSP) Manager
  * Token Key Service (TKS)
  * Token Processing Service (TPS)
  * Automatic Certificate Management Environment (ACME) Responder
  * Enrollment over Secure Transport (EST) Responder


Security Fix(es):  

  * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)
  * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:43400" id="RHSA-2026:43400" type="rhsa" title="RHSA-2026:43400"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-54512" id="CVE-2026-54512" type="cve" title="CVE-2026-54512"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-54513" id="CVE-2026-54513" type="cve" title="CVE-2026-54513"/>
      <reference href="https://bugzilla.redhat.com/2492010" id="2492010" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492015" id="2492015" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-43400.html" id="ALSA-2026:43400" type="self" title="ALSA-2026:43400"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="idm-pki-kra" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-kra-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">0969cdaf908804a41b9168709166a69e8aa7ae8fcc2e747357080f04a1172f5e</sum>
        </package>
        <package name="idm-pki-ca" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-ca-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">0b735f0dd0d261caa3582e67de71f6261dbab4015274cff710fc04879b00b9e9</sum>
        </package>
        <package name="idm-pki-java" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-java-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">19db97d8c3e96b064b9b644b115703383e1a284592656856fb4c10b17f0ff783</sum>
        </package>
        <package name="idm-pki-base" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-base-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">2078148c1821766f42e07686376b4f47372e0d8d1f28117d64c14ecfa9c35ec2</sum>
        </package>
        <package name="idm-pki-tools" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-tools-11.9.0-4.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">52e152f0c8918344dec49d9c867448fde12d961064d0bc9094212bf4cb9fe88a</sum>
        </package>
        <package name="idm-pki-acme" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-acme-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">65f47e5c5837435369b77d7a6e0414cfd4e2ab76ac728e69b36043659fdf4ae8</sum>
        </package>
        <package name="python3-idm-pki" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>python3-idm-pki-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">6e8938d303bc048889247d06f240b4f4e4629de2d3a8d8d05230791ef281e8a6</sum>
        </package>
        <package name="idm-pki-server" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-server-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">b82532ebd593f44ece5bc792082777393864e54da71878f86dc5d3f9abd9a78a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:43505</id>
    <title>Important: mariadb-connector-c security update</title>
    <issued date="2026-07-22 00:00:00"/>
    <updated date="2026-07-23 08:41:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>mariadb-connector-c security update</summary>
    <description>The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases.   

Security Fix(es):  

  * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:43505" id="RHSA-2026:43505" type="rhsa" title="RHSA-2026:43505"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44172" id="CVE-2026-44172" type="cve" title="CVE-2026-44172"/>
      <reference href="https://bugzilla.redhat.com/2488459" id="2488459" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-43505.html" id="ALSA-2026:43505" type="self" title="ALSA-2026:43505"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mariadb-connector-c-devel" version="3.4.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="mariadb-connector-c-3.4.4-2.el10_2.src.rpm">
          <filename>mariadb-connector-c-devel-3.4.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">347e54309379011544c8d5706e0da1d8abe4d5de5606e9d4e2207ccc73271034</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:44270</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-23 00:00:00"/>
    <updated date="2026-07-25 07:46:58"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:44270" id="RHSA-2026:44270" type="rhsa" title="RHSA-2026:44270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46323" id="CVE-2026-46323" type="cve" title="CVE-2026-46323"/>
      <reference href="https://bugzilla.redhat.com/2479832" id="2479832" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-44270.html" id="ALSA-2026:44270" type="self" title="ALSA-2026:44270"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="perf" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.38.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">022e32022d288a8512f382ee099453f2eea1121334a3126517d9ff8b5e9bc04c</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.38.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">32a63d673a202e56b9c77c71384722256b2465f3b7b1b059ef1f7451d3a47e5e</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.38.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">471c033099645f00daba2f5246fff507a68aa7697140f7dcd7dcd4e0d8c7bf21</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.38.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">4a069b5675e58961c90a55b7563fc8b4cdfeb44341f929a948dd293d00bbc4cb</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.38.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">70e6dfc4a9ce127fb0f11186408d549f5766ff760405c6345e875f68761a3833</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.38.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">75b8e30ae67bb08224591bd25a8c7589110b1b628fbf62f025728d79430de105</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.38.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">762b9ab1928680f46b525d5f6dbaae883b0571ef223a43d5dfefd8516efb4e34</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.38.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7a394afc8fb9b230e3e9feb7e9193a987e1e35e7385627d0a97311b2e65b661f</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.38.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">99cc2fe37112ac750cf1773dee7c28bc9eaf85f7e4cf54a48294602e91eae15e</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.38.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a37b76b970b840d30612a53ed5a6a2e27777d7dfd452030e0d6755c6a402457f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:44391</id>
    <title>Important: libpq security update</title>
    <issued date="2026-07-23 00:00:00"/>
    <updated date="2026-07-23 13:04:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libpq security update</summary>
    <description>The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers.   

Security Fix(es):  

  * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:44391" id="RHSA-2026:44391" type="rhsa" title="RHSA-2026:44391"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6477" id="CVE-2026-6477" type="cve" title="CVE-2026-6477"/>
      <reference href="https://bugzilla.redhat.com/2477442" id="2477442" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-44391.html" id="ALSA-2026:44391" type="self" title="ALSA-2026:44391"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libpq-devel" version="16.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="libpq-16.14-1.el10_2.src.rpm">
          <filename>libpq-devel-16.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">901c69911b0dfb4873f632e2d5f09b42782d867c3836e749e5d676c631b3d232</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:45114</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-24 00:00:00"/>
    <updated date="2026-08-07 12:56:47"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237)
  * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)
  * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)
  * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)
  * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973)
  * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)


</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:45114" id="RHSA-2026:45114" type="rhsa" title="RHSA-2026:45114"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40237" id="CVE-2025-40237" type="cve" title="CVE-2025-40237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23110" id="CVE-2026-23110" type="cve" title="CVE-2026-23110"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31692" id="CVE-2026-31692" type="cve" title="CVE-2026-31692"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46099" id="CVE-2026-46099" type="cve" title="CVE-2026-46099"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52973" id="CVE-2026-52973" type="cve" title="CVE-2026-52973"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53059" id="CVE-2026-53059" type="cve" title="CVE-2026-53059"/>
      <reference href="https://bugzilla.redhat.com/2418829" id="2418829" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436755" id="2436755" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464093" id="2464093" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481972" id="2481972" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492277" id="2492277" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492413" id="2492413" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-45114.html" id="ALSA-2026:45114" type="self" title="ALSA-2026:45114"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-64561.html" id="CVE-2026-64561" type="cve" title="CVE-2026-64561"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-headers" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.39.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">22ea359bbce05c019b89557f2f9c4d305e666e9614c60ac24e03626eaae5474e</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.39.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2f756f252bd2a98d5f3b6deb3bd8bbf0386e057e7c1ab2ffe1fc6985cec0ef90</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.39.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">43012a395c1244a6f69e39f378a599573abaf727a09e3871e7a714eea8666012</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.39.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">57e1f4e0112f0ee664bd8c97fc523d619d431cc818979280b6d5c75b74881350</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.39.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5c14ce3fa4ab0b8c88ca552c52a6a3e5c4f626a08c7b8006273dfca8cc715ac9</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.39.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8362f529ee0024b7dbd8738cd3a8a1a6c03888eaf772a78c550eeb6036f7186b</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.39.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9c7d71bbe5363008a14dab604720f81c22396f64aa9e1283aea67827e564b0bc</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.39.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9dacba346e902a79be6fb240dc8027bae2c25f7181e3da033dc9deb3d9abe3ce</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.39.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">bed818f0799b768ff6cfc2f657938405ca4fdd836ecda0511057e50c36a60fb4</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.39.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e6a8416f039852ebe8938c77329fb53398697c961f6c461a5f084fc4d8d7feb0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:46394</id>
    <title>Important: go-fdo-client security update</title>
    <issued date="2026-07-27 00:00:00"/>
    <updated date="2026-07-28 10:57:03"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>go-fdo-client security update</summary>
    <description>go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.  

Security Fix(es):  

  * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:46394" id="RHSA-2026:46394" type="rhsa" title="RHSA-2026:46394"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145"/>
      <reference href="https://bugzilla.redhat.com/2484207" id="2484207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-46394.html" id="ALSA-2026:46394" type="self" title="ALSA-2026:46394"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="go-fdo-client" version="1.0.0" release="4.el10_2.5" epoch="0" arch="x86_64_v2" src="go-fdo-client-1.0.0-4.el10_2.5.src.rpm">
          <filename>go-fdo-client-1.0.0-4.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">09b2315b63b01d4c2d044ffde9d6b85a35c7dc183a7e7e9a696b86a75b5694c6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:46395</id>
    <title>Important: go-fdo-server security update</title>
    <issued date="2026-07-27 00:00:00"/>
    <updated date="2026-07-28 10:57:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>go-fdo-server security update</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.  

Security Fix(es):  

  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:46395" id="RHSA-2026:46395" type="rhsa" title="RHSA-2026:46395"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484207" id="2484207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-46395.html" id="ALSA-2026:46395" type="self" title="ALSA-2026:46395"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="go-fdo-server" version="1.0.1" release="2.el10_2.3" epoch="0" arch="x86_64_v2" src="go-fdo-server-1.0.1-2.el10_2.3.src.rpm">
          <filename>go-fdo-server-1.0.1-2.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">0f154c3ea758f81abc1c29ac3b9d352280d261a8147d0d163211ac37d905adfc</sum>
        </package>
        <package name="go-fdo-server-owner" version="1.0.1" release="2.el10_2.3" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.3.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-2.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">8a1f12fb60dd6f709e8d044b6d020d14de7e6afbde8dda5848544a5e669cff85</sum>
        </package>
        <package name="go-fdo-server-rendezvous" version="1.0.1" release="2.el10_2.3" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.3.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-2.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">caf1db0da6a4940dc368733c9e45509fe9a782dd4331421e6ca8bcf1a5779321</sum>
        </package>
        <package name="go-fdo-server-manufacturer" version="1.0.1" release="2.el10_2.3" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.3.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-2.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">cb7c2a74215550a5f2ce3d4355be09b754b0e502285caecb7e0f536ef2a0011f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:46398</id>
    <title>Important: libreswan security update</title>
    <issued date="2026-07-27 00:00:00"/>
    <updated date="2026-07-27 12:31:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libreswan security update</summary>
    <description>Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).  

Security Fix(es):  

  * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)
  * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)
  * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)
  * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:46398" id="RHSA-2026:46398" type="rhsa" title="RHSA-2026:46398"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12413" id="CVE-2026-12413" type="cve" title="CVE-2026-12413"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14957" id="CVE-2026-14957" type="cve" title="CVE-2026-14957"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50721" id="CVE-2026-50721" type="cve" title="CVE-2026-50721"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50722" id="CVE-2026-50722" type="cve" title="CVE-2026-50722"/>
      <reference href="https://bugzilla.redhat.com/2494147" id="2494147" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2494148" id="2494148" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2494149" id="2494149" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2501764" id="2501764" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-46398.html" id="ALSA-2026:46398" type="self" title="ALSA-2026:46398"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libreswan-minimal" version="5.3.2" release="1.el10_2" epoch="0" arch="x86_64_v2" src="libreswan-5.3.2-1.el10_2.src.rpm">
          <filename>libreswan-minimal-5.3.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0c321d4d6cbd639f860ff82758b76fa4212b7d0686114f23f13eba7a4db94ce8</sum>
        </package>
        <package name="libreswan" version="5.3.2" release="1.el10_2" epoch="0" arch="x86_64_v2" src="libreswan-5.3.2-1.el10_2.src.rpm">
          <filename>libreswan-5.3.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1926f320d81ffefd287a82e8a9cf7ba0a49edaf3ae5dca587b9a11d6792c6513</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47017</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-08-25 14:29:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)
  * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)
  * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)
  * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281)


Bug Fix(es) and Enhancement(s):  

  * rxrpc: Address CVE-2026-43500 [almalinux-10.2.z] (JIRA:AlmaLinux-178254)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47017" id="RHSA-2026:47017" type="rhsa" title="RHSA-2026:47017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46086" id="CVE-2026-46086" type="cve" title="CVE-2026-46086"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52993" id="CVE-2026-52993" type="cve" title="CVE-2026-52993"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53006" id="CVE-2026-53006" type="cve" title="CVE-2026-53006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53281" id="CVE-2026-53281" type="cve" title="CVE-2026-53281"/>
      <reference href="https://bugzilla.redhat.com/2481989" id="2481989" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492363" id="2492363" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492437" id="2492437" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493728" id="2493728" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47017.html" id="ALSA-2026:47017" type="self" title="ALSA-2026:47017"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-31635.html" id="CVE-2026-31635" type="cve" title="CVE-2026-31635"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-devel-matched" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.40.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">20163430fcb12415c74a647cb1f408f13f828c1ad0b0bf432fa807089afb9b55</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.40.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3a6032a92ae2781be3ad802778a77155e5b0cb9d4c6f157b0437d16cc5ddd9b3</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.40.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">3f33284f7c4ea3f56149f8190f4db9d0acabacfef1186c7aa7ad46d25395aa49</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.40.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">88431ed38553f63147122d246fa69b6363eaabd88436759e8ed22102cd7769f1</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.40.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a023489552b5d47a7a61428b113cb16feffe7746d434a9d2404d66a84fa039f9</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.40.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ad085c99ae6cb15f6e1bf94988e02be069764894d4205fa9c0031b2d46ce2e9c</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.40.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b75346bb7bb00d06a0cfe87ee240f921fcc531b9ad15105e360bb149ae889a63</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.40.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c5431f908331ceb545b96c865f0d9e91c95f9181d4210e479af879767b22b1ea</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.40.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e73428c78026f396a6712be1ca6aee2e60a34c7472f15aa443c11d4a835f4652</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.40.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f567bebc561db10db3e184b9fb4d94f56e1e967271a834438d9144f527c6439c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47079</id>
    <title>Important: libXfont2 security update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-07-29 12:49:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libXfont2 security update</summary>
    <description>X.Org X11 libXfont2 runtime library  

Security Fix(es):  

  * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)
  * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47079" id="RHSA-2026:47079" type="rhsa" title="RHSA-2026:47079"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56001" id="CVE-2026-56001" type="cve" title="CVE-2026-56001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56002" id="CVE-2026-56002" type="cve" title="CVE-2026-56002"/>
      <reference href="https://bugzilla.redhat.com/2496640" id="2496640" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2496641" id="2496641" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47079.html" id="ALSA-2026:47079" type="self" title="ALSA-2026:47079"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libXfont2" version="2.0.6" release="5.el10_2.1" epoch="0" arch="x86_64_v2" src="libXfont2-2.0.6-5.el10_2.1.src.rpm">
          <filename>libXfont2-2.0.6-5.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">d1b4f9ce4f6378f190e10bb4f7a356d63398336242b225709ce29677a3a888eb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47083</id>
    <title>Important: pipewire security update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-07-31 09:12:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>pipewire security update</summary>
    <description>PipeWire is a multimedia server for Linux and other Unix like operating systems.  

Security Fix(es):  

  * pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading (CVE-2026-5674)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47083" id="RHSA-2026:47083" type="rhsa" title="RHSA-2026:47083"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5674" id="CVE-2026-5674" type="cve" title="CVE-2026-5674"/>
      <reference href="https://bugzilla.redhat.com/2455341" id="2455341" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47083.html" id="ALSA-2026:47083" type="self" title="ALSA-2026:47083"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="pipewire-devel" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-devel-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">02b3fa726cee7c29c43069a732a649d304f71104221578119be0d661d2d4fbfd</sum>
        </package>
        <package name="pipewire-pulseaudio" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-pulseaudio-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">052f9edf2a721e6ee382f0932a9ef832c10e2531912487e3e234759251b3e176</sum>
        </package>
        <package name="pipewire" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1f73ed78b5c1f93f94d8cb805f41996461e55e81148ea22211239ef3a546f515</sum>
        </package>
        <package name="pipewire-utils" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-utils-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3c4c9209372f5219cbd448204547f4c31677f73365e835da0477ec1e454369da</sum>
        </package>
        <package name="pipewire-module-x11" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-module-x11-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">50b6aff64f9f3cbccf2cd4a836ae59d5b5bae2ef1bd382cecbc0b9f584019731</sum>
        </package>
        <package name="pipewire-plugin-libcamera" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-plugin-libcamera-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">702bea68c4ba94c322c6719697d9c097cbb919c9e36dfb22974fc74e347209ed</sum>
        </package>
        <package name="pipewire-jack-audio-connection-kit-devel" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-jack-audio-connection-kit-devel-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">74fd965bbc1fc863822a129b222878461a1283d9b726ac473a931443893f8282</sum>
        </package>
        <package name="pipewire-jack-audio-connection-kit" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-jack-audio-connection-kit-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">75ad185157b3d1ca3027a893133b13bbcafc10fe11aef25a2192cda5d2fb9b63</sum>
        </package>
        <package name="pipewire-libs" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-libs-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7f0a9e39c0ac85910fa155e3d8cbf311f1c401926361a58dbaea97689d493368</sum>
        </package>
        <package name="pipewire-jack-audio-connection-kit-libs" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-jack-audio-connection-kit-libs-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8b42ee6e6e1c97645aeb77ce9d986328087a0a81f135de963127f05806956652</sum>
        </package>
        <package name="pipewire-alsa" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-alsa-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e90a5a9ec2eb180011ea06c77e822a9bf09a20fbbe81221a94f4bc1d27033083</sum>
        </package>
        <package name="pipewire-gstreamer" version="1.4.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="pipewire-1.4.11-1.el10_2.src.rpm">
          <filename>pipewire-gstreamer-1.4.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fd499ec8568962857c6e8b6b8af7b1e2c1d296ca005c0fc449814c520869b664</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47085</id>
    <title>Important: rest security update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-07-29 12:49:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>rest security update</summary>
    <description>The rest packages provide a library for access to the RESTful web services.  

Security Fix(es):  

  * librest: weak random number generation in PKCE implementation (CVE-2026-16615)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47085" id="RHSA-2026:47085" type="rhsa" title="RHSA-2026:47085"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16615" id="CVE-2026-16615" type="cve" title="CVE-2026-16615"/>
      <reference href="https://bugzilla.redhat.com/2504432" id="2504432" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47085.html" id="ALSA-2026:47085" type="self" title="ALSA-2026:47085"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="rest" version="0.9.1" release="11.el10_2.1" epoch="0" arch="x86_64_v2" src="rest-0.9.1-11.el10_2.1.src.rpm">
          <filename>rest-0.9.1-11.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0e956b3aa3e4eb3f723552ce9a22fdfff0b7b3c0d3c777f41ae39b1a2d06426c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47101</id>
    <title>Important: firefox security update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-08-06 14:41:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47101" id="RHSA-2026:47101" type="rhsa" title="RHSA-2026:47101"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15718" id="CVE-2026-15718" type="cve" title="CVE-2026-15718"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15719" id="CVE-2026-15719" type="cve" title="CVE-2026-15719"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16349" id="CVE-2026-16349" type="cve" title="CVE-2026-16349"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16350" id="CVE-2026-16350" type="cve" title="CVE-2026-16350"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16351" id="CVE-2026-16351" type="cve" title="CVE-2026-16351"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16352" id="CVE-2026-16352" type="cve" title="CVE-2026-16352"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16353" id="CVE-2026-16353" type="cve" title="CVE-2026-16353"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16354" id="CVE-2026-16354" type="cve" title="CVE-2026-16354"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16355" id="CVE-2026-16355" type="cve" title="CVE-2026-16355"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16356" id="CVE-2026-16356" type="cve" title="CVE-2026-16356"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16357" id="CVE-2026-16357" type="cve" title="CVE-2026-16357"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16358" id="CVE-2026-16358" type="cve" title="CVE-2026-16358"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16359" id="CVE-2026-16359" type="cve" title="CVE-2026-16359"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16360" id="CVE-2026-16360" type="cve" title="CVE-2026-16360"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16361" id="CVE-2026-16361" type="cve" title="CVE-2026-16361"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16362" id="CVE-2026-16362" type="cve" title="CVE-2026-16362"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16363" id="CVE-2026-16363" type="cve" title="CVE-2026-16363"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16368" id="CVE-2026-16368" type="cve" title="CVE-2026-16368"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16369" id="CVE-2026-16369" type="cve" title="CVE-2026-16369"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16371" id="CVE-2026-16371" type="cve" title="CVE-2026-16371"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16374" id="CVE-2026-16374" type="cve" title="CVE-2026-16374"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16375" id="CVE-2026-16375" type="cve" title="CVE-2026-16375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16377" id="CVE-2026-16377" type="cve" title="CVE-2026-16377"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16379" id="CVE-2026-16379" type="cve" title="CVE-2026-16379"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16381" id="CVE-2026-16381" type="cve" title="CVE-2026-16381"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16383" id="CVE-2026-16383" type="cve" title="CVE-2026-16383"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16387" id="CVE-2026-16387" type="cve" title="CVE-2026-16387"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16390" id="CVE-2026-16390" type="cve" title="CVE-2026-16390"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16391" id="CVE-2026-16391" type="cve" title="CVE-2026-16391"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16396" id="CVE-2026-16396" type="cve" title="CVE-2026-16396"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16405" id="CVE-2026-16405" type="cve" title="CVE-2026-16405"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16412" id="CVE-2026-16412" type="cve" title="CVE-2026-16412"/>
      <reference href="https://bugzilla.redhat.com/2499973" id="2499973" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2499974" id="2499974" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503415" id="2503415" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503416" id="2503416" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503420" id="2503420" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503423" id="2503423" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503425" id="2503425" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503430" id="2503430" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503432" id="2503432" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503434" id="2503434" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503439" id="2503439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503440" id="2503440" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503444" id="2503444" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503451" id="2503451" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503454" id="2503454" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503456" id="2503456" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503463" id="2503463" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503472" id="2503472" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503473" id="2503473" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503485" id="2503485" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503489" id="2503489" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503491" id="2503491" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503497" id="2503497" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503498" id="2503498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503500" id="2503500" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503501" id="2503501" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503505" id="2503505" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503512" id="2503512" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503513" id="2503513" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503517" id="2503517" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503521" id="2503521" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503527" id="2503527" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47101.html" id="ALSA-2026:47101" type="self" title="ALSA-2026:47101"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.13.0" release="1.el10_2" epoch="0" arch="x86_64_v2" src="firefox-140.13.0-1.el10_2.src.rpm">
          <filename>firefox-140.13.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a2123ce62f11938c126f55c64e824bd1a9deb822421c3cd352a8f475a2f18299</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47180</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-07-29 12:49:58"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-bad-free security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  

Security Fix(es):  

  * gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer (CVE-2026-59691)
  * gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback (CVE-2026-59692)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47180" id="RHSA-2026:47180" type="rhsa" title="RHSA-2026:47180"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59691" id="CVE-2026-59691" type="cve" title="CVE-2026-59691"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59692" id="CVE-2026-59692" type="cve" title="CVE-2026-59692"/>
      <reference href="https://bugzilla.redhat.com/2497343" id="2497343" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2497344" id="2497344" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47180.html" id="ALSA-2026:47180" type="self" title="ALSA-2026:47180"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-bad-free-libs" version="1.26.7" release="2.el10_2.6" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.6.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">4a0fef0c2fbc66f6866565a3ef88f272c31beaac59198941873ac704efd1536b</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" version="1.26.7" release="2.el10_2.6" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.6.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">d1e630924136f3fb2358c53381553fa73833c403a7b5e87154c75f58fc342670</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47757</id>
    <title>Important: openssh security update</title>
    <issued date="2026-07-29 00:00:00"/>
    <updated date="2026-07-29 15:47:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>openssh security update</summary>
    <description>OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.  

Security Fix(es):  

  * openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenSSH client versions (CVE-2026-55655)
  * openssh: Double free in AlmaLinux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653)
  * openssh: Heap out-of-bounds read in AlmaLinux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654)
  * openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)
  * openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy (CVE-2026-59996)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47757" id="RHSA-2026:47757" type="rhsa" title="RHSA-2026:47757"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-55653" id="CVE-2026-55653" type="cve" title="CVE-2026-55653"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-55654" id="CVE-2026-55654" type="cve" title="CVE-2026-55654"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-55655" id="CVE-2026-55655" type="cve" title="CVE-2026-55655"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59996" id="CVE-2026-59996" type="cve" title="CVE-2026-59996"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60002" id="CVE-2026-60002" type="cve" title="CVE-2026-60002"/>
      <reference href="https://bugzilla.redhat.com/2462250" id="2462250" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2462351" id="2462351" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2462493" id="2462493" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2497936" id="2497936" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2497944" id="2497944" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47757.html" id="ALSA-2026:47757" type="self" title="ALSA-2026:47757"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="openssh-keysign" version="9.9p1" release="25.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="openssh-9.9p1-25.el10_2.alma.1.src.rpm">
          <filename>openssh-keysign-9.9p1-25.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">6d706b9259ae0db0d677cc8b51e36a62085986cd943ea3e1ff7bc2db6bcc44ef</sum>
        </package>
        <package name="openssh-askpass" version="9.9p1" release="25.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="openssh-9.9p1-25.el10_2.alma.1.src.rpm">
          <filename>openssh-askpass-9.9p1-25.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">8e34921643845426e71ed976c965814c406e0d409cf20e6b466ede72cf8574ba</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48032</id>
    <title>Important: nodejs-nodemon security update</title>
    <issued date="2026-07-29 00:00:00"/>
    <updated date="2026-07-30 13:20:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs-nodemon security update</summary>
    <description>Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.  

Security Fix(es):  

  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48032" id="RHSA-2026:48032" type="rhsa" title="RHSA-2026:48032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13149" id="CVE-2026-13149" type="cve" title="CVE-2026-13149"/>
      <reference href="https://bugzilla.redhat.com/2494813" id="2494813" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48032.html" id="ALSA-2026:48032" type="self" title="ALSA-2026:48032"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs-nodemon" version="3.1.14" release="2.el10_2" epoch="0" arch="noarch" src="nodejs-nodemon-3.1.14-2.el10_2.src.rpm">
          <filename>nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">bbd3e0be33345b40f7140ed617b9d6ac035fa7d714eef964005b4f634524f37c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48033</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-07-29 00:00:00"/>
    <updated date="2026-07-30 13:20:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs22 security update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.  

Security Fix(es):  

  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48033" id="RHSA-2026:48033" type="rhsa" title="RHSA-2026:48033"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13149" id="CVE-2026-13149" type="cve" title="CVE-2026-13149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59873" id="CVE-2026-59873" type="cve" title="CVE-2026-59873"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59874" id="CVE-2026-59874" type="cve" title="CVE-2026-59874"/>
      <reference href="https://bugzilla.redhat.com/2494813" id="2494813" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498116" id="2498116" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498120" id="2498120" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48033.html" id="ALSA-2026:48033" type="self" title="ALSA-2026:48033"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs-docs" version="22.23.1" release="4.el10_2" epoch="1" arch="noarch" src="nodejs22-22.23.1-4.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-4.el10_2.noarch.rpm</filename>
          <sum type="sha256">4a83c12224f35412b6625e9741ade14adf2898f3deb3cc76c129e06984205bf2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48034</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-07-29 00:00:00"/>
    <updated date="2026-07-30 13:20:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs24 security update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  

Security Fix(es):  

  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48034" id="RHSA-2026:48034" type="rhsa" title="RHSA-2026:48034"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13149" id="CVE-2026-13149" type="cve" title="CVE-2026-13149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59873" id="CVE-2026-59873" type="cve" title="CVE-2026-59873"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59874" id="CVE-2026-59874" type="cve" title="CVE-2026-59874"/>
      <reference href="https://bugzilla.redhat.com/2494813" id="2494813" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498116" id="2498116" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498120" id="2498120" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48034.html" id="ALSA-2026:48034" type="self" title="ALSA-2026:48034"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs24-full-i18n" version="24.18.0" release="3.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-full-i18n-24.18.0-3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">70ab798a204dae3e8ac5ecedbd3b4b659d4566cb57d92c0d9022ebf7e7a3af97</sum>
        </package>
        <package name="nodejs24-docs" version="24.18.0" release="3.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-docs-24.18.0-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">89066bd3e4a424f6060b375e6c02c05394b0753a9457c3f2bea0b8ca3a7ef097</sum>
        </package>
        <package name="nodejs24-npm" version="11.16.0" release="1.24.18.0.3.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm</filename>
          <sum type="sha256">a0d67f6698a66c5d36c8a723a620bfc3e7512941af628d160a75f70e47142745</sum>
        </package>
        <package name="nodejs24-devel" version="24.18.0" release="3.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-devel-24.18.0-3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c81e848dad8b6863dbedbfba91123ef63b4cbeedbfaecb8b42cc625d251191ee</sum>
        </package>
        <package name="nodejs24-libs" version="24.18.0" release="3.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-libs-24.18.0-3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d167e8b6b601e32fde15a69674e118a2ea4da06fbbbedfef74fb9655ae1ed774</sum>
        </package>
        <package name="nodejs24" version="24.18.0" release="3.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-24.18.0-3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dcbf23b84d7a0cbf8c5618e3dc399ce5ebf450f1e94b6ce673f27e0f65f8b071</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48170</id>
    <title>Low: php security, bug fix, and enhancement update</title>
    <issued date="2026-07-29 00:00:00"/>
    <updated date="2026-08-18 08:59:59"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>php security, bug fix, and enhancement update</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.  

Security Fix(es):  

  * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)


Bug Fix(es) and Enhancement(s):  

  * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48170" id="RHSA-2026:48170" type="rhsa" title="RHSA-2026:48170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14355" id="CVE-2026-14355" type="cve" title="CVE-2026-14355"/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48170.html" id="ALSA-2026:48170" type="self" title="ALSA-2026:48170"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="php-bcmath" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-bcmath-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">02b3f85af26c7b70c71544f00443199b81a53ed0095a2f26acc9c7c24d972696</sum>
        </package>
        <package name="php-gmp" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-gmp-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0a36c803ea788e2e31388dabbd5d235a26c60f40438f6491b5ca65491be90e01</sum>
        </package>
        <package name="php-enchant" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-enchant-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0e0a869051a07179a9d0dafbb11a285e0c30b0cc150ffd1378fbdb8ec4b2b883</sum>
        </package>
        <package name="php-opcache" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-opcache-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1962b0cdc958d0d541218c6761355967de81cb6ca283eb679b87cdfea38b7d13</sum>
        </package>
        <package name="php-fpm" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-fpm-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1af87c327989cfd417766a0affcb3bf31fdfe8b01c10139379bbff61be2e373b</sum>
        </package>
        <package name="php-dbg" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-dbg-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">29c374779bfbe11facb92fd973e3cd0af572b8dd684f8f9265a84a1c647e65d1</sum>
        </package>
        <package name="php-common" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-common-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2b2ffb65897c613a8a3aa313e8723067508c51148c08bf83f1cb470e499ebc7c</sum>
        </package>
        <package name="php-cli" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-cli-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3213d8f43fba84a1545a8923149fbb4469f8b66f55c4d80f2049c756aa4fddb4</sum>
        </package>
        <package name="php-snmp" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-snmp-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4ccf65ae6981da322f9e53668d9ae8bdbf904b1063fe3d6c1308b57079219959</sum>
        </package>
        <package name="php-dba" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-dba-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">58e6d9a00e94bbdab0404bfbd998e784d9d85513d933d6eeca1c69dcea1c92a9</sum>
        </package>
        <package name="php-pdo" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-pdo-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6f61b63bed90aaab7394db304e3fdf2022ab38fbdfa34057730e3d200cf92a5b</sum>
        </package>
        <package name="php-process" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-process-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7516b3c7dfc40ffb12473238eb781a467f8b32f15de6f4991897a422f409d536</sum>
        </package>
        <package name="php" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">757151fa20f07447e96af5ef5cda933dce0d9fde9df1be0afacf0dc685cebee8</sum>
        </package>
        <package name="php-gd" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-gd-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7682125bd33c3e75f66311076c6bfc49b9b45e0ade1b8c7c9d27d80c7b230793</sum>
        </package>
        <package name="php-xml" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-xml-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7929f6734a558502a022471dc3afbaeec6184c58d783a1994f14841f8497474a</sum>
        </package>
        <package name="php-embedded" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-embedded-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8d4a897ccf7d19406214d4991a552817aa26b9251619b1c55ef2687badcdf2ad</sum>
        </package>
        <package name="php-ldap" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-ldap-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">997ab90c460dae0ae499f974d667605182bc6e7a45868ace49dfba6b4f6dc7bf</sum>
        </package>
        <package name="php-ffi" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-ffi-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9c93c765fb8302f247aa7aeb820fcef7fa6ceec41b8742e67e40efe7eba95ed9</sum>
        </package>
        <package name="php-intl" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-intl-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c87cdd96cca4c3f54125f818f62ede16d60c780136f4fe2398d2824ef39bfd76</sum>
        </package>
        <package name="php-odbc" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-odbc-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cc77d24f51b57f2d5269990379fd0701377f0bd001ddb0362e5a4d50cd7101a6</sum>
        </package>
        <package name="php-pgsql" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-pgsql-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cdc91fb5a27e382f7d021e45489a722310bccfa226a1c64803ddea4621c3186d</sum>
        </package>
        <package name="php-soap" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-soap-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d5cedb4de6c7a05ba87c97b6854a9cecbe7660fb3473e026002c829ac2748e09</sum>
        </package>
        <package name="php-devel" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-devel-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d5e4f68029613a88aa53a29e6a066efae1581eb73d59e75e279388d7e9b241f5</sum>
        </package>
        <package name="php-mysqlnd" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-mysqlnd-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">df743599c5360e482435d115fe5894b7cd3f0934cd968e04e50de82dc09f23de</sum>
        </package>
        <package name="php-mbstring" version="8.3.32" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-mbstring-8.3.32-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f3669416c212f8689267c962d2d0f78e11a09544529a0abeab45e8d283b3a08b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48585</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-07-30 00:00:00"/>
    <updated date="2026-07-31 09:23:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>fence-agents security update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   

Security Fix(es):  

  * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48585" id="RHSA-2026:48585" type="rhsa" title="RHSA-2026:48585"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59939" id="CVE-2026-59939" type="cve" title="CVE-2026-59939"/>
      <reference href="https://bugzilla.redhat.com/2498212" id="2498212" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48585.html" id="ALSA-2026:48585" type="self" title="ALSA-2026:48585"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="fence-agents-scsi" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-scsi-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">02a9562b78a8a24d7e333970efbc532e24161062499846a84fe75f07c16df2e2</sum>
        </package>
        <package name="fence-agents-azure-arm" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-azure-arm-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">032af64bcd10bde68b2388dd314060970da7c540163af46a05622613d0c712e6</sum>
        </package>
        <package name="fence-agents-cisco-mds" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">0585c3e9f38920e515019f74ebdb69e2987cda9c3fc8f55553b0d5b46a04667e</sum>
        </package>
        <package name="fence-agents-ifmib" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">079ef24bb4d641ff4713ab43de2a354ad8dc7350f764f31380313fb52bb8e396</sum>
        </package>
        <package name="fence-agents-eaton-snmp" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">089facbd88cf4480c948daef5080d8a4e863f876af741e894953a052c18472f1</sum>
        </package>
        <package name="fence-agents-apc-snmp" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">0ed42a2237e32de2ee788e8d1ce0205de2e3e3668fe8621b0454862360f4cae9</sum>
        </package>
        <package name="fence-agents-virsh" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-virsh-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">0fbe596f99db8f892c67c85f7cca46ccd883667a63ee6aa5c0a06fc771d1546a</sum>
        </package>
        <package name="fence-agents-rsa" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-rsa-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">1af89745129e72d3cf10835d0b18dc20f4fbb3c87def696fa64d2677f26078eb</sum>
        </package>
        <package name="fence-agents-aws" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-aws-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">1c1a066c56a916c08165ce2852ef4ca97387d9182b0bee48d36b26c35cb1a8ab</sum>
        </package>
        <package name="fence-virtd" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-virtd-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">1c859889147401fe5dc425549dfd18408405cd0aa1bde27b559c1216a58e421a</sum>
        </package>
        <package name="fence-agents-rsb" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-rsb-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">205874c6618128431f134d578571738ee9368d524e16f9991bf507a48a1fc4af</sum>
        </package>
        <package name="fence-agents-wti" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-wti-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">2ac50c4183e12154477c90ad233354a1b426ce6ada8318cd9ff1c95783d0a6e9</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">33a6033ef28cbf57fe6ae177ba899bee9efa2586458cfc9f4b17d8816f4852e9</sum>
        </package>
        <package name="fence-agents-sbd" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-sbd-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">393ba16d2124e745058334be1a9ea19466f1ea2ed79be749f9534c0eb2eae3a0</sum>
        </package>
        <package name="fence-agents-ilo-ssh" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">3b06b3b6370f1542f6c561b830148802a761f1a54cced27f5b897bc72bbf000c</sum>
        </package>
        <package name="fence-agents-common" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-common-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">3eea86a9b2e7978c718daa37a47dec023fd62a6bb5a36ee23afbdad03426d642</sum>
        </package>
        <package name="fence-agents-bladecenter" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">43be7813f12ea8487c7144e058efdca667f8ee63e3b8fb3688b1ee768242c4db</sum>
        </package>
        <package name="fence-agents-amt-ws" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">4f4f9455dc2124c09068d3955018c52d59c5e5787e20c74b56664df7585682b8</sum>
        </package>
        <package name="fence-agents-brocade" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-brocade-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">512d3a91950b1d4aba9d521f1b1298cb5281a94cc741007163fdefa3ff9c6d6b</sum>
        </package>
        <package name="fence-agents-mpath" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-mpath-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">63316b6226135353f691c6e8611077a5d55c61e96e1bbd2f0feae1ef1156055f</sum>
        </package>
        <package name="fence-virtd-multicast" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-virtd-multicast-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">65efd24257c0e60cb531d44888b175a4a8af287349499364ca831a5bf96d36a6</sum>
        </package>
        <package name="fence-agents-eps" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-eps-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">70805cb3186ce3b83c61dd6a92392e10e2269d97bb12901831a705caa2e13e67</sum>
        </package>
        <package name="fence-agents-ibm-powervs" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">769c27a5bdf674e7ae7d3e284ca2ef59c325032952f687138b4de3eb49bbf684</sum>
        </package>
        <package name="fence-agents-ibmblade" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">7d422de49cf099ef097c46e463774d835a7a6341739f62bf21f362bf0369b424</sum>
        </package>
        <package name="fence-virtd-serial" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-virtd-serial-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">82abf7608308292d22e7961b4643d0c77e4425af172230652e5d53ddf17f5e26</sum>
        </package>
        <package name="fence-agents-hpblade" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">89fef3d43f7585019392d0dc5d961f1c4648edbad79329024e184b6e229a1f31</sum>
        </package>
        <package name="fence-virtd-cpg" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-virtd-cpg-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">8c4ee59cf52dcdb1af369d4b8999eb8aa3b0f793446f26f7d3e5d8fe64240359</sum>
        </package>
        <package name="fence-agents-lpar" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-lpar-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">91ae58cf021e245e1a1bf1024c70c1f559915400b560633a3068c117a652dbec</sum>
        </package>
        <package name="fence-agents-cisco-ucs" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">9380d9758dfd4d1453e71e86b6de038363038a4d33fa19c298d368038b30f2cd</sum>
        </package>
        <package name="fence-agents-vmware-soap" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">998f6222b512104dd6ebeef7539b27e306dc5fcfa10ff8331e8975e680821aff</sum>
        </package>
        <package name="fence-agents-heuristics-ping" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">9a5a0dc003e77f5a9ea108f92a622c5d6976e36a844c4b748e069257b31f1021</sum>
        </package>
        <package name="fence-agents-openstack" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-openstack-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">9b097854e612818ee90d30c50c6fba1e7f79c3716557de87cf7648f87c029179</sum>
        </package>
        <package name="fence-agents-aliyun" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-aliyun-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">a4d489d60108099d6eefdf7f6f44af6b38ea8c2cb8396dbbc430f5385b4e9098</sum>
        </package>
        <package name="fence-virtd-libvirt" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-virtd-libvirt-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">a6ddf1a1d37c084897d74b25a2b990462c04056432b85d76f410f98ed7529587</sum>
        </package>
        <package name="fence-agents-kdump" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-kdump-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">a7c0af4a97db21f10c718360495200005870c28e7269ac3e8ad195c439e743d3</sum>
        </package>
        <package name="fence-agents-intelmodular" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">af75659dc64c53a891fd4636e3b0602ad519684579d5271ea03c01a7caa278b2</sum>
        </package>
        <package name="fence-agents-emerson" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-emerson-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">b3ba20e516f6f7d2812656bf61775f98e42e342544de7b9ed01aa80028d7e454</sum>
        </package>
        <package name="fence-agents-vmware-rest" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">bc1b3776aff2e7d3bbe29a17599074c9bf396e5e1b77fe5ab1defede6847358b</sum>
        </package>
        <package name="fence-agents-apc" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-apc-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">bec0c532edc9657fca3d85daa3a0597c46af622904928c2339a37f0adf7ed7ce</sum>
        </package>
        <package name="fence-agents-nutanix-ahv" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-nutanix-ahv-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">c009350e071848c015df98437c80cab01c9ca98f0801415e0e5a445ee998c502</sum>
        </package>
        <package name="fence-agents-rhevm" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">c41641cbe4507b116bd310318f52a3d80536a50089c6df7dca2a11a7a759457c</sum>
        </package>
        <package name="fence-agents-drac5" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-drac5-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">c72dc94ebe3471be09580a457d1e65fd832107047626548b5bfb15a04b9060dc</sum>
        </package>
        <package name="fence-virtd-tcp" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-virtd-tcp-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">ca9cce476887124ca97a195b9c4f8a3ed463982b8cb75a94910cf81c3b9d95b0</sum>
        </package>
        <package name="fence-agents-kubevirt" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">cbf3cae696912bb7382c505117647a24eb44b2d260dfc30cf96b87e5c4246f2c</sum>
        </package>
        <package name="fence-agents-ipmilan" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">cc3c20cef2b889d5204bd8db41430e7e4147d375fba2c598f1d7f4ae9a00fd26</sum>
        </package>
        <package name="fence-virt" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-virt-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">d4d7c75ba3d522608bec900e479af0504bf824df198cf989a2b5c34111ebd9f2</sum>
        </package>
        <package name="ha-cloud-support" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>ha-cloud-support-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">d759306a62c03f0dc232c65eebfffdfd528fa4a8b46ae825a867266caa2f6117</sum>
        </package>
        <package name="fence-agents-all" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-all-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">e9a620bd36bf856171c1cecc8c201e9a3039e2a808161c6fcda9f5413fbb85d6</sum>
        </package>
        <package name="fence-agents-ilo2" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">eb84f77d4c349914d249a21e99b260421c5f9152deb8ab4f6aefcad2c4b71e68</sum>
        </package>
        <package name="fence-agents-ilo-mp" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">eeb9b2bc6cde8b87c3ec4e65ba4ab628d789e89f6bb675f9de06ddff240c830a</sum>
        </package>
        <package name="fence-agents-redfish" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-redfish-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">f19d61955c24363cb9cd767a1025045c87740f218c01a0e728adf04cbff80735</sum>
        </package>
        <package name="fence-agents-gce" version="4.16.0" release="21.el10_2.5" epoch="0" arch="x86_64_v2" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-gce-4.16.0-21.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">f319b5c5cc0c8b42c50256250745e3265a4fa26518b0160c1e57641443a70cca</sum>
        </package>
        <package name="fence-agents-ibm-vpc" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">f902c8e652433f804325f4d993ebdaaa7d96b4806e8da803c04d74fd44eb47e5</sum>
        </package>
        <package name="fence-agents-ipdu" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">fc9de80e97011d49b8861f131eb3794c92c566c1c4502d917365892d71a8bb61</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48650</id>
    <title>Important: vim security update</title>
    <issued date="2026-07-30 00:00:00"/>
    <updated date="2026-08-03 08:24:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>vim security update</summary>
    <description>Vim (Vi IMproved) is an updated and improved version of the vi editor.  

Security Fix(es):  

  * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
  * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
  * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
  * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)
  * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48650" id="RHSA-2026:48650" type="rhsa" title="RHSA-2026:48650"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-55693" id="CVE-2026-55693" type="cve" title="CVE-2026-55693"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-57455" id="CVE-2026-57455" type="cve" title="CVE-2026-57455"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-57456" id="CVE-2026-57456" type="cve" title="CVE-2026-57456"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59856" id="CVE-2026-59856" type="cve" title="CVE-2026-59856"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59858" id="CVE-2026-59858" type="cve" title="CVE-2026-59858"/>
      <reference href="https://bugzilla.redhat.com/2492968" id="2492968" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492972" id="2492972" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492980" id="2492980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498867" id="2498867" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498868" id="2498868" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48650.html" id="ALSA-2026:48650" type="self" title="ALSA-2026:48650"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="vim-enhanced" version="9.1.083" release="9.el10_2.12" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.12.src.rpm">
          <filename>vim-enhanced-9.1.083-9.el10_2.12.x86_64_v2.rpm</filename>
          <sum type="sha256">50ad672efdc2df4ef8c88f9e51afb36c1b1a7238fe6ecf4e0e336854db8c2449</sum>
        </package>
        <package name="xxd" version="9.1.083" release="9.el10_2.12" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.12.src.rpm">
          <filename>xxd-9.1.083-9.el10_2.12.x86_64_v2.rpm</filename>
          <sum type="sha256">560e6b4bc2fc2335bbd243471a8055c985a71c73e87c89ec19047a417008ecec</sum>
        </package>
        <package name="vim-X11" version="9.1.083" release="9.el10_2.12" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.12.src.rpm">
          <filename>vim-X11-9.1.083-9.el10_2.12.x86_64_v2.rpm</filename>
          <sum type="sha256">6e3d2eac70e13ea7520bbc453314b0d6d09c7c785faad12b0c09deddb475355d</sum>
        </package>
        <package name="vim-common" version="9.1.083" release="9.el10_2.12" epoch="2" arch="x86_64_v2" src="vim-9.1.083-9.el10_2.12.src.rpm">
          <filename>vim-common-9.1.083-9.el10_2.12.x86_64_v2.rpm</filename>
          <sum type="sha256">e7825c480444fb15a84ff596b569f98ce0610b0b1e55e9b16f76d94116a7f66d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49211</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-31 00:00:00"/>
    <updated date="2026-08-06 14:45:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)
  * kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303)
  * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle ()


Bug Fix(es) and Enhancement(s):  

  * [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [almalinux-10.2.z] (JIRA:AlmaLinux-185669)
  * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-10.2.z] (JIRA:AlmaLinux-212063)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49211" id="RHSA-2026:49211" type="rhsa" title="RHSA-2026:49211"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68211" id="CVE-2025-68211" type="cve" title="CVE-2025-68211"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46303" id="CVE-2026-46303" type="cve" title="CVE-2026-46303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64530" id="CVE-2026-64530" type="cve" title="CVE-2026-64530"/>
      <reference href="https://bugzilla.redhat.com/2422696" id="2422696" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486471" id="2486471" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504052" id="2504052" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49211.html" id="ALSA-2026:49211" type="self" title="ALSA-2026:49211"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="rv" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.42.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">003ce0ff1e53196fdb7e4ca0404ea8bed4d2fc856b9229dab6db651098e0d5b0</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.42.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">28f29706214d64317162097fc8cf7f7017172f53fffe92038232e9740f5a8bf7</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.42.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">492f8d8f6dce8366129e08b4c3225cc0e154c720a9edb8bb080e93b836d1f955</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.42.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4978e749af158917052ca1cc07076c51d19864e127cdf6e35a1fc508cf0c6821</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.42.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">653897c094ec44ef1b7b1ca1d1ea84665ce9e45c6022077d15158b5eaff5f77e</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.42.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">832c2f81e16fc0032b88e977ccd7a93d6f0a8b6fea5c87ccc96932ea9b46f514</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.42.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">87cb219334aad67d5594bbaa844c52222b3b51fccdb105d7e513f987f077ceb6</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.42.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">bf419056c1f25a425baf0071c6b140681f7a5be5fb6970d09bdaddba8a9d6353</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.42.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dc6739eb90bab5fbc63a605ee777cc9da2d1c0f1e3014fe6aee9ae5a3bb95c36</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.42.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f2cf7076107b4436bd2daa7f83bf99150bb43bd81b5f38e4d97fe9d45c437ac9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49508</id>
    <title>Important: gstreamer1-plugins-good security update</title>
    <issued date="2026-08-03 00:00:00"/>
    <updated date="2026-08-04 16:37:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-good security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  

Security Fix(es):  

  * gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux (CVE-2026-5056)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49508" id="RHSA-2026:49508" type="rhsa" title="RHSA-2026:49508"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5056" id="CVE-2026-5056" type="cve" title="CVE-2026-5056"/>
      <reference href="https://bugzilla.redhat.com/2508623" id="2508623" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49508.html" id="ALSA-2026:49508" type="self" title="ALSA-2026:49508"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-good" version="1.26.7" release="2.el10_2.2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.2.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">0c36071c9895d3aeb28770f616ab19c377981048778fcbfc71885fd0516191b4</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" version="1.26.7" release="2.el10_2.2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.2.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">6731f5de53194e6ef7e96e34e5b3d210d11757a92392f774175e26c354c5d874</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49514</id>
    <title>Important: perl-DBI security update</title>
    <issued date="2026-08-03 00:00:00"/>
    <updated date="2026-08-03 08:24:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-DBI security update</summary>
    <description>DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  

Security Fix(es):  

  * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)
  * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49514" id="RHSA-2026:49514" type="rhsa" title="RHSA-2026:49514"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14380" id="CVE-2026-14380" type="cve" title="CVE-2026-14380"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14739" id="CVE-2026-14739" type="cve" title="CVE-2026-14739"/>
      <reference href="https://bugzilla.redhat.com/2497915" id="2497915" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2497916" id="2497916" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49514.html" id="ALSA-2026:49514" type="self" title="ALSA-2026:49514"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="perl-DBI" version="1.643" release="26.el10_2.3" epoch="0" arch="x86_64_v2" src="perl-DBI-1.643-26.el10_2.3.src.rpm">
          <filename>perl-DBI-1.643-26.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">fa2bd9d95aa4d2ec9e7a4144d0b6945c34862f96f0c99ff53cbfc891c3f8c47a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49523</id>
    <title>Important: perl-Archive-Tar security update</title>
    <issued date="2026-08-03 00:00:00"/>
    <updated date="2026-08-04 16:37:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-Archive-Tar security update</summary>
    <description>Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.  

Security Fix(es):  

  * perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size (CVE-2026-9538)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49523" id="RHSA-2026:49523" type="rhsa" title="RHSA-2026:49523"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9538" id="CVE-2026-9538" type="cve" title="CVE-2026-9538"/>
      <reference href="https://bugzilla.redhat.com/2481315" id="2481315" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49523.html" id="ALSA-2026:49523" type="self" title="ALSA-2026:49523"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="perl-Archive-Tar" version="3.02" release="512.el10_2.2" epoch="0" arch="noarch" src="perl-Archive-Tar-3.02-512.el10_2.2.src.rpm">
          <filename>perl-Archive-Tar-3.02-512.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d2c6df33777b5bff8ce63f4a073d414a7c9afac6e1da152d7b5a41393951e548</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49526</id>
    <title>Important: osbuild-composer security update</title>
    <issued date="2026-08-03 00:00:00"/>
    <updated date="2026-08-13 08:05:34"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>osbuild-composer security update</summary>
    <description>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.  

Security Fix(es):  

  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49526" id="RHSA-2026:49526" type="rhsa" title="RHSA-2026:49526"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49526.html" id="ALSA-2026:49526" type="self" title="ALSA-2026:49526"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="osbuild-composer-core" version="165.1" release="3.el10_2.1.alma.3" epoch="0" arch="x86_64_v2" src="osbuild-composer-165.1-3.el10_2.1.alma.3.src.rpm">
          <filename>osbuild-composer-core-165.1-3.el10_2.1.alma.3.x86_64_v2.rpm</filename>
          <sum type="sha256">290cd3932ad7a5738892690cc85374e2dcf75068cffe30bdd96f43d7ff01c7bb</sum>
        </package>
        <package name="osbuild-composer" version="165.1" release="3.el10_2.1.alma.3" epoch="0" arch="x86_64_v2" src="osbuild-composer-165.1-3.el10_2.1.alma.3.src.rpm">
          <filename>osbuild-composer-165.1-3.el10_2.1.alma.3.x86_64_v2.rpm</filename>
          <sum type="sha256">5ed5ad0f0d5dc36c80efa92d1fe48135a864c9e0880e09f680733c8ef096cebd</sum>
        </package>
        <package name="osbuild-composer-worker" version="165.1" release="3.el10_2.1.alma.3" epoch="0" arch="x86_64_v2" src="osbuild-composer-165.1-3.el10_2.1.alma.3.src.rpm">
          <filename>osbuild-composer-worker-165.1-3.el10_2.1.alma.3.x86_64_v2.rpm</filename>
          <sum type="sha256">ea9b002913de51b6a465c48b1996f0eab0262f3b1b77a2d28a25e8423db94621</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49621</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-08-03 00:00:00"/>
    <updated date="2026-08-06 14:44:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>thunderbird security update</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.  

Security Fix(es):  

  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
  * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49621" id="RHSA-2026:49621" type="rhsa" title="RHSA-2026:49621"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14899" id="CVE-2026-14899" type="cve" title="CVE-2026-14899"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15718" id="CVE-2026-15718" type="cve" title="CVE-2026-15718"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15719" id="CVE-2026-15719" type="cve" title="CVE-2026-15719"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16349" id="CVE-2026-16349" type="cve" title="CVE-2026-16349"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16350" id="CVE-2026-16350" type="cve" title="CVE-2026-16350"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16351" id="CVE-2026-16351" type="cve" title="CVE-2026-16351"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16352" id="CVE-2026-16352" type="cve" title="CVE-2026-16352"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16353" id="CVE-2026-16353" type="cve" title="CVE-2026-16353"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16354" id="CVE-2026-16354" type="cve" title="CVE-2026-16354"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16355" id="CVE-2026-16355" type="cve" title="CVE-2026-16355"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16356" id="CVE-2026-16356" type="cve" title="CVE-2026-16356"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16357" id="CVE-2026-16357" type="cve" title="CVE-2026-16357"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16358" id="CVE-2026-16358" type="cve" title="CVE-2026-16358"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16359" id="CVE-2026-16359" type="cve" title="CVE-2026-16359"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16360" id="CVE-2026-16360" type="cve" title="CVE-2026-16360"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16361" id="CVE-2026-16361" type="cve" title="CVE-2026-16361"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16362" id="CVE-2026-16362" type="cve" title="CVE-2026-16362"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16363" id="CVE-2026-16363" type="cve" title="CVE-2026-16363"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16368" id="CVE-2026-16368" type="cve" title="CVE-2026-16368"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16369" id="CVE-2026-16369" type="cve" title="CVE-2026-16369"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16371" id="CVE-2026-16371" type="cve" title="CVE-2026-16371"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16374" id="CVE-2026-16374" type="cve" title="CVE-2026-16374"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16375" id="CVE-2026-16375" type="cve" title="CVE-2026-16375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16377" id="CVE-2026-16377" type="cve" title="CVE-2026-16377"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16379" id="CVE-2026-16379" type="cve" title="CVE-2026-16379"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16381" id="CVE-2026-16381" type="cve" title="CVE-2026-16381"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16383" id="CVE-2026-16383" type="cve" title="CVE-2026-16383"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16387" id="CVE-2026-16387" type="cve" title="CVE-2026-16387"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16390" id="CVE-2026-16390" type="cve" title="CVE-2026-16390"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16391" id="CVE-2026-16391" type="cve" title="CVE-2026-16391"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16396" id="CVE-2026-16396" type="cve" title="CVE-2026-16396"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16405" id="CVE-2026-16405" type="cve" title="CVE-2026-16405"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16412" id="CVE-2026-16412" type="cve" title="CVE-2026-16412"/>
      <reference href="https://bugzilla.redhat.com/2499973" id="2499973" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2499974" id="2499974" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503415" id="2503415" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503416" id="2503416" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503420" id="2503420" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503423" id="2503423" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503425" id="2503425" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503430" id="2503430" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503432" id="2503432" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503434" id="2503434" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503439" id="2503439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503440" id="2503440" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503444" id="2503444" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503451" id="2503451" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503454" id="2503454" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503456" id="2503456" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503463" id="2503463" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503472" id="2503472" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503473" id="2503473" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503485" id="2503485" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503489" id="2503489" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503491" id="2503491" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503497" id="2503497" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503498" id="2503498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503500" id="2503500" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503501" id="2503501" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503505" id="2503505" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503512" id="2503512" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503513" id="2503513" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503517" id="2503517" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503521" id="2503521" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503527" id="2503527" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2506217" id="2506217" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49621.html" id="ALSA-2026:49621" type="self" title="ALSA-2026:49621"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="thunderbird" version="140.13.0" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="thunderbird-140.13.0-1.el10_2.alma.1.src.rpm">
          <filename>thunderbird-140.13.0-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">dbde50784b4ef033b3099da23ec43be532ecdee887982a7397e348e1b6d655cf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49668</id>
    <title>Moderate: p11-kit security update</title>
    <issued date="2026-08-03 00:00:00"/>
    <updated date="2026-08-04 16:37:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>p11-kit security update</summary>
    <description>The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.  

Security Fix(es):  

  * p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing (CVE-2026-13757)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49668" id="RHSA-2026:49668" type="rhsa" title="RHSA-2026:49668"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13757" id="CVE-2026-13757" type="cve" title="CVE-2026-13757"/>
      <reference href="https://bugzilla.redhat.com/2494556" id="2494556" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49668.html" id="ALSA-2026:49668" type="self" title="ALSA-2026:49668"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="p11-kit-server" version="0.26.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="p11-kit-0.26.4-1.el10_2.src.rpm">
          <filename>p11-kit-server-0.26.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">13964f71af7f99be1964e864d033624432327bf82e62a52b337a8f20695dd205</sum>
        </package>
        <package name="p11-kit-devel" version="0.26.4" release="1.el10_2" epoch="0" arch="x86_64_v2" src="p11-kit-0.26.4-1.el10_2.src.rpm">
          <filename>p11-kit-devel-0.26.4-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ef000e3ceaaa52759e9c27cc329f8fbd7fbbd18e10f8a6b277d1ca7962adea84</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49836</id>
    <title>Important: ldns security update</title>
    <issued date="2026-08-03 00:00:00"/>
    <updated date="2026-08-06 14:43:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ldns security update</summary>
    <description>The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets.  

Security Fix(es):  

  * ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49836" id="RHSA-2026:49836" type="rhsa" title="RHSA-2026:49836"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10846" id="CVE-2026-10846" type="cve" title="CVE-2026-10846"/>
      <reference href="https://bugzilla.redhat.com/2487437" id="2487437" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49836.html" id="ALSA-2026:49836" type="self" title="ALSA-2026:49836"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="ldns" version="1.8.3" release="18.el10_2.1" epoch="0" arch="x86_64_v2" src="ldns-1.8.3-18.el10_2.1.src.rpm">
          <filename>ldns-1.8.3-18.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">54132f86ac2afad31d6c23a0256b23e3447dc295ba347fbaf724b7307212f63e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49871</id>
    <title>Moderate: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-04 00:00:00"/>
    <updated date="2026-08-07 08:58:28"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214)
  * kernel: procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199)


Bug Fix(es) and Enhancement(s):  

  * [Lenovo] Graphics not working on T14 G7 Intel (Pantherlake) (JIRA:AlmaLinux-172832)
  * Possible regression with FM350GL [almalinux-10.2.z] (JIRA:AlmaLinux-184266)
  * [10.2 FEAT] CNB102: dpll: sync with upstream (JIRA:AlmaLinux-211011)
  * backport make module and modules-core provides use variant [almalinux-10.2.z] (JIRA:AlmaLinux-213965)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49871" id="RHSA-2026:49871" type="rhsa" title="RHSA-2026:49871"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68214" id="CVE-2025-68214" type="cve" title="CVE-2025-68214"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23199" id="CVE-2026-23199" type="cve" title="CVE-2026-23199"/>
      <reference href="https://bugzilla.redhat.com/2422686" id="2422686" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439919" id="2439919" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49871.html" id="ALSA-2026:49871" type="self" title="ALSA-2026:49871"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-devel-matched" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.43.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">198cec0f7d0b0982442523e8d9f0a1150a770323618f4579d2d3d2a207f3b830</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.43.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1c74553d75296b52e5083e8873de03e04a8574cf085839e5ac3f4e2003a287ca</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.43.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3e92461b767b2e1aa250b2697ae01738d2e0900a61db7b97778639d62755cb8a</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.43.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6687bd62bf7ba91c68a4ff914fbeebd0689a579c2ee0718b960f261430667982</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.43.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">948cb7e56cdab7d07544b27ac078888a6333e4ac230f0c0a184c0f98e932df37</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.43.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">96faa6def8cd7d33b4bb72f50ef3a895c2f38da6193fb3a0bd6f0917587312e6</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.43.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b1f1a7475e54139edb9efc4b7636fa21db12a7fdacb810da77e61e9d39599c7e</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.43.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c3b2260b4d2588bca99a1cc1e210e2bc554d5a5e3db7019280a279ce6387840f</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.43.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e6b1b0ff59f9e6cb9040b041683f40f4cf3047690a526cef16d4a50f9ef86829</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.43.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e8945f0a2c99b73c4fdd80ecfb922baf3420357e0132c583a0c5b41eac9ab46a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49914</id>
    <title>Low: php8.4 security, bug fix, and enhancement update</title>
    <issued date="2026-08-04 00:00:00"/>
    <updated date="2026-08-18 08:59:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>php8.4 security, bug fix, and enhancement update</summary>
    <description>PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.  

Security Fix(es):  

  * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)


Bug Fix(es) and Enhancement(s):  

  * Rebase PHP to 8.4.23 for CVE-2026-14355 in 10.2.z (JIRA:AlmaLinux-192616)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49914" id="RHSA-2026:49914" type="rhsa" title="RHSA-2026:49914"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14355" id="CVE-2026-14355" type="cve" title="CVE-2026-14355"/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49914.html" id="ALSA-2026:49914" type="self" title="ALSA-2026:49914"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="php8.4-common" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-common-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0a38538ff6683af279c3af8a9947941b65365f4b86cd466b6ee6c44144fe24f8</sum>
        </package>
        <package name="php8.4-pdo" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-pdo-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0bc608d660c0c2dedaa0bfc06bc4eec1786281d6b818c397d149a94facb781f1</sum>
        </package>
        <package name="php8.4-snmp" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-snmp-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">12dd209c801382523cbc3448e59d89ef323f77f32c47cdf5bd937e44e1cdd121</sum>
        </package>
        <package name="php8.4-gd" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-gd-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">363a5b90b389b0a8b9a98d1cb17e3c23a304cfdea4b06030b5f022cdb1263db4</sum>
        </package>
        <package name="php8.4" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">39e167e196aab585723c419823cf6161b8fc8c10b49aad8d5b9e4e619c1e8ba9</sum>
        </package>
        <package name="php8.4-fpm" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-fpm-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4d6dc19e9ab15d380db167a78f2e9d914f799eed993bc37e816491abdaec68a9</sum>
        </package>
        <package name="php8.4-mbstring" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-mbstring-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">50d82608c0ecb122df0d09342c778cabb933267469b22e32671d70eeeafccafa</sum>
        </package>
        <package name="php8.4-xml" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-xml-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5bc96e709703b7ae5e93c710193ae9e1ace3259ec97e2811e46986c6a8dadcfd</sum>
        </package>
        <package name="php8.4-process" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-process-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">60db45a8099a927c478fe38197515fa93e912c908cf28470dcfbff1a6d12639c</sum>
        </package>
        <package name="php8.4-ffi" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-ffi-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">612623fbb01775f2dbee77d7b6bb06f7b8b28156ff30b430ae4b5554816728de</sum>
        </package>
        <package name="php8.4-opcache" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-opcache-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6bbc37daaadfbc178306e81b42a354ada1dcc9ab59f44bb1919713bb7afa6ce9</sum>
        </package>
        <package name="php8.4-enchant" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-enchant-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">73d8caad324847324777265998a963c3d84203db9269e5723f89aea2096d8b34</sum>
        </package>
        <package name="php8.4-mysqlnd" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-mysqlnd-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">747b53a9171ec7366f28209bdfaeabb1f52f46b0503b156ec74a460bd787b995</sum>
        </package>
        <package name="php8.4-soap" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-soap-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">81bf0497f43ab931d535fc075baa24438b1c87816930c05b4b34fb6da702d72e</sum>
        </package>
        <package name="php8.4-pgsql" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-pgsql-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">81dea6caef14fd47e897992aa975e0adbc2c98dfa5dcd0ed4abe05a628e2c32c</sum>
        </package>
        <package name="php8.4-cli" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-cli-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9f221ffaef058deb95278ca493623cbf93795c9aef512c4cc6c331f21e4bc79b</sum>
        </package>
        <package name="php8.4-dbg" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-dbg-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a60472fff3ec049b090090dc2930930d1d7222b9dc6245ffc9693f7f62b87e95</sum>
        </package>
        <package name="php8.4-bcmath" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-bcmath-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c456c4f91e46f522641e1f1b26da0917fe2637211a1b9280ae1dc234c3238cd9</sum>
        </package>
        <package name="php8.4-embedded" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-embedded-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c681f66585f6a8e47da583383d30b2f7417be9cdfe7747bd6392c1e9c536c1f6</sum>
        </package>
        <package name="php8.4-ldap" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-ldap-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c8c0678b91b4abb33e755608d42542bbf364977ca794c96858055a9eb960276d</sum>
        </package>
        <package name="php8.4-gmp" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-gmp-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d052bf88122360e7bb78c6029308467a19ca101579ef0c8c19a0cc17632d7fc1</sum>
        </package>
        <package name="php8.4-intl" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-intl-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e997271b73366d4da42c96b1c050c309d9a4430b2a178441ef1a715ef0025743</sum>
        </package>
        <package name="php8.4-dba" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-dba-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ece1cf77674708a564930031c00c112e0680e4e5ca4966174f70cd44f294e735</sum>
        </package>
        <package name="php8.4-odbc" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-odbc-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f1184c957f54d351eef0378674dc7d918dadf635ef2a1b6f9bce3097fa34ff81</sum>
        </package>
        <package name="php8.4-devel" version="8.4.23" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-devel-8.4.23-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fe99174206eed69287b91ddb8ba59f662599c02c085d8a18262b64c89f3401f3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:50144</id>
    <title>Moderate: libgcrypt security update</title>
    <issued date="2026-08-04 00:00:00"/>
    <updated date="2026-08-06 14:41:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libgcrypt security update</summary>
    <description>The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.  

Security Fix(es):  

  * Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:50144" id="RHSA-2026:50144" type="rhsa" title="RHSA-2026:50144"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41989" id="CVE-2026-41989" type="cve" title="CVE-2026-41989"/>
      <reference href="https://bugzilla.redhat.com/2461063" id="2461063" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-50144.html" id="ALSA-2026:50144" type="self" title="ALSA-2026:50144"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libgcrypt-devel" version="1.11.0" release="7.el10_2" epoch="0" arch="x86_64_v2" src="libgcrypt-1.11.0-7.el10_2.src.rpm">
          <filename>libgcrypt-devel-1.11.0-7.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e6b885077bd8a779bfdb13740abf81cbe2ca7d129494b989143e853384d5df72</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:50747</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-08-05 00:00:00"/>
    <updated date="2026-08-06 14:41:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>freerdp security update</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.  

Security Fix(es):  

  * FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding (CVE-2026-55827)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:50747" id="RHSA-2026:50747" type="rhsa" title="RHSA-2026:50747"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-55827" id="CVE-2026-55827" type="cve" title="CVE-2026-55827"/>
      <reference href="https://bugzilla.redhat.com/2499159" id="2499159" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-50747.html" id="ALSA-2026:50747" type="self" title="ALSA-2026:50747"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="freerdp" version="3.10.3" release="12.el10_2.7" epoch="2" arch="x86_64_v2" src="freerdp-3.10.3-12.el10_2.7.src.rpm">
          <filename>freerdp-3.10.3-12.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">4687f893588a3a901373eef26ac355ec309d29c3f2ecb86df99e626a03e43bc4</sum>
        </package>
        <package name="libwinpr" version="3.10.3" release="12.el10_2.7" epoch="2" arch="x86_64_v2" src="freerdp-3.10.3-12.el10_2.7.src.rpm">
          <filename>libwinpr-3.10.3-12.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">4e1eb08457f573b34c95f7983e426b32fc30ccf321fe0af4ba64deaae1a7c528</sum>
        </package>
        <package name="freerdp-libs" version="3.10.3" release="12.el10_2.7" epoch="2" arch="x86_64_v2" src="freerdp-3.10.3-12.el10_2.7.src.rpm">
          <filename>freerdp-libs-3.10.3-12.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">827814258aa362323275dc95e8e12907f8a9f7150801b5424eb22304dc8e7c1b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:51075</id>
    <title>Important: gpsd security update</title>
    <issued date="2026-08-06 00:00:00"/>
    <updated date="2026-08-07 15:41:53"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gpsd security update</summary>
    <description>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See &lt;https://access.AlmaLinux.com/support/policy/gpsd-support&gt; for more details.  

Security Fix(es):  

  * gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution (CVE-2026-58459)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:51075" id="RHSA-2026:51075" type="rhsa" title="RHSA-2026:51075"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58459" id="CVE-2026-58459" type="cve" title="CVE-2026-58459"/>
      <reference href="https://bugzilla.redhat.com/2498575" id="2498575" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-51075.html" id="ALSA-2026:51075" type="self" title="ALSA-2026:51075"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gpsd" version="3.26.1" release="3.el10_2.1" epoch="1" arch="x86_64_v2" src="gpsd-3.26.1-3.el10_2.1.src.rpm">
          <filename>gpsd-3.26.1-3.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">06fa2318248abf28ee5125eca2060a4bb276f8c6aaf18857b3bf0f33ac155a0e</sum>
        </package>
        <package name="python3-gpsd" version="3.26.1" release="3.el10_2.1" epoch="1" arch="x86_64_v2" src="gpsd-3.26.1-3.el10_2.1.src.rpm">
          <filename>python3-gpsd-3.26.1-3.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b149b421ecf9b8c86eae1006f11438c101c00744637a146eb61f139ceae8543f</sum>
        </package>
        <package name="gpsd-clients" version="3.26.1" release="3.el10_2.1" epoch="1" arch="x86_64_v2" src="gpsd-3.26.1-3.el10_2.1.src.rpm">
          <filename>gpsd-clients-3.26.1-3.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">be82ec41f3e03a23f7a03f4e73ed3e4222e023ecd9c22e69651234aef302a854</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:51295</id>
    <title>Moderate: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-06 00:00:00"/>
    <updated date="2026-08-11 08:56:26"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CVE-2026-43186)


Bug Fix(es) and Enhancement(s):  

  * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-10.2.z] (JIRA:AlmaLinux-186345)
  * ice: driver update 2026-06, part 2 [almalinux-10.2.z] (JIRA:AlmaLinux-193134)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:51295" id="RHSA-2026:51295" type="rhsa" title="RHSA-2026:51295"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43186" id="CVE-2026-43186" type="cve" title="CVE-2026-43186"/>
      <reference href="https://bugzilla.redhat.com/2467143" id="2467143" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-51295.html" id="ALSA-2026:51295" type="self" title="ALSA-2026:51295"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.44.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1c4aade5d5fb516248eb660f2819523377e9feca8b77c696901ba628dcc0602a</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.44.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">22d29a216d1e645bfaf0b3b31ddac23e9d78d94010fe746e1f5dea0d7eef56f7</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.44.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">30fd476c6c7223afbe57a98effb1fdc8b297119bc995d12b1ea3a59ebe2d4e57</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.44.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">59b6dac2a799cfb690c1ae81418820918b9baf8039a030abd9e7f2f8098bc9b2</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.44.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5ac8a28f66e44fcfe3cd1a303608668ec9144c98f83389fa67019011e1f3a6b5</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.44.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">74aa74d6598b0c09914d70a26fa7f1ed8494d5a4b4dcd11722de540b4957cce5</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.44.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">931f5276200a337a78d07104dc49844d3ff1fd47250f39788c9cc737e1d74af1</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.44.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b70d56674a33abbb31ab9542ceb518b40f479ae6c73c5cfb2d8b83da0fb83b2c</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.44.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f4620031bced7f48202f3b9785b237d4a8d1a4177a70ae0e1f89fb149a217bc6</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.44.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f5ea2399ed2bbbe91858a7c455d8abb8bfa1de14837baaaffb35d522e6519e0b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:52675</id>
    <title>Moderate: libarchive security update</title>
    <issued date="2026-08-10 00:00:00"/>
    <updated date="2026-08-10 15:32:28"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libarchive security update</summary>
    <description>The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  

Security Fix(es):  

  * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:52675" id="RHSA-2026:52675" type="rhsa" title="RHSA-2026:52675"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14164" id="CVE-2026-14164" type="cve" title="CVE-2026-14164"/>
      <reference href="https://bugzilla.redhat.com/2493411" id="2493411" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-52675.html" id="ALSA-2026:52675" type="self" title="ALSA-2026:52675"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libarchive-devel" version="3.7.7" release="10.el10_2" epoch="0" arch="x86_64_v2" src="libarchive-3.7.7-10.el10_2.src.rpm">
          <filename>libarchive-devel-3.7.7-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">125d8c50877261464195cc9f281b0e257993d7134ed30fb9062803fd0fd8462a</sum>
        </package>
        <package name="bsdtar" version="3.7.7" release="10.el10_2" epoch="0" arch="x86_64_v2" src="libarchive-3.7.7-10.el10_2.src.rpm">
          <filename>bsdtar-3.7.7-10.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">421ba2efeea4cd6068924e0fa3ede5c64df5e2a288b8146ad5f2c92079c421dd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:52841</id>
    <title>Important: nodejs-nodemon security update</title>
    <issued date="2026-08-10 00:00:00"/>
    <updated date="2026-08-11 08:56:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs-nodemon security update</summary>
    <description>Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.  

Security Fix(es):  

  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:52841" id="RHSA-2026:52841" type="rhsa" title="RHSA-2026:52841"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-69152" id="CVE-2026-69152" type="cve" title="CVE-2026-69152"/>
      <reference href="https://bugzilla.redhat.com/2510722" id="2510722" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-52841.html" id="ALSA-2026:52841" type="self" title="ALSA-2026:52841"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs-nodemon" version="3.1.14" release="3.el10_2" epoch="0" arch="noarch" src="nodejs-nodemon-3.1.14-3.el10_2.src.rpm">
          <filename>nodejs-nodemon-3.1.14-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">754dbb75c7096126fe89e0025ab2e31e63eda960fb77226c5e627a74feb18d21</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:53330</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-11 00:00:00"/>
    <updated date="2026-08-13 09:17:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: fsnotify: Fix ordering of iput() and watched_objects decrement (CVE-2024-53143)
  * kernel: shmem: fix recovery on rename failures (CVE-2025-71072)
  * kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415)
  * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)
  * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)
  * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368)
  * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)


Bug Fix(es) and Enhancement(s):  

  * Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-10.2.z] (JIRA:AlmaLinux-213035)
  * AlmaLinux10.0 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-10.2.z] (JIRA:AlmaLinux-222503)
  * AlmaLinux10.0 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-10.2.z] (JIRA:AlmaLinux-222505)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:53330" id="RHSA-2026:53330" type="rhsa" title="RHSA-2026:53330"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-53143" id="CVE-2024-53143" type="cve" title="CVE-2024-53143"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71072" id="CVE-2025-71072" type="cve" title="CVE-2025-71072"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23415" id="CVE-2026-23415" type="cve" title="CVE-2026-23415"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31488" id="CVE-2026-31488" type="cve" title="CVE-2026-31488"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52923" id="CVE-2026-52923" type="cve" title="CVE-2026-52923"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64368" id="CVE-2026-64368" type="cve" title="CVE-2026-64368"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64531" id="CVE-2026-64531" type="cve" title="CVE-2026-64531"/>
      <reference href="https://bugzilla.redhat.com/2330957" id="2330957" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2429083" id="2429083" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454320" id="2454320" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460619" id="2460619" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492094" id="2492094" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507213" id="2507213" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507402" id="2507402" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-53330.html" id="ALSA-2026:53330" type="self" title="ALSA-2026:53330"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-devel-matched" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.46.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1e1452ee0f31e6528b28500507deec1b371908b5161ce4236b24f2df56398c77</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.46.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">284998ddcbf8d00c5202e1315d7bf8e1e14caa97a133d0dcf7123510a9544661</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.46.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4bb8713cca45b39b58f7b4c120ffb3af5838c6f27c94180c0a4305f7de43b11e</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.46.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5694db68af9ac578da9c82db457b19bf6a64acc9014cdf4d7836981d383beaf2</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.46.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">889073b12cc0ea295f2ca8fe44265cfc363bf64df9f9389e1236bf5667da86f5</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.46.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a4045fbf2b278910f8552bcd9be1af378b04f758874179308099f0149c30191c</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.46.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a9745537f7ff6586b4e1492812f0ad6fc0d5689f7e5d68f07ced20ed313f0eb9</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.46.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c19f84f73cd9c0b6ff7403dde04bb4872632d5b6279fdb23151b22233dfb84e3</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.46.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c9e38f2a5f36d8a6a6ae58167305c6139ece292eb298e2830a08f094fdf98cb0</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.46.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fd1f09081a6d2a546bd9484a1f90ab01b6ff3e63fc575df2bbad14884f9e7693</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:53435</id>
    <title>Important: udisks2 security update</title>
    <issued date="2026-08-11 00:00:00"/>
    <updated date="2026-08-12 12:03:58"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>udisks2 security update</summary>
    <description>The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.  

Security Fix(es):  

  * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:53435" id="RHSA-2026:53435" type="rhsa" title="RHSA-2026:53435"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7867" id="CVE-2026-7867" type="cve" title="CVE-2026-7867"/>
      <reference href="https://bugzilla.redhat.com/2466747" id="2466747" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-53435.html" id="ALSA-2026:53435" type="self" title="ALSA-2026:53435"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="udisks2-iscsi" version="2.11.0" release="2.el10_2.1.alma.2" epoch="0" arch="x86_64_v2" src="udisks2-2.11.0-2.el10_2.1.alma.2.src.rpm">
          <filename>udisks2-iscsi-2.11.0-2.el10_2.1.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">158186a1650bd037ad0cd9154302292e9c1d1f17ad8075973fc183c4f7854874</sum>
        </package>
        <package name="udisks2-lvm2" version="2.11.0" release="2.el10_2.1.alma.2" epoch="0" arch="x86_64_v2" src="udisks2-2.11.0-2.el10_2.1.alma.2.src.rpm">
          <filename>udisks2-lvm2-2.11.0-2.el10_2.1.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">17cc42fc5b71d82b33b1613969aee8518d8fa957d483de250c224606beaba8ea</sum>
        </package>
        <package name="udisks2-lsm" version="2.11.0" release="2.el10_2.1.alma.2" epoch="0" arch="x86_64_v2" src="udisks2-2.11.0-2.el10_2.1.alma.2.src.rpm">
          <filename>udisks2-lsm-2.11.0-2.el10_2.1.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">19285ef02dff2f45def5add063aebeeb312affa8939e5045e57a47d50e73d418</sum>
        </package>
        <package name="libudisks2" version="2.11.0" release="2.el10_2.1.alma.2" epoch="0" arch="x86_64_v2" src="udisks2-2.11.0-2.el10_2.1.alma.2.src.rpm">
          <filename>libudisks2-2.11.0-2.el10_2.1.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">37924fa37533d86b8e30b7f3fbbcdc135ed96282d2e6711ff7df51caa673509b</sum>
        </package>
        <package name="udisks2" version="2.11.0" release="2.el10_2.1.alma.2" epoch="0" arch="x86_64_v2" src="udisks2-2.11.0-2.el10_2.1.alma.2.src.rpm">
          <filename>udisks2-2.11.0-2.el10_2.1.alma.2.x86_64_v2.rpm</filename>
          <sum type="sha256">db06d6ab08781d1e57b4d6878ba550e5a31d37d0a7cfcf1b3f8ea6d867575844</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:53451</id>
    <title>Moderate: gstreamer1-plugins-good security update</title>
    <issued date="2026-08-11 00:00:00"/>
    <updated date="2026-08-13 08:05:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>gstreamer1-plugins-good security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  

Security Fix(es):  

  * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:53451" id="RHSA-2026:53451" type="rhsa" title="RHSA-2026:53451"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-18649" id="CVE-2026-18649" type="cve" title="CVE-2026-18649"/>
      <reference href="https://bugzilla.redhat.com/2510614" id="2510614" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-53451.html" id="ALSA-2026:53451" type="self" title="ALSA-2026:53451"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-good" version="1.26.7" release="2.el10_2.3" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.3.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">99d10bdb5bcaa8286ff3edda5c1d4f54eedd23266c14e146af4ca596e3d93307</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" version="1.26.7" release="2.el10_2.3" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.3.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">f4f1c059cfcf9450c4b141518a3033aeec565c77d42a9d3013d268fcaaafe98b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:53845</id>
    <title>Important: iscsi-initiator-utils security, bug fix, and enhancement update</title>
    <issued date="2026-08-11 00:00:00"/>
    <updated date="2026-08-12 09:24:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>iscsi-initiator-utils security, bug fix, and enhancement update</summary>
    <description>The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.  

Security Fix(es):  

  * open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)
  * open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)


Bug Fix(es) and Enhancement(s):  

  * [FJ10.1 Bug]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [almalinux-10.2.z] (JIRA:AlmaLinux-191899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:53845" id="RHSA-2026:53845" type="rhsa" title="RHSA-2026:53845"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44943" id="CVE-2026-44943" type="cve" title="CVE-2026-44943"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44944" id="CVE-2026-44944" type="cve" title="CVE-2026-44944"/>
      <reference href="https://bugzilla.redhat.com/2508412" id="2508412" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2508419" id="2508419" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-53845.html" id="ALSA-2026:53845" type="self" title="ALSA-2026:53845"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3-iscsi-initiator-utils" version="6.2.1.11" release="1.git4b3e853.el10_2.2" epoch="0" arch="x86_64_v2" src="iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el10_2.2.src.rpm">
          <filename>python3-iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">bace86f45fa9f900229bdd07f2c395dace56953cecdd3f7e27128172be600680</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:54178</id>
    <title>Moderate: grafana security, bug fix, and enhancement update</title>
    <issued date="2026-08-12 00:00:00"/>
    <updated date="2026-08-13 08:05:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>grafana security, bug fix, and enhancement update</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.   

Security Fix(es):  

  * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)
  * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)
  * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)
  * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)


Bug Fix(es) and Enhancement(s):  

  * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:54178" id="RHSA-2026:54178" type="rhsa" title="RHSA-2026:54178"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33376" id="CVE-2026-33376" type="cve" title="CVE-2026-33376"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33377" id="CVE-2026-33377" type="cve" title="CVE-2026-33377"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33382" id="CVE-2026-33382" type="cve" title="CVE-2026-33382"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8609" id="CVE-2026-8609" type="cve" title="CVE-2026-8609"/>
      <reference href="https://bugzilla.redhat.com/2477246" id="2477246" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477262" id="2477262" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2499061" id="2499061" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2499062" id="2499062" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-54178.html" id="ALSA-2026:54178" type="self" title="ALSA-2026:54178"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="grafana-selinux" version="10.2.6" release="28.el10_2.4" epoch="0" arch="x86_64_v2" src="grafana-10.2.6-28.el10_2.4.src.rpm">
          <filename>grafana-selinux-10.2.6-28.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">2f61bfaf645239532e18a1c8b4bf0f520bce9a38364a3078cced4f3e9336afc4</sum>
        </package>
        <package name="grafana" version="10.2.6" release="28.el10_2.4" epoch="0" arch="x86_64_v2" src="grafana-10.2.6-28.el10_2.4.src.rpm">
          <filename>grafana-10.2.6-28.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">b9da239f5dc112745aff9268951b326f91012d3bef3dc28e79681abfb2a84020</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:54343</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-12 00:00:00"/>
    <updated date="2026-08-14 10:45:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202)
  * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
  * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)
  * kernel: perf/aux: Fix page UAF in map_range() (CVE-2026-64300)
  * kernel: af_unix: set gc_in_progress to true in unix_gc() (CVE-2026-53361)


Bug Fix(es) and Enhancement(s):  

  * netfilter: CVE backports for AlmaLinux 10.2.z (JIRA:AlmaLinux-185311)
  * tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-10.2.z] (JIRA:AlmaLinux-214436)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:54343" id="RHSA-2026:54343" type="rhsa" title="RHSA-2026:54343"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53202" id="CVE-2026-53202" type="cve" title="CVE-2026-53202"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53264" id="CVE-2026-53264" type="cve" title="CVE-2026-53264"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-63887" id="CVE-2026-63887" type="cve" title="CVE-2026-63887"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64300" id="CVE-2026-64300" type="cve" title="CVE-2026-64300"/>
      <reference href="https://bugzilla.redhat.com/2492823" id="2492823" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492851" id="2492851" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502447" id="2502447" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507040" id="2507040" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-54343.html" id="ALSA-2026:54343" type="self" title="ALSA-2026:54343"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.47.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1d2744d86fef3fcc2f7dd93b9cd3e7dda1e30bf78eecd84a97b378cbad4624fc</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.47.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4bc22f55746eabdf05e50f331ecdb24690ba67b364ff1d6f0c614dc41ce8bb7f</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.47.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4f448bd7f031e99a1b6f3057663e6a9de795b1119e3127376f0b6f4426ff6c46</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.47.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">609e036547634502eed36a90e50125f963517a3d5ffe0f94c83cbd0d498e9c03</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.47.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6ab6254e1b90f0fd89cfd61817c3db5355f6c2e45b1cd4a9a15d5b72afb8f41d</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.47.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">81bdb86d67527830ad5a2c5cd8d85a8db5898da46f549292a917123fa94b7b37</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.47.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">afe0401c5f104ef5f92a53e15f6e7036c2cf12f397c55d476aac5876c5b4d963</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.47.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b6ea785a24bb7a5f9f936164f09340cbc926d13f91290fde4caa9d611fc41c48</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.47.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ce9fe8ff3cb2fc06a761178e0b6b722ef24d5d01c2586c1852e7e9e2f7938197</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.47.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dfda07b268132d889ad8a9e47647e440c02953ce25665a1d6e2856ef3225c113</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:54486</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-08-13 00:00:00"/>
    <updated date="2026-08-14 08:59:00"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>freerdp security update</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.  

Security Fix(es):  

  * FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620)
  * FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621)
  * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)
  * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)
  * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)
  * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:54486" id="RHSA-2026:54486" type="rhsa" title="RHSA-2026:54486"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64620" id="CVE-2026-64620" type="cve" title="CVE-2026-64620"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64621" id="CVE-2026-64621" type="cve" title="CVE-2026-64621"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64624" id="CVE-2026-64624" type="cve" title="CVE-2026-64624"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-67289" id="CVE-2026-67289" type="cve" title="CVE-2026-67289"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-67299" id="CVE-2026-67299" type="cve" title="CVE-2026-67299"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-68580" id="CVE-2026-68580" type="cve" title="CVE-2026-68580"/>
      <reference href="https://bugzilla.redhat.com/2502752" id="2502752" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502766" id="2502766" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503096" id="2503096" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2509985" id="2509985" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510004" id="2510004" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510125" id="2510125" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-54486.html" id="ALSA-2026:54486" type="self" title="ALSA-2026:54486"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="freerdp-libs" version="3.10.3" release="12.el10_2.8" epoch="2" arch="x86_64_v2" src="freerdp-3.10.3-12.el10_2.8.src.rpm">
          <filename>freerdp-libs-3.10.3-12.el10_2.8.x86_64_v2.rpm</filename>
          <sum type="sha256">073d3c0a9ba078f3f2f1631c80c297696354705aed4b87bfe12cbccbcc232826</sum>
        </package>
        <package name="freerdp" version="3.10.3" release="12.el10_2.8" epoch="2" arch="x86_64_v2" src="freerdp-3.10.3-12.el10_2.8.src.rpm">
          <filename>freerdp-3.10.3-12.el10_2.8.x86_64_v2.rpm</filename>
          <sum type="sha256">10d440b689bfca614616a858fe81fca53221b49709f7bcb8cdae418bbb3701a0</sum>
        </package>
        <package name="libwinpr" version="3.10.3" release="12.el10_2.8" epoch="2" arch="x86_64_v2" src="freerdp-3.10.3-12.el10_2.8.src.rpm">
          <filename>libwinpr-3.10.3-12.el10_2.8.x86_64_v2.rpm</filename>
          <sum type="sha256">e54bb73d25ea5dc566192397b2a99c71949301a47bbc17f247419c8d41b04c0d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:54512</id>
    <title>Moderate: gnome-remote-desktop security update</title>
    <issued date="2026-08-13 00:00:00"/>
    <updated date="2026-08-14 08:57:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>gnome-remote-desktop security update</summary>
    <description>GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.  

Security Fix(es):  

  * gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service (CVE-2026-18358)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:54512" id="RHSA-2026:54512" type="rhsa" title="RHSA-2026:54512"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-18358" id="CVE-2026-18358" type="cve" title="CVE-2026-18358"/>
      <reference href="https://bugzilla.redhat.com/2462876" id="2462876" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-54512.html" id="ALSA-2026:54512" type="self" title="ALSA-2026:54512"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gnome-remote-desktop" version="49.3" release="4.el10_2" epoch="0" arch="x86_64_v2" src="gnome-remote-desktop-49.3-4.el10_2.src.rpm">
          <filename>gnome-remote-desktop-49.3-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e8b38e84c51e4ce40ed30bb276827e88466ac1af9cd24f6134a7d74957cb82b6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:54541</id>
    <title>Important: .NET 8.0 security, bug fix, and enhancement update</title>
    <issued date="2026-08-13 00:00:00"/>
    <updated date="2026-08-14 13:46:51"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 8.0 security, bug fix, and enhancement update</summary>
    <description>.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 8.0.130  
Runtime version: 8.0.30  

Security Fix(es):  

  * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
  * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
  * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
  * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-10.2.z] (JIRA:AlmaLinux-235472)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:54541" id="RHSA-2026:54541" type="rhsa" title="RHSA-2026:54541"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62899" id="CVE-2026-62899" type="cve" title="CVE-2026-62899"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62900" id="CVE-2026-62900" type="cve" title="CVE-2026-62900"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62901" id="CVE-2026-62901" type="cve" title="CVE-2026-62901"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62909" id="CVE-2026-62909" type="cve" title="CVE-2026-62909"/>
      <reference href="https://bugzilla.redhat.com/2512175" id="2512175" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2512179" id="2512179" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2512180" id="2512180" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2512185" id="2512185" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-54541.html" id="ALSA-2026:54541" type="self" title="ALSA-2026:54541"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dotnet-sdk-8.0" version="8.0.130" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.130-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0f8e497573a998001cfe44c090afabbd1caa92cb42ae258859c52ef3dd674591</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" version="8.0.30" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.30-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">17588a3afb801d317e74dcaa85052b234c02f064e4806dc73f2bdace1cf2c807</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" version="8.0.130" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.130-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">28e7419355536c4f567d1756b2a2e0a3f1ff720475422326cefb675f3f377b7d</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" version="8.0.30" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.30-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">36aadd435481447bcf3b0974bf32cb29b2c53f724a97154f493f9a303ae758f3</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" version="8.0.30" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.30-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3ff56f493395049ad9c242fa9b71a35d4bdc2be253fcb27776d956552412a94d</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" version="8.0.30" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.30-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">84d1514499666812232c6abcfbda962b94a18af220b7de520b56152523d83d9c</sum>
        </package>
        <package name="dotnet-templates-8.0" version="8.0.130" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.130-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9bc87f9d7bfa854266aef1b605817f722a34bd57858f2de2f25b05101e1c7207</sum>
        </package>
        <package name="dotnet-runtime-8.0" version="8.0.30" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.30-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a31dde77266f6304a9fbb196fd93545d32f1fa1a181b40ce684efa1478e0dbcd</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" version="8.0.30" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.30-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ad0d49d7948d14242a15077f2e45f0070a16d711c8c9eaa44c58b4d1e1695ce6</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" version="8.0.30" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.30-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f6b8de9d880ee309e8b05a3e35069d73f812afbe1f68b5f7a232ba085524daf6</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" version="8.0.30" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.30-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f860100e992132646be3a15176ef3bef03002466b05fc4d168c0be8d3c7d0517</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:54576</id>
    <title>Important: dracut security update</title>
    <issued date="2026-08-13 00:00:00"/>
    <updated date="2026-08-14 08:55:39"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dracut security update</summary>
    <description>The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.  

Security Fix(es):  

  * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:54576" id="RHSA-2026:54576" type="rhsa" title="RHSA-2026:54576"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15816" id="CVE-2026-15816" type="cve" title="CVE-2026-15816"/>
      <reference href="https://bugzilla.redhat.com/2500889" id="2500889" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-54576.html" id="ALSA-2026:54576" type="self" title="ALSA-2026:54576"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dracut-caps" version="107" release="9.el10_2" epoch="0" arch="x86_64_v2" src="dracut-107-9.el10_2.src.rpm">
          <filename>dracut-caps-107-9.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5c1a700dc44a04055dec3c8ecabf28513f28aee13c48ec9c22b9e79ad5e13b8e</sum>
        </package>
        <package name="dracut-live" version="107" release="9.el10_2" epoch="0" arch="x86_64_v2" src="dracut-107-9.el10_2.src.rpm">
          <filename>dracut-live-107-9.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6ff7e323b6eefd6888207df2915d1341ba7144a9d2d26da06c77cf254629d3ae</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:54590</id>
    <title>Important: .NET 9.0 security, bug fix, and enhancement update</title>
    <issued date="2026-08-13 00:00:00"/>
    <updated date="2026-08-14 08:51:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 9.0 security, bug fix, and enhancement update</summary>
    <description>.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 9.0.120  
Runtime version: 9.0.19  

Security Fix(es):  

  * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
  * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
  * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
  * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-10.2.z] (JIRA:AlmaLinux-235477)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:54590" id="RHSA-2026:54590" type="rhsa" title="RHSA-2026:54590"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62899" id="CVE-2026-62899" type="cve" title="CVE-2026-62899"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62900" id="CVE-2026-62900" type="cve" title="CVE-2026-62900"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62901" id="CVE-2026-62901" type="cve" title="CVE-2026-62901"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62909" id="CVE-2026-62909" type="cve" title="CVE-2026-62909"/>
      <reference href="https://bugzilla.redhat.com/2512175" id="2512175" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2512179" id="2512179" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2512180" id="2512180" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2512185" id="2512185" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-54590.html" id="ALSA-2026:54590" type="self" title="ALSA-2026:54590"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="dotnet-apphost-pack-9.0" version="9.0.19" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.19-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">200979506e5d861b1e10e064085576e73a7bdae7e119c8dce2d706e7638e1ffd</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" version="9.0.120" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.120-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2852cfafb1cc6b0de5598a3afd6c21c5082a1ce3c76226c5946b9c2b7a80b95d</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" version="9.0.120" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.120-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">462309574177d65426996ee518964948cbcc28afdaaab9f489e801f5a005091c</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" version="9.0.19" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.19-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4c222f8dd142ee7502f9be9cf153ad5489c8d1d87fde7aa927389016281cf2da</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" version="9.0.19" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.19-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">60af7b9d8bbc689987b1439a4c2111036a25201447efd11c646ccca7dd1c89d8</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" version="9.0.19" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.19-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6fa167235def586b335033c6263e0dbec99200a8129860a3cce397280e250e04</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" version="9.0.19" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.19-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7feb712424edda5529f861cebfb8cd6ac9844ffdb3048a2575f4b267b70814f1</sum>
        </package>
        <package name="dotnet-runtime-9.0" version="9.0.19" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.19-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8a4ded8d22449715374a75f02f5947d9ecdd842eba9c189308765fc0db602190</sum>
        </package>
        <package name="dotnet-sdk-9.0" version="9.0.120" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.120-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a534e36f13eea76baf244db154170d07ef9980c00fc5fb21c27963c23cebd3d1</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" version="9.0.19" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.19-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b3c0207b79674ed4a2d9aba2683c4d61d589ae003e641a3db4b9604e46c7999e</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" version="9.0.19" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.19-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cef07f76b4e688d12bae5e16d157c42006e6ece8f08e7843225589df7a8a21f7</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" version="9.0.120" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.120-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d3c478c3d375580b36ded0ba1efe91639daceeaad2d86be04b845205446af1aa</sum>
        </package>
        <package name="dotnet-templates-9.0" version="9.0.120" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.120-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">da99db32e8ea57334fb4f9bda52b8735cf315de464366c5d937dca894e69024c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:54650</id>
    <title>Moderate: nghttp2 security update</title>
    <issued date="2026-08-13 00:00:00"/>
    <updated date="2026-08-14 08:48:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>nghttp2 security update</summary>
    <description>libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.  

Security Fix(es):  

  * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:54650" id="RHSA-2026:54650" type="rhsa" title="RHSA-2026:54650"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58055" id="CVE-2026-58055" type="cve" title="CVE-2026-58055"/>
      <reference href="https://bugzilla.redhat.com/2493954" id="2493954" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-54650.html" id="ALSA-2026:54650" type="self" title="ALSA-2026:54650"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libnghttp2-devel" version="1.68.0" release="3.el10_2.2" epoch="0" arch="x86_64_v2" src="nghttp2-1.68.0-3.el10_2.2.src.rpm">
          <filename>libnghttp2-devel-1.68.0-3.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">ffb6f60b73a88fd960bf5e43fec8113b43305b56bc249bbf5b8ce562336b2778</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55424</id>
    <title>Important: 389-ds-base security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:58:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>389-ds-base security update</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.  

Security Fix(es):  

  * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770)
  * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788)
  * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55424" id="RHSA-2026:55424" type="rhsa" title="RHSA-2026:55424"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11770" id="CVE-2026-11770" type="cve" title="CVE-2026-11770"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11788" id="CVE-2026-11788" type="cve" title="CVE-2026-11788"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15722" id="CVE-2026-15722" type="cve" title="CVE-2026-15722"/>
      <reference href="https://bugzilla.redhat.com/2484802" id="2484802" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485423" id="2485423" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2499961" id="2499961" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55424.html" id="ALSA-2026:55424" type="self" title="ALSA-2026:55424"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="389-ds-base-snmp" version="3.2.0" release="9.el10_2" epoch="0" arch="x86_64_v2" src="389-ds-base-3.2.0-9.el10_2.src.rpm">
          <filename>389-ds-base-snmp-3.2.0-9.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">115cd522eb964d0f493910cc0dd5587dba6e471945baf3c8c1dd9b0542ec2346</sum>
        </package>
        <package name="python3-lib389" version="3.2.0" release="9.el10_2" epoch="0" arch="noarch" src="389-ds-base-3.2.0-9.el10_2.src.rpm">
          <filename>python3-lib389-3.2.0-9.el10_2.noarch.rpm</filename>
          <sum type="sha256">27cf3e06e99257f4c51c72088b1f9e5f48d590b294e516768385c0f484ac53a2</sum>
        </package>
        <package name="389-ds-base" version="3.2.0" release="9.el10_2" epoch="0" arch="x86_64_v2" src="389-ds-base-3.2.0-9.el10_2.src.rpm">
          <filename>389-ds-base-3.2.0-9.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b889759e1f8d5ef1528619138f5dae6348802a208ceb8f8eca0704a60b9e665e</sum>
        </package>
        <package name="389-ds-base-libs" version="3.2.0" release="9.el10_2" epoch="0" arch="x86_64_v2" src="389-ds-base-3.2.0-9.el10_2.src.rpm">
          <filename>389-ds-base-libs-3.2.0-9.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bf02666432177b282009d7e4b6648e2477416a048465552a82610f8a8350bd6b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55432</id>
    <title>Important: curl security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:57:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>curl security update</summary>
    <description>The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  

Security Fix(es):  

  * curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55432" id="RHSA-2026:55432" type="rhsa" title="RHSA-2026:55432"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8927" id="CVE-2026-8927" type="cve" title="CVE-2026-8927"/>
      <reference href="https://bugzilla.redhat.com/2496769" id="2496769" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55432.html" id="ALSA-2026:55432" type="self" title="ALSA-2026:55432"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libcurl-devel" version="8.12.1" release="4.el10_2.4" epoch="0" arch="x86_64_v2" src="curl-8.12.1-4.el10_2.4.src.rpm">
          <filename>libcurl-devel-8.12.1-4.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">6b00a1f78b84ad5c1f3edfe972e2cfa1f7ae4c18e6406a15f59d6e2b574b30ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55433</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:59:47"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-bad-free security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  

Security Fix(es):  

  * gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55433" id="RHSA-2026:55433" type="rhsa" title="RHSA-2026:55433"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-19387" id="CVE-2026-19387" type="cve" title="CVE-2026-19387"/>
      <reference href="https://bugzilla.redhat.com/2513015" id="2513015" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55433.html" id="ALSA-2026:55433" type="self" title="ALSA-2026:55433"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-bad-free-libs" version="1.26.7" release="2.el10_2.7" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">18d6f7bb62222a97c63ce08d04dbff283ef89ac1b582cbe7f501164dde80fffa</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" version="1.26.7" release="2.el10_2.7" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">8d3ce15ca3055c2271ddcd624cb448be79c61fe09a4a05c9df232321d70d4f1d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55434</id>
    <title>Moderate: gstreamer1-plugins-good security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:57:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>gstreamer1-plugins-good security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  

Security Fix(es):  

  * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)
  * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55434" id="RHSA-2026:55434" type="rhsa" title="RHSA-2026:55434"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-73433" id="CVE-2026-73433" type="cve" title="CVE-2026-73433"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-73434" id="CVE-2026-73434" type="cve" title="CVE-2026-73434"/>
      <reference href="https://bugzilla.redhat.com/2514801" id="2514801" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2514807" id="2514807" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55434.html" id="ALSA-2026:55434" type="self" title="ALSA-2026:55434"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-good" version="1.26.7" release="2.el10_2.5" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.5.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">00c3bfd4685ae9e7fceea6d2dd9848d68719acce2956c6899f7ab06a2cbfd7cc</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" version="1.26.7" release="2.el10_2.5" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.5.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.5.x86_64_v2.rpm</filename>
          <sum type="sha256">8dd8046fa825088d8513f2886b8d582a41e6c4db7f7bebb2671ff85a44c07ac6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55435</id>
    <title>Important: gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:57:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-ugly-free security update</summary>
    <description>GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.  

Security Fix(es):  

  * gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55435" id="RHSA-2026:55435" type="rhsa" title="RHSA-2026:55435"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-19389" id="CVE-2026-19389" type="cve" title="CVE-2026-19389"/>
      <reference href="https://bugzilla.redhat.com/2513016" id="2513016" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55435.html" id="ALSA-2026:55435" type="self" title="ALSA-2026:55435"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-ugly-free" version="1.26.7" release="2.el10_2.2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.2.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">f1f3c129ff1616f85e7b241a3ed92b06e4c061c66e3a5a401e9b9558b05421d8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55437</id>
    <title>Important: bind security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:56:46"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>bind security update</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  

Security Fix(es):  

  * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
  * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
  * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)
  * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
  * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
  * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55437" id="RHSA-2026:55437" type="rhsa" title="RHSA-2026:55437"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10723" id="CVE-2026-10723" type="cve" title="CVE-2026-10723"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11331" id="CVE-2026-11331" type="cve" title="CVE-2026-11331"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11622" id="CVE-2026-11622" type="cve" title="CVE-2026-11622"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11721" id="CVE-2026-11721" type="cve" title="CVE-2026-11721"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13204" id="CVE-2026-13204" type="cve" title="CVE-2026-13204"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13321" id="CVE-2026-13321" type="cve" title="CVE-2026-13321"/>
      <reference href="https://bugzilla.redhat.com/2503721" id="2503721" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504166" id="2504166" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504298" id="2504298" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504338" id="2504338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504447" id="2504447" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504560" id="2504560" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55437.html" id="ALSA-2026:55437" type="self" title="ALSA-2026:55437"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="bind" version="9.18.33" release="15.el10_2.10" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-9.18.33-15.el10_2.10.x86_64_v2.rpm</filename>
          <sum type="sha256">4a1d79869711ae51b9ae95c2e3d17b222f76915ed16121af31d47dd1de20e8f6</sum>
        </package>
        <package name="bind-dnssec-utils" version="9.18.33" release="15.el10_2.10" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-15.el10_2.10.x86_64_v2.rpm</filename>
          <sum type="sha256">685abd266ec002e7fff8febe21204b66e7861beef11eaa14440cd17a239778e2</sum>
        </package>
        <package name="bind-chroot" version="9.18.33" release="15.el10_2.10" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-chroot-9.18.33-15.el10_2.10.x86_64_v2.rpm</filename>
          <sum type="sha256">96865d990dd12f80d93bf63663a5612bab8a14a0cf1fdb976144c600322512c6</sum>
        </package>
        <package name="bind-utils" version="9.18.33" release="15.el10_2.10" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-utils-9.18.33-15.el10_2.10.x86_64_v2.rpm</filename>
          <sum type="sha256">9ecc585a8ac59230087d7fcc71647e0bb48be3cfe777bcd6c005471d84258973</sum>
        </package>
        <package name="bind-libs" version="9.18.33" release="15.el10_2.10" epoch="32" arch="x86_64_v2" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-libs-9.18.33-15.el10_2.10.x86_64_v2.rpm</filename>
          <sum type="sha256">e000fd62c4e1ec48610291e2b6c4ee431111dffd82143565a50c84859c6a9c64</sum>
        </package>
        <package name="bind-license" version="9.18.33" release="15.el10_2.10" epoch="32" arch="noarch" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-license-9.18.33-15.el10_2.10.noarch.rpm</filename>
          <sum type="sha256">e7269f3a04d0f19af0b01cb87ae997a2d63f8b901c3fbbbd06b2be1ac756d519</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55448</id>
    <title>Important: libXfont2 security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:55:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libXfont2 security update</summary>
    <description>X.Org X11 libXfont2 runtime library  

Security Fix(es):  

  * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)
  * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55448" id="RHSA-2026:55448" type="rhsa" title="RHSA-2026:55448"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44950" id="CVE-2026-44950" type="cve" title="CVE-2026-44950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59679" id="CVE-2026-59679" type="cve" title="CVE-2026-59679"/>
      <reference href="https://bugzilla.redhat.com/2509620" id="2509620" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2509622" id="2509622" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55448.html" id="ALSA-2026:55448" type="self" title="ALSA-2026:55448"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libXfont2" version="2.0.6" release="5.el10_2.3" epoch="0" arch="x86_64_v2" src="libXfont2-2.0.6-5.el10_2.3.src.rpm">
          <filename>libXfont2-2.0.6-5.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">ff92cf9c72cab7affa2e52de3fd5f3919573b64ca849fba2c32457c0949e24e2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55541</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 11:35:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs22 security update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.  

Security Fix(es):  

  * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55541" id="RHSA-2026:55541" type="rhsa" title="RHSA-2026:55541"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14257" id="CVE-2026-14257" type="cve" title="CVE-2026-14257"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-69152" id="CVE-2026-69152" type="cve" title="CVE-2026-69152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-69192" id="CVE-2026-69192" type="cve" title="CVE-2026-69192"/>
      <reference href="https://bugzilla.redhat.com/2506433" id="2506433" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510722" id="2510722" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510801" id="2510801" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55541.html" id="ALSA-2026:55541" type="self" title="ALSA-2026:55541"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs" version="22.23.1" release="6.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-22.23.1-6.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1d81480579b1d97b87baed29114425b3d4063d304eae795c88c787e9f333e5c1</sum>
        </package>
        <package name="nodejs-devel" version="22.23.1" release="6.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-devel-22.23.1-6.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">20e7d0b162e1705cef23eb08b0595d5aa499ca3b47446aa5ade00575fa19eaab</sum>
        </package>
        <package name="nodejs-full-i18n" version="22.23.1" release="6.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-full-i18n-22.23.1-6.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">32a5a1c0b0a211874bfa51d4ba4383cdd3c617c5dd2aa429b22886aee3efcf9d</sum>
        </package>
        <package name="nodejs-npm" version="10.9.8" release="1.22.23.1.6.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-npm-10.9.8-1.22.23.1.6.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8681340e29bdc0982accc334dd523c61391e518ed1450a93c4efbe98f823ed0e</sum>
        </package>
        <package name="nodejs-docs" version="22.23.1" release="6.el10_2" epoch="1" arch="noarch" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-6.el10_2.noarch.rpm</filename>
          <sum type="sha256">a4cf7db461223295f0f82718617815510079e00e6e5e5f79921d8490e5169df3</sum>
        </package>
        <package name="nodejs-libs" version="22.23.1" release="6.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-libs-22.23.1-6.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fb8cf43a2a9123b2cd4a3dabc06cc42e0988ad6422dd8b47711e57b8d99c3c32</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55617</id>
    <title>Important: pcp security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-19 12:23:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>pcp security update</summary>
    <description>Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.  

Security Fix(es):  

  * PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524)
  * PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526)
  * PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527)
  * PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55617" id="RHSA-2026:55617" type="rhsa" title="RHSA-2026:55617"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16524" id="CVE-2026-16524" type="cve" title="CVE-2026-16524"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16526" id="CVE-2026-16526" type="cve" title="CVE-2026-16526"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16527" id="CVE-2026-16527" type="cve" title="CVE-2026-16527"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16529" id="CVE-2026-16529" type="cve" title="CVE-2026-16529"/>
      <reference href="https://bugzilla.redhat.com/2506023" id="2506023" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2506026" id="2506026" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2506031" id="2506031" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2506032" id="2506032" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55617.html" id="ALSA-2026:55617" type="self" title="ALSA-2026:55617"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="pcp-pmda-bcc" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bcc-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">07852c364becd0e8c3725e6519661f8eac61a6ba16fdd5adebd9675d0ad04b79</sum>
        </package>
        <package name="pcp-export-pcp2openmetrics" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2openmetrics-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">07f39611b76b10c9e4f031a2024ea687723e1c4bdd30acbfe95c1a4c6a00112f</sum>
        </package>
        <package name="pcp-pmda-opentelemetry" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-opentelemetry-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">09bba7e5b41c6fbcae66f3ac7120a44755aaaa9ce50a72d4ed55c4d9411e1dac</sum>
        </package>
        <package name="pcp-pmda-infiniband" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-infiniband-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0df9a0e0ca3a14c6f7524a853cc64f98b755a1e7f88ab4f7038883cf8e8be317</sum>
        </package>
        <package name="pcp-pmda-bpf" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bpf-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0e8691e9fdc5e980a388bc422ea6acdce24e2d7f6171351e0304711d199cb1b6</sum>
        </package>
        <package name="pcp-pmda-pdns" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-pdns-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0ffc1ccc8f6960e7fb7bf1f2b5f2b100810964dacac92a62e7455f968ac180e1</sum>
        </package>
        <package name="pcp-pmda-netfilter" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-netfilter-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">121f0b5ee80f80d6ec89ef307bdada3929ce479f9e6157d5363a0a373a1253de</sum>
        </package>
        <package name="pcp-export-pcp2xml" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2xml-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">18348da1f800df4b73aba478c4e26ae17da9e8f445e26ebf20bc3225e15fabfd</sum>
        </package>
        <package name="pcp-pmda-hdb" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-hdb-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1a94808675a931bed6bf7fa459214b230d3b0f93472f9b3d206aadf196454a6c</sum>
        </package>
        <package name="pcp-import-pmseries" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-pmseries-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1b642e29cb832e72b53709dad848ca2b3ddcb30cbab6de21931dbfc23e0a8215</sum>
        </package>
        <package name="pcp-pmda-podman" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-podman-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1ca436c94471d3ddbd8c075f92f73e7f8cea28ea3e2d75c0c4c047b34b1577a7</sum>
        </package>
        <package name="pcp-pmda-zimbra" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-zimbra-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1d42c964d2ea9c95c4d0f63e75a6be64f00991e3f67c68e2985eda1fa2cf98f1</sum>
        </package>
        <package name="pcp-pmda-trace" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-trace-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1d458fd2fbffa85038ef8415856a9457806618c9c26e84aed70a537c08df9fab</sum>
        </package>
        <package name="pcp-export-pcp2json" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2json-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1f62a5790714ac2f4dd70e2866ece8ca85b5e4765d5239740a784bd74c4d6116</sum>
        </package>
        <package name="pcp-pmda-sendmail" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-sendmail-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">22dcc09790a81deb164efca38e3138344f85fc7b852ad52ce0732e96c90aea58</sum>
        </package>
        <package name="pcp-pmda-systemd" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-systemd-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">236ab82543995affac36a52ae204551829b8d55ccf4bb1debb38c507e67bcd6d</sum>
        </package>
        <package name="pcp-pmda-redis" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-redis-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">23b4d533c370e8e9ab2c891d32f7fa4fbd8b16cc6fb1ba0b890262868298164b</sum>
        </package>
        <package name="pcp-pmda-nvidia-gpu" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-nvidia-gpu-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">27e1987e8a2c84379956f182a4bffe9dbee6adc8e49155029c783ea1b2698893</sum>
        </package>
        <package name="pcp-pmda-bind2" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bind2-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2cdbbdd5b6caa17bf2b40de67f231a2f2329a9c25cce83b97be7e195fde3a279</sum>
        </package>
        <package name="pcp-pmda-nfsclient" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-nfsclient-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2f8f244e52574acf0a2ba595e92a28a8dfb58fa261f6bf94ce7e2f3d1aec72ea</sum>
        </package>
        <package name="pcp-export-pcp2opentelemetry" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2opentelemetry-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3092766ce6f4cbb58ff8ee213caa8a160f5426243aa18b34c45e9a0f24b87cc3</sum>
        </package>
        <package name="perl-PCP-LogSummary" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>perl-PCP-LogSummary-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">36354f6a2f8e9ba6a41179bb4b8537d7c53ca8e6db818ee095dda191e1271178</sum>
        </package>
        <package name="pcp-pmda-perfevent" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-perfevent-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3654a3e9d57d7b8e81fb1ce8c0fda3eea6da03760b98bc3c132c4747e571bfe5</sum>
        </package>
        <package name="pcp-pmda-nginx" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-nginx-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">36838fe0157d981f75b0310aa6f8aeac1374bfcb0232106045750a081d269c78</sum>
        </package>
        <package name="pcp-pmda-openmetrics" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-openmetrics-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">373ebeda3f2f74a223410d55d7bb1faf082de87192e334fb3c50dd688943d714</sum>
        </package>
        <package name="pcp-pmda-cisco" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-cisco-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">37f2b9a998a3d263944868585c2b80b111e80fed9bfd97aa9e2fd19f99a79903</sum>
        </package>
        <package name="pcp-pmda-lustre" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-lustre-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3da4d4165a39d433ba52321f410762f2da6c2fd9d26fafe95a2af50d6a25aea4</sum>
        </package>
        <package name="pcp-pmda-amdgpu" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-amdgpu-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3e56bd302ecead6e4e6b80a17ffe3eff8a8e80b053d396d9a37b808d0d9245d8</sum>
        </package>
        <package name="pcp-pmda-statsd" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-statsd-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3edd3c88ce3829fe20693eb0c1c7706b25d609cef2cfebd8db40b49189154089</sum>
        </package>
        <package name="pcp-import-ganglia2pcp" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-ganglia2pcp-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3f4161b073ef83432c55aec48efcdafb6447b49128e674f4c042d71dad8f1928</sum>
        </package>
        <package name="pcp-import-mrtg2pcp" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-mrtg2pcp-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">413b46f70df91bfec8351baa4ef94ee57a00accf1351665f37eb1eb6e19e62a9</sum>
        </package>
        <package name="pcp-pmda-denki" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-denki-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">43dcd8a23226ecec7221dc12425e59565eb1fd6f3105537add0a7b07cf49450d</sum>
        </package>
        <package name="pcp-export-zabbix-agent" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-zabbix-agent-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">44c85d6e5910a63521c7d81f3d903dd7a6143f8dfafb2e94314ad2b109eaa672</sum>
        </package>
        <package name="pcp-export-pcp2graphite" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2graphite-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4674fc787e44bcc5ef0a7a55ac922e8eded05f4ebc5f1aff85e4b5c8ff01e535</sum>
        </package>
        <package name="pcp-system-tools" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-system-tools-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">46e35b6b0a1d80afa3923fa289bcdc820dc34e80373acaef9a3fd73c9bf89150</sum>
        </package>
        <package name="pcp-export-pcp2elasticsearch" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2elasticsearch-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4cc8060a6f2ee9931e60baee05ec9fa3924f30a3e12b7e023826c1e513f22333</sum>
        </package>
        <package name="pcp-pmda-memcache" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-memcache-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">521cde8e9314361b84508b95b74a8c6f0acb06f040553e2d8560fb093bc1bf02</sum>
        </package>
        <package name="pcp-libs" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-libs-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">57e51adb943ad80363e0418a8c0100dfda1eb705cebdf93f2dcb43dbb8c6b934</sum>
        </package>
        <package name="pcp-pmda-smart" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-smart-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">580dc024a6cffbc6d3acd56bd485cd8b8d7575b550d4fb47e9076d4d59bb67b5</sum>
        </package>
        <package name="pcp-pmda-sockets" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-sockets-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">59c5dbc0b00a7ca04f98c309fef39b5cf60b53d20285ff65a74543f5df3cf412</sum>
        </package>
        <package name="pcp-pmda-shping" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-shping-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5cc264933c5ad46f0f29d075916557d6d0a9eff76e6ba9b636eb6bbd73e745b3</sum>
        </package>
        <package name="pcp-export-pcp2spark" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2spark-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">60f969a71855ec3a729d6491a134595028106a3b199f7ac369b8cec159a874dc</sum>
        </package>
        <package name="pcp-pmda-netcheck" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-netcheck-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6182d4de8801c697f811853cc427a5560bbd8d5b31b56be8452fa14f71e7b424</sum>
        </package>
        <package name="python3-pcp" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>python3-pcp-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">61bf5cb44ee6272130dc8c28bf305cbfae7d171130978e7340afb4bc96231270</sum>
        </package>
        <package name="pcp-pmda-mic" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mic-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">62fa872b764f299befcbce1bcf9c68939b7e7c9b87563228406394ea6dff2404</sum>
        </package>
        <package name="pcp-pmda-slurm" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-slurm-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6827f517ec6331f4a81647ac38c4fcf980ae44a04b33aa47fcfbddfce273783d</sum>
        </package>
        <package name="pcp-pmda-named" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-named-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6a5284425a5cb10ee0c2368614ba9a1d5194263c72cbf465f39f63258afa3319</sum>
        </package>
        <package name="pcp-pmda-mysql" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mysql-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6c0bc54f8f2fb49410175b815d28f224d4c252f118da2453544f2202c6eca679</sum>
        </package>
        <package name="pcp-pmda-uwsgi" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-uwsgi-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6e8001c38eeb653d8b89face64ac52e323c285715c45be72562ae17bd4eccac7</sum>
        </package>
        <package name="pcp-pmda-ds389log" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-ds389log-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6f503670bd6a789246cc9bd6d9073a1ef704420e887ebcf46d32b56061df9eb6</sum>
        </package>
        <package name="pcp-export-pcp2influxdb" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2influxdb-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6ff6b5195069e83120504c1c7c9cb5958c251654058dd2722eecec4befea18ac</sum>
        </package>
        <package name="pcp-pmda-summary" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-summary-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">730ac9d13135b230d424b1d2fb5e61d5205bfd870e8c0982ecdf41511e972b49</sum>
        </package>
        <package name="pcp-pmda-mongodb" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mongodb-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7419a8a7d31a216917f356338348f7fa9216119d4a09eda51067870afd06cc89</sum>
        </package>
        <package name="pcp-pmda-docker" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-docker-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7b6d5e5f5130a51ee4c1aaab1630cbd09e5fee5d27bd90715d7e29e9bdf870c0</sum>
        </package>
        <package name="pcp-pmda-resctrl" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-resctrl-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7c31c893d2997688649cdaef3ab1c53be6e9a1692405b5b21ad4f12e754733bf</sum>
        </package>
        <package name="pcp-pmda-apache" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-apache-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7efa39157a6ed5873194a6c5ad2807e75d0b8befe16e1e32a6c5311b4851efd8</sum>
        </package>
        <package name="pcp-pmda-news" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-news-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">82c5b9f9097c0b5386d261c430ed1ee460527891bee69111e0a302dd61bc5773</sum>
        </package>
        <package name="pcp-pmda-roomtemp" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-roomtemp-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">837220193c551105806cc79a22a548886c26aea4ab72c7a76026b2d5fb9f27c8</sum>
        </package>
        <package name="pcp-pmda-lio" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-lio-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">841b5591a7a090abbb39c3b0973b5b1951a4ede36c5de1af5a6aaebf37c21da5</sum>
        </package>
        <package name="pcp-pmda-oracle" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-oracle-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">880adf4cfef0b015243c0fe1f5b57ec5dec5bb319947a32c129b475882573eb5</sum>
        </package>
        <package name="pcp-pmda-elasticsearch" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-elasticsearch-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8afa49fb1fb286845de33fa02fccd9dcb02062d664daf95e4ca56d3eb2af0efd</sum>
        </package>
        <package name="pcp-import-benchmarks" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-benchmarks-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8b5513a746677404a2b7880f5101dac851a7f673c1850d3b51d4f185595724f5</sum>
        </package>
        <package name="pcp-pmda-haproxy" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-haproxy-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8e9988b8b8311e9880cdd992bce02b4d826477c3eded69477dadb11d8208775f</sum>
        </package>
        <package name="perl-PCP-MMV" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>perl-PCP-MMV-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8f2b38284dfefd21602ad0a5f6ee828a6af3e9662fcbd6ece3e1ac17cef9ab11</sum>
        </package>
        <package name="pcp-pmda-lustrecomm" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-lustrecomm-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">918bf1ec5fdc73f008ddae04797c14e7c165a70af8e4ec3768f2251238d728af</sum>
        </package>
        <package name="pcp-pmda-libvirt" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-libvirt-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9416a4d7b9e147c941bf28ca97a48ea8831e98a9bbd5426be7af6b61f825e6ef</sum>
        </package>
        <package name="pcp-doc" version="7.0.3" release="5.el10_2" epoch="0" arch="noarch" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-doc-7.0.3-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">94a7dc3f75afab71ce735dd038541108a4e6b18e03790db4d1e46bbc272ecb1d</sum>
        </package>
        <package name="pcp-export-pcp2zabbix" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2zabbix-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9807ad22cb0564efec8ef3861d67a675747ff0a9e022dca75c400269a81a0706</sum>
        </package>
        <package name="pcp-pmda-bash" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bash-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">98ac55855f1ad23b9f7356a3bb230b756b01287a57f7f4ef3e1c8238aed9cfaa</sum>
        </package>
        <package name="perl-PCP-LogImport" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>perl-PCP-LogImport-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9a045d9cec93e03ce1dc20123f4dfff89570d6fac172a8ed9104b13654e27a59</sum>
        </package>
        <package name="pcp-pmda-hacluster" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-hacluster-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9b4f4ccc86d459cdbca55105def55528d97dcc5b6af3625c13bc32dcfa360e69</sum>
        </package>
        <package name="pcp-pmda-samba" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-samba-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9e412d816dad9b19e03364ca9551a4f9b307cd28b0eced7e73cc33074e750ddd</sum>
        </package>
        <package name="pcp-pmda-cifs" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-cifs-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9e5255b8f0e0657b6de4493f624cf654c3e2ef89d8b0b4ef3392ce92fa42ec41</sum>
        </package>
        <package name="pcp-selinux" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-selinux-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9fc3fe9b1a14e5487d65c827a3d98f079b9248e63b9f94dee52ac36aeee7a6a1</sum>
        </package>
        <package name="pcp-pmda-unbound" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-unbound-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a0482304647021621d271a2d75c793a84b8286602544bb15622f25acf0373c5a</sum>
        </package>
        <package name="pcp-pmda-gluster" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-gluster-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a22e376f6460e93866b95b1eb63f7843918bec1be19a268f8281e41c28ad8293</sum>
        </package>
        <package name="pcp-pmda-postfix" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-postfix-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a304fe93cb5e9144fcc2d550b93e67e772d47ab215974f3ab4937428fd51e776</sum>
        </package>
        <package name="pcp-pmda-dbping" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-dbping-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a48f42d249818c50aae3f34045705246ed54103cd1e83a7f21892c64d768bba3</sum>
        </package>
        <package name="pcp-pmda-gpfs" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-gpfs-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a6e18ed7b8278bf66a92556077aed3a7b820bdea9624d2cc53c109aecfdeafca</sum>
        </package>
        <package name="pcp-pmda-mounts" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mounts-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a6f68ee4e626d50df5cba677d5245ddb2be679e801e410f3d75d107afd99da9e</sum>
        </package>
        <package name="pcp-zeroconf" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-zeroconf-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a8faa22eb019df7d20298d5d4254c349847f39acf4d755062c7f605bb010ca83</sum>
        </package>
        <package name="pcp-pmda-ds389" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-ds389-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ad7ce2d663e7be9d3c0537355a3b616b07b7666290de1c581091f0a9b2be5f25</sum>
        </package>
        <package name="pcp-gui" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-gui-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">aee72f654569b67041d04cb4b46141529bac2765c735bdcf859460e138a1599d</sum>
        </package>
        <package name="pcp-conf" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-conf-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b331ae3ad1899cc2ffcd60756f4dac17ee44279ea530d45a7a1196dadf43b00a</sum>
        </package>
        <package name="pcp-pmda-mssql" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mssql-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b64c645d431aeb0fc0f5e56848344b1adbff80eed56b6de55d47804eccad6ff7</sum>
        </package>
        <package name="pcp-pmda-bpftrace" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bpftrace-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bc4d6c115cd597b3653724d6dfabce98ea8145a74bd0a7d91437d2ac1c174870</sum>
        </package>
        <package name="pcp-import-iostat2pcp" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-iostat2pcp-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c00369d1c5cf25f0a981eba7c18fef86d1034043df3f82fcec24afaebd7e0ee6</sum>
        </package>
        <package name="pcp-pmda-activemq" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-activemq-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c0a9f29e4ca09b7173b8e2f5dd97eb676a3c6483f9706c245d756be95f74f99e</sum>
        </package>
        <package name="pcp-pmda-logger" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-logger-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c550a72bda0e8b53ca291f1d20121364732ff1abea25bb7b09e8251fa0b1f5bc</sum>
        </package>
        <package name="pcp-pmda-lmsensors" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-lmsensors-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cb84d807725d931315579326453bcf85e9e8b5160b3066a666baa35d876dba69</sum>
        </package>
        <package name="pcp-geolocate" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-geolocate-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ceb095165157ba9c29881feb966aea082e5690442f54140eeb5fed074ccfb8f4</sum>
        </package>
        <package name="pcp-pmda-openvswitch" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-openvswitch-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d359ed158982720fae6f41cc85f620c59761b67bcd6a80fdbc33a484bd7c8ed7</sum>
        </package>
        <package name="perl-PCP-PMDA" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>perl-PCP-PMDA-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d3eb4d51f4e6c826a39484eed276da687acb9fdc0b0f4261b35daff9e9df3e12</sum>
        </package>
        <package name="pcp-import-collectl2pcp" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-collectl2pcp-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d5fb9a574f7c8aecc963fc764aded367faacabf3b40de78350f6e825e3792dea</sum>
        </package>
        <package name="pcp-pmda-bonding" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bonding-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d960510d7ed45c1d36536a8a981a4429be4183e31412fdf81de5ccc54d6169c0</sum>
        </package>
        <package name="pcp-import-sar2pcp" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-sar2pcp-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">da55c9fa362b18e9695ee1e0e922edda755b5a051fde0a4ce8a20ac5792f9db4</sum>
        </package>
        <package name="pcp-pmda-rocestat" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-rocestat-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dc6700fad6d31b18f7dd6c3b56359929a8bdaffe252448337be308f70afffff8</sum>
        </package>
        <package name="pcp-pmda-gpsd" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-gpsd-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dd4410a9dc690b200f12396da68904cb4172d08c73e527f0b117f84f4ca418ab</sum>
        </package>
        <package name="pcp-pmda-rsyslog" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-rsyslog-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">df54c14315eac0c0af3cd6561e29a852a8dad37774cf98a01465cce83d61af95</sum>
        </package>
        <package name="pcp" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e9e2024b084ffa3f6a58adb215969bbe2ba14bd93926cd24b4569e4950d62741</sum>
        </package>
        <package name="pcp-pmda-dm" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-dm-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ecd02a682013895f0512486707b5aa89f20f15bee6f62a8121be6573d54a37ac</sum>
        </package>
        <package name="pcp-devel" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-devel-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">eeb44b2b7012e1b12d1294a4c12e2cda102b959d10d16e333363b33cae62e214</sum>
        </package>
        <package name="pcp-pmda-farm" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-farm-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f19e15adeccacb5de78c6061ebdf137fbb80d7615514b02fc615758c70e114af</sum>
        </package>
        <package name="pcp-pmda-snmp" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-snmp-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f4112a791e120b6d62cc4d36d86758c51ffd7c0a8a764b0d67927ca006d7d059</sum>
        </package>
        <package name="pcp-pmda-postgresql" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-postgresql-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f49e7922c19d97e372e3d2f16a3f4e799c78c868ee556100c4cd1e0beed6663b</sum>
        </package>
        <package name="pcp-pmda-weblog" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-weblog-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f62e334264ae3c068d7f9d7b741e2fc6948efc62f1dd9311ecf5876d679934da</sum>
        </package>
        <package name="pcp-pmda-zswap" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-zswap-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fac74d59832e6ea125371cb27273387828eae3b8109731f2dc7987f8ce82a3b0</sum>
        </package>
        <package name="pcp-libs-devel" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-libs-devel-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fc87d1711c6cc09ad5c2aefd9286b47178d9c3a561be63b4bf4aaea5f868c551</sum>
        </package>
        <package name="pcp-pmda-mailq" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mailq-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fd3a6503f116bbac74b47bcf1bae53823a13ba9e314351da3c67a00a79d553a6</sum>
        </package>
        <package name="pcp-pmda-rabbitmq" version="7.0.3" release="5.el10_2" epoch="0" arch="x86_64_v2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-rabbitmq-7.0.3-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fe9737044af32ed0db8d9783cf4c088c6ff4ad1800eacd3dae6847fce652c351</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55679</id>
    <title>Important: haproxy security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:55:00"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>haproxy security update</summary>
    <description>The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.  

Security Fix(es):  

  * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)
  * haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55679" id="RHSA-2026:55679" type="rhsa" title="RHSA-2026:55679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-55203" id="CVE-2026-55203" type="cve" title="CVE-2026-55203"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-55204" id="CVE-2026-55204" type="cve" title="CVE-2026-55204"/>
      <reference href="https://bugzilla.redhat.com/2490518" id="2490518" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490522" id="2490522" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55679.html" id="ALSA-2026:55679" type="self" title="ALSA-2026:55679"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="haproxy" version="3.0.5" release="6.el10_2.2" epoch="0" arch="x86_64_v2" src="haproxy-3.0.5-6.el10_2.2.src.rpm">
          <filename>haproxy-3.0.5-6.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">c6b86236d5a68f5b208e9b5ee8ffd65cc181a06b527ab4e477076b9cfd2c6612</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55787</id>
    <title>Moderate: java-21-openjdk security update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-21 12:52:53"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>java-21-openjdk security update</summary>
    <description>The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.  

Security Fix(es):  

  * JDK: Improve Resource Resolving (CVE-2026-60589)
  * JDK: Enhance HTTP Connections (CVE-2026-61308)
  * JDK: Enhance TLS server (CVE-2026-70907)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55787" id="RHSA-2026:55787" type="rhsa" title="RHSA-2026:55787"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60589" id="CVE-2026-60589" type="cve" title="CVE-2026-60589"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61308" id="CVE-2026-61308" type="cve" title="CVE-2026-61308"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-70907" id="CVE-2026-70907" type="cve" title="CVE-2026-70907"/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55787.html" id="ALSA-2026:55787" type="self" title="ALSA-2026:55787"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="java-21-openjdk-devel" version="21.0.12.1.1" release="1.2.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.src.rpm">
          <filename>java-21-openjdk-devel-21.0.12.1.1-1.2.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">0f87f660e194507b8d52428f90ed835efeb52464613513e7e689167cb5e260ee</sum>
        </package>
        <package name="java-21-openjdk-src" version="21.0.12.1.1" release="1.2.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.src.rpm">
          <filename>java-21-openjdk-src-21.0.12.1.1-1.2.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">2e1f03f5af3ad29a954bc6de84c3fe9a5c151c8fad398573123875ce7180e523</sum>
        </package>
        <package name="java-21-openjdk-static-libs" version="21.0.12.1.1" release="1.2.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.src.rpm">
          <filename>java-21-openjdk-static-libs-21.0.12.1.1-1.2.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">89c962f8a0870da03d659d3130031947fdbf89ce8ff5e21d7bab6477e68da3ea</sum>
        </package>
        <package name="java-21-openjdk-jmods" version="21.0.12.1.1" release="1.2.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.src.rpm">
          <filename>java-21-openjdk-jmods-21.0.12.1.1-1.2.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">a9cfc355ace2a8f1d576b4eaf5ba7469ba322b23eb946723c18f2f3bed8cacb2</sum>
        </package>
        <package name="java-21-openjdk-javadoc" version="21.0.12.1.1" release="1.2.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.src.rpm">
          <filename>java-21-openjdk-javadoc-21.0.12.1.1-1.2.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b6ed99bb0b6a69fe10d9caae021b09b2c10f4f3d4e0055ebf661280cad97f706</sum>
        </package>
        <package name="java-21-openjdk-demo" version="21.0.12.1.1" release="1.2.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.src.rpm">
          <filename>java-21-openjdk-demo-21.0.12.1.1-1.2.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">ccbe1340d10e47737844663344047952eb52269704d3e67df12994cdcbe96e48</sum>
        </package>
        <package name="java-21-openjdk" version="21.0.12.1.1" release="1.2.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.src.rpm">
          <filename>java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">df5fbc78119913d01fa66f5c4ba3239817cb37685caabcc688eefd1f71686015</sum>
        </package>
        <package name="java-21-openjdk-headless" version="21.0.12.1.1" release="1.2.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.src.rpm">
          <filename>java-21-openjdk-headless-21.0.12.1.1-1.2.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">fb486ae0612e465a078589cf668b0d6e5137ed295170dc0c2b83696de14ad91e</sum>
        </package>
        <package name="java-21-openjdk-javadoc-zip" version="21.0.12.1.1" release="1.2.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.src.rpm">
          <filename>java-21-openjdk-javadoc-zip-21.0.12.1.1-1.2.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">fb80c89ecdebc205a531b889c57d923ebfe27218e9467132aef9824c5b41924b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55798</id>
    <title>Moderate: java-25-openjdk security update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-24 10:53:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>java-25-openjdk security update</summary>
    <description>The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.  

Security Fix(es):  

  * JDK: Improve Resource Resolving (CVE-2026-60589)
  * JDK: Enhance HTTP Connections (CVE-2026-61308)
  * JDK: Improve font loading (CVE-2026-70906)
  * JDK: Enhance TLS server (CVE-2026-70907)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55798" id="RHSA-2026:55798" type="rhsa" title="RHSA-2026:55798"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60589" id="CVE-2026-60589" type="cve" title="CVE-2026-60589"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61308" id="CVE-2026-61308" type="cve" title="CVE-2026-61308"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-70906" id="CVE-2026-70906" type="cve" title="CVE-2026-70906"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-70907" id="CVE-2026-70907" type="cve" title="CVE-2026-70907"/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55798.html" id="ALSA-2026:55798" type="self" title="ALSA-2026:55798"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="java-25-openjdk-src" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-src-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1692588f22d38321f86fd8cfa13be3111e38e37e624c8554f9b5a2bf1933369c</sum>
        </package>
        <package name="java-25-openjdk-crypto-adapter" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-crypto-adapter-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">18e2991065e33a6ce56d8af1f700255585657c7b3c5529477a6870fde8611aa6</sum>
        </package>
        <package name="java-25-openjdk-static-libs" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-static-libs-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">1bb5fa6d596b66f64924a10a7bcea3e3f62c4b372b1c4f8ccc7b3624f84dff04</sum>
        </package>
        <package name="java-25-openjdk-devel" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-devel-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">3f11e511ced88215e7df5d0f5fdc452913fab6e7c25492b8e6417ada3f2e3d00</sum>
        </package>
        <package name="java-25-openjdk-jmods" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-jmods-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">6ea1ac15dc43292daeb50674f333ddd700b0bb4c954e16d8e293acbc9abc0fc9</sum>
        </package>
        <package name="java-25-openjdk-demo" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-demo-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">840b1b19d869a7bce390c7c38691f6953aebb29798195cc455deac6eb069814d</sum>
        </package>
        <package name="java-25-openjdk" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9a4a253eba8b95aa19bbdd4d1f4620b62466a8c501429f7c1c8097d3d7689bed</sum>
        </package>
        <package name="java-25-openjdk-javadoc-zip" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-javadoc-zip-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">acabda2714fcca3d44b9ec8591c54822c9281615595aca114626c5cc79dc86b9</sum>
        </package>
        <package name="java-25-openjdk-headless" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-headless-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b8458fd49a0a2c8f5721467f7fd2e50dc435ba99d9cd131365f1e1a5d10a5ff9</sum>
        </package>
        <package name="java-25-openjdk-javadoc" version="25.0.4.1.1" release="1.1.el10.alma.1" epoch="1" arch="x86_64_v2" src="java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.src.rpm">
          <filename>java-25-openjdk-javadoc-25.0.4.1.1-1.1.el10.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">c0c1c09b0d8cb679555b64eae90094cd6a60de84032bc3cb7a2344bcc0da8037</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55855</id>
    <title>Important: libssh security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 11:15:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libssh security update</summary>
    <description>libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.  

Security Fix(es):  

  * libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)
  * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)
  * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)
  * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)
  * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)
  * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)
  * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)
  * libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)
  * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)
  * libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)
  * libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55855" id="RHSA-2026:55855" type="rhsa" title="RHSA-2026:55855"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15370" id="CVE-2026-15370" type="cve" title="CVE-2026-15370"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59842" id="CVE-2026-59842" type="cve" title="CVE-2026-59842"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59843" id="CVE-2026-59843" type="cve" title="CVE-2026-59843"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59844" id="CVE-2026-59844" type="cve" title="CVE-2026-59844"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59845" id="CVE-2026-59845" type="cve" title="CVE-2026-59845"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59846" id="CVE-2026-59846" type="cve" title="CVE-2026-59846"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59847" id="CVE-2026-59847" type="cve" title="CVE-2026-59847"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59848" id="CVE-2026-59848" type="cve" title="CVE-2026-59848"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59849" id="CVE-2026-59849" type="cve" title="CVE-2026-59849"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59850" id="CVE-2026-59850" type="cve" title="CVE-2026-59850"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59851" id="CVE-2026-59851" type="cve" title="CVE-2026-59851"/>
      <reference href="https://bugzilla.redhat.com/2498168" id="2498168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498176" id="2498176" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498177" id="2498177" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498178" id="2498178" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498179" id="2498179" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498180" id="2498180" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498181" id="2498181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498182" id="2498182" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498183" id="2498183" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498184" id="2498184" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2499049" id="2499049" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55855.html" id="ALSA-2026:55855" type="self" title="ALSA-2026:55855"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libssh-devel" version="0.12.0" release="3.el10_2" epoch="0" arch="x86_64_v2" src="libssh-0.12.0-3.el10_2.src.rpm">
          <filename>libssh-devel-0.12.0-3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">cf889169a138c1d2fe2a780dbecef2c94ee338f4bea052c8ec705aec8df146db</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55858</id>
    <title>Important: .NET 10.0 security, bug fix, and enhancement update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 11:15:59"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 10.0 security, bug fix, and enhancement update</summary>
    <description>.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 10.0.111  
Runtime version: 10.0.11  

Security Fix(es):  

  * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
  * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
  * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
  * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-10.2.z] (JIRA:AlmaLinux-235482)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55858" id="RHSA-2026:55858" type="rhsa" title="RHSA-2026:55858"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62899" id="CVE-2026-62899" type="cve" title="CVE-2026-62899"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62900" id="CVE-2026-62900" type="cve" title="CVE-2026-62900"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62901" id="CVE-2026-62901" type="cve" title="CVE-2026-62901"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-62909" id="CVE-2026-62909" type="cve" title="CVE-2026-62909"/>
      <reference href="https://bugzilla.redhat.com/2512175" id="2512175" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2512179" id="2512179" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2512180" id="2512180" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2512185" id="2512185" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55858.html" id="ALSA-2026:55858" type="self" title="ALSA-2026:55858"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="aspnetcore-targeting-pack-10.0" version="10.0.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0381b821e443f730f4e781eef06580f07209d4be9a515ae34f16910beead6e17</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" version="10.0.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">06a83c9140b3036a15f78e061b63d735e6866e99ff594503b8a5a6d246f9a77d</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" version="10.0.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2166d0dfb44c90d8db4ed828054bd8cf565112ca75788bfd682b312889517ff6</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" version="10.0.111" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.111-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2ce58e69ffe5f3aa350feab846a11e854fc657737000f84d85495286da7282f8</sum>
        </package>
        <package name="dotnet-templates-10.0" version="10.0.111" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.111-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">37df30ec1c7702246bf241886175b1864831f1f6e622aa7f9fefc3c9a656d181</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" version="10.0.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">38bf5c10e77cc5d0dee468dbfecef893b045d6231046b48ba999529d19e40bc7</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" version="10.0.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">68593d1a490bc455d7acf96d13dcb583049640c507f55d924a1607b86f73ce78</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" version="10.0.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8579f777460edf01146b1decbb63d9bf63581185220f88e34953b3da36dc9760</sum>
        </package>
        <package name="dotnet-runtime-10.0" version="10.0.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b3643a031d1f4406483f6bbbdc142020746741fbbfa6b29d314693101a933579</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" version="10.0.111" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.111-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">e32c4171c2a131141f8496a3995331c6793cf1eef954b0e988876e9bf5f7bbdb</sum>
        </package>
        <package name="dotnet-sdk-10.0" version="10.0.111" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.111-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">eccff7f77f5d488f40e358e2cfe766b4a86f93ad414696c68161ec1dfb27a49c</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" version="10.0.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f3b5cac56a8f89be284c694b08020bb71e9191be08683c43106ffdbc8e8b8f30</sum>
        </package>
        <package name="dotnet-host" version="10.0.11" release="1.el10_2" epoch="0" arch="x86_64_v2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.11-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f81d05c85ea019a494f9cd13511ebe3466aa64cb3874bb1c354872037e8012bd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55892</id>
    <title>Important: unbound security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:55:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)
  * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55892" id="RHSA-2026:55892" type="rhsa" title="RHSA-2026:55892"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44690" id="CVE-2026-44690" type="cve" title="CVE-2026-44690"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-55973" id="CVE-2026-55973" type="cve" title="CVE-2026-55973"/>
      <reference href="https://bugzilla.redhat.com/2503063" id="2503063" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503075" id="2503075" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55892.html" id="ALSA-2026:55892" type="self" title="ALSA-2026:55892"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="unbound" version="1.24.2" release="7.el10_2.4" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-1.24.2-7.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">0a16752fe035528e3c0b640744b3fc76aed794608d2b5ac26eb41899af9382a8</sum>
        </package>
        <package name="unbound-dracut" version="1.24.2" release="7.el10_2.4" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">3ae839ae75c8ed9306134db0947b4655d5b7aabd90622a426052f32db72d3a58</sum>
        </package>
        <package name="unbound-anchor" version="1.24.2" release="7.el10_2.4" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">4dfac69f2fa754147922a61031b7e4b336f5633f19d56d07bb66ebb6aec0f69f</sum>
        </package>
        <package name="python3-unbound" version="1.24.2" release="7.el10_2.4" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">59985b1e0ee9b0642e0476cd5eb444f76c53ae724ff072adad49aac63c852333</sum>
        </package>
        <package name="unbound-utils" version="1.24.2" release="7.el10_2.4" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">956b387af2b8af319589c1b616a14f8dfac6dd8f11dd02391e65054da126c65c</sum>
        </package>
        <package name="unbound-libs" version="1.24.2" release="7.el10_2.4" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">c2a3977c6eebb3582c8dfb5ca109bfbddcfeec8e51aa5b8a87fbc779ef50b610</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:56007</id>
    <title>Important: mysql8.4 security, bug fix, and enhancement update</title>
    <issued date="2026-08-18 00:00:00"/>
    <updated date="2026-08-19 14:17:46"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>mysql8.4 security, bug fix, and enhancement update</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.  

Security Fix(es):  

  * mysql: Performance Schema unspecified vulnerability (CPU Jul 2026) (CVE-2026-61081)
  * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47064)
  * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47012)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60331)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60190)
  * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60177)
  * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-60145)
  * mysql: DDL unspecified vulnerability (CPU Jul 2026) (CVE-2026-46936)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60186)
  * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60315)
  * mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026) (CVE-2026-61096)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60163)
  * mysql: InnoDB unspecified vulnerability (CPU Jul 2026) (CVE-2026-47052)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60188)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60184)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60185)
  * mysql: JSON unspecified vulnerability (CPU Jul 2026) (CVE-2026-61109)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60191)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-61094)
  * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60178)
  * mysql: Group Replication GCS unspecified vulnerability (CPU Jul 2026) (CVE-2026-60332)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60189)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60747)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-47023)
  * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60183)
  * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60316)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60187)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60585)
  * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60182)


Bug Fix(es) and Enhancement(s):  

  * [tracker] Rebase MySQL to 8.4.11 (JIRA:AlmaLinux-188044)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:56007" id="RHSA-2026:56007" type="rhsa" title="RHSA-2026:56007"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46936" id="CVE-2026-46936" type="cve" title="CVE-2026-46936"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47012" id="CVE-2026-47012" type="cve" title="CVE-2026-47012"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47023" id="CVE-2026-47023" type="cve" title="CVE-2026-47023"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47052" id="CVE-2026-47052" type="cve" title="CVE-2026-47052"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47064" id="CVE-2026-47064" type="cve" title="CVE-2026-47064"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60145" id="CVE-2026-60145" type="cve" title="CVE-2026-60145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60163" id="CVE-2026-60163" type="cve" title="CVE-2026-60163"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60177" id="CVE-2026-60177" type="cve" title="CVE-2026-60177"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60178" id="CVE-2026-60178" type="cve" title="CVE-2026-60178"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60182" id="CVE-2026-60182" type="cve" title="CVE-2026-60182"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60183" id="CVE-2026-60183" type="cve" title="CVE-2026-60183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60184" id="CVE-2026-60184" type="cve" title="CVE-2026-60184"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60185" id="CVE-2026-60185" type="cve" title="CVE-2026-60185"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60186" id="CVE-2026-60186" type="cve" title="CVE-2026-60186"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60187" id="CVE-2026-60187" type="cve" title="CVE-2026-60187"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60188" id="CVE-2026-60188" type="cve" title="CVE-2026-60188"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60189" id="CVE-2026-60189" type="cve" title="CVE-2026-60189"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60190" id="CVE-2026-60190" type="cve" title="CVE-2026-60190"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60191" id="CVE-2026-60191" type="cve" title="CVE-2026-60191"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60315" id="CVE-2026-60315" type="cve" title="CVE-2026-60315"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60316" id="CVE-2026-60316" type="cve" title="CVE-2026-60316"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60331" id="CVE-2026-60331" type="cve" title="CVE-2026-60331"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60332" id="CVE-2026-60332" type="cve" title="CVE-2026-60332"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60585" id="CVE-2026-60585" type="cve" title="CVE-2026-60585"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60747" id="CVE-2026-60747" type="cve" title="CVE-2026-60747"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61081" id="CVE-2026-61081" type="cve" title="CVE-2026-61081"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61094" id="CVE-2026-61094" type="cve" title="CVE-2026-61094"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61096" id="CVE-2026-61096" type="cve" title="CVE-2026-61096"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61109" id="CVE-2026-61109" type="cve" title="CVE-2026-61109"/>
      <reference href="https://bugzilla.redhat.com/2504779" id="2504779" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504823" id="2504823" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504848" id="2504848" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504855" id="2504855" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504877" id="2504877" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504925" id="2504925" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504940" id="2504940" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505001" id="2505001" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505002" id="2505002" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505027" id="2505027" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505182" id="2505182" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505200" id="2505200" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505215" id="2505215" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505259" id="2505259" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505262" id="2505262" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505300" id="2505300" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505310" id="2505310" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505319" id="2505319" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505509" id="2505509" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505594" id="2505594" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505643" id="2505643" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505699" id="2505699" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505711" id="2505711" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505722" id="2505722" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505844" id="2505844" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505868" id="2505868" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505891" id="2505891" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505923" id="2505923" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505927" id="2505927" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-56007.html" id="ALSA-2026:56007" type="self" title="ALSA-2026:56007"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mysql8.4-server" version="8.4.11" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="mysql8.4-8.4.11-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-server-8.4.11-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">246ad7f569e31f100344a7f9e285898a02a9cf7c0273d64327ded3a8e0cc0e2a</sum>
        </package>
        <package name="mysql8.4-errmsg" version="8.4.11" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.11-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.11-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">363b90f121ea2698cc9695f9f3309d5ffa0b6afbaa96304878cd6e0f4729dc7e</sum>
        </package>
        <package name="mysql8.4-common" version="8.4.11" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.11-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-common-8.4.11-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">c88645f04b3cebf77c1371c06af54dbc511288a9c7e60b32a1b8566680f797db</sum>
        </package>
        <package name="mysql8.4" version="8.4.11" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="mysql8.4-8.4.11-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-8.4.11-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">cdf54bafe0a43d7d8ea37e04f149ce51f80cf843efeb9070517f345c32d27a03</sum>
        </package>
        <package name="mysql8.4-libs" version="8.4.11" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="mysql8.4-8.4.11-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-libs-8.4.11-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">dfdd83f8d1f19f0fb0bf01431b227a2591c22759461f9249f57f79e35ef5bc09</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:56965</id>
    <title>Moderate: libcupsfilters security update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-20 10:15:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libcupsfilters security update</summary>
    <description>Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications.  

Security Fix(es):  

  * libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611)
  * libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:56965" id="RHSA-2026:56965" type="rhsa" title="RHSA-2026:56965"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64611" id="CVE-2026-64611" type="cve" title="CVE-2026-64611"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64612" id="CVE-2026-64612" type="cve" title="CVE-2026-64612"/>
      <reference href="https://bugzilla.redhat.com/2502799" id="2502799" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502801" id="2502801" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-56965.html" id="ALSA-2026:56965" type="self" title="ALSA-2026:56965"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libcupsfilters" version="2.0.0" release="13.el10_2" epoch="1" arch="x86_64_v2" src="libcupsfilters-2.0.0-13.el10_2.src.rpm">
          <filename>libcupsfilters-2.0.0-13.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4278b3da47132cb9285f3f50bc35b3173b58aed9d65a5e4a9de8e139bad6bebd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:56969</id>
    <title>Important: php8.4 security, bug fix, and enhancement update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-20 10:16:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>php8.4 security, bug fix, and enhancement update</summary>
    <description>PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.  

Security Fix(es):  

  * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)
  * php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544)


Bug Fix(es) and Enhancement(s):  

  * Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:AlmaLinux-223949)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:56969" id="RHSA-2026:56969" type="rhsa" title="RHSA-2026:56969"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-17543" id="CVE-2026-17543" type="cve" title="CVE-2026-17543"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-17544" id="CVE-2026-17544" type="cve" title="CVE-2026-17544"/>
      <reference href="https://bugzilla.redhat.com/2509254" id="2509254" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2509256" id="2509256" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-56969.html" id="ALSA-2026:56969" type="self" title="ALSA-2026:56969"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="php8.4-fpm" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-fpm-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">07008388e2b2e2466e5b5fcb7e4dd4b387cd1ec74671bf776c24490cfd11274f</sum>
        </package>
        <package name="php8.4-bcmath" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-bcmath-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0c5fed5cf060c2a304efa99d4b0525e4ecf91f1754eaf8d74b1a25f1c3a5dceb</sum>
        </package>
        <package name="php8.4-snmp" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-snmp-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">294d4ff8b93fbba48cbd079fc57f4aa728996d89f142d36e0b47ce8fef636af5</sum>
        </package>
        <package name="php8.4-ffi" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-ffi-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2cff92452c608ff10b0184b530aca6160cba1ab64fac73d981b58dfc04cb4b69</sum>
        </package>
        <package name="php8.4-gd" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-gd-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2f3d1234ab221d932769dfc0f32e5dfb838d9ea3d25854abd218a7dafac93a45</sum>
        </package>
        <package name="php8.4-gmp" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-gmp-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">33296f7af4c8f4c23dda55b21cb0130ba563b9758e20a75ee6183be214263613</sum>
        </package>
        <package name="php8.4-common" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-common-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3623e68bd00fe7acbef5036d268e9cf431972421ef72c3cb8100a5a8bf30920b</sum>
        </package>
        <package name="php8.4-dba" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-dba-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4411da8380961b45b61caec3297db939c4c3b04e6a0879c8387c452795037595</sum>
        </package>
        <package name="php8.4-odbc" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-odbc-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">485d09c5b09abb17c82866383130b7d7f7b617e209c9c80967a2305ec472673f</sum>
        </package>
        <package name="php8.4-mbstring" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-mbstring-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4a6a7cfd7d4e975132cdb5711115aff61c05f2b5f9a747b65f945315796c520e</sum>
        </package>
        <package name="php8.4-ldap" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-ldap-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">622db637f63601d48e1eedfd22c49d456a2bf4e9fd95057c58329d6e6df76ade</sum>
        </package>
        <package name="php8.4-cli" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-cli-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">761bdcd7846d2a578d0ab0d3219e8647036e1af37ff32fb8b1fb72ef0bd71b9b</sum>
        </package>
        <package name="php8.4-pdo" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-pdo-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">772cebb1174e81832ab403615d09cdd6ae05fa332331ea59adb0f08103c38042</sum>
        </package>
        <package name="php8.4-process" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-process-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7d22d9263e84c9a61d4e6ffffa81ee251e4d3eebfaba615e487dc0b772c167d5</sum>
        </package>
        <package name="php8.4-embedded" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-embedded-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">988af8e37bf3a84fe1ec94ff99a4b423a9be1784b10f2add9449c032eab77d62</sum>
        </package>
        <package name="php8.4-pgsql" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-pgsql-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a75e3a79c5e00d8ddf65b4c040b5e02ac8152f94892916be07ef85fcab9cb6ea</sum>
        </package>
        <package name="php8.4-mysqlnd" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-mysqlnd-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">aa94a7355b5ca7ef4386adb34303d4a9ec6cf5d61d78f22fd34e553848ad20b6</sum>
        </package>
        <package name="php8.4-soap" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-soap-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ac08a6456cd28090de2c0e475cb8cda3263f3d9c395b08408f82120674777041</sum>
        </package>
        <package name="php8.4-opcache" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-opcache-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ca3e4b068a3539b3f2c613886d0b78dc6991c5eaf5b32ce745e5baf88082c339</sum>
        </package>
        <package name="php8.4-enchant" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-enchant-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ce39f7f476a0ed53eadd020f51da9970f0eb5503940d766a29b0db0b7b90f7ee</sum>
        </package>
        <package name="php8.4-xml" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-xml-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d1be0e4c4fcb9a353a5f0523808964a934265a0d370499d5b55a9fea8dc49122</sum>
        </package>
        <package name="php8.4-intl" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-intl-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d2c873d693ad5d61029b3189202ae6eb8ffa83e65adbdc991475cd539521a4c9</sum>
        </package>
        <package name="php8.4-devel" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-devel-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dc918c21e48724cf2b123a9b32bb56a848b625406489c32114230861a23b5b36</sum>
        </package>
        <package name="php8.4" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fb37bae2d17e2d2a19be383501616f6ea73cadf0146414d7063530d7af3e375e</sum>
        </package>
        <package name="php8.4-dbg" version="8.4.24" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-dbg-8.4.24-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fb7bb01c0b7075c844ecdf8abfba73ef8497569abb6864c20a5a49d0a41a538d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:56971</id>
    <title>Important: perl-Date-Manip security update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-20 10:13:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-Date-Manip security update</summary>
    <description>Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.  

Security Fix(es):  

  * perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:56971" id="RHSA-2026:56971" type="rhsa" title="RHSA-2026:56971"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60075" id="CVE-2026-60075" type="cve" title="CVE-2026-60075"/>
      <reference href="https://bugzilla.redhat.com/2509486" id="2509486" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-56971.html" id="ALSA-2026:56971" type="self" title="ALSA-2026:56971"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="perl-Date-Manip" version="6.94" release="5.el10_2.1" epoch="0" arch="noarch" src="perl-Date-Manip-6.94-5.el10_2.1.src.rpm">
          <filename>perl-Date-Manip-6.94-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">10d103055b714ff49d9c99838b44a6ae39437022daa8f3446516cf8eca19f1d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:57015</id>
    <title>Moderate: glib2 security update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-20 10:13:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glib2 security update</summary>
    <description>GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.  

Security Fix(es):  

  * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010)
  * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011)
  * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012)
  * glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013)
  * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014)
  * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015)
  * GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering (CVE-2026-15588)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:57015" id="RHSA-2026:57015" type="rhsa" title="RHSA-2026:57015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15588" id="CVE-2026-15588" type="cve" title="CVE-2026-15588"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58010" id="CVE-2026-58010" type="cve" title="CVE-2026-58010"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58011" id="CVE-2026-58011" type="cve" title="CVE-2026-58011"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58012" id="CVE-2026-58012" type="cve" title="CVE-2026-58012"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58013" id="CVE-2026-58013" type="cve" title="CVE-2026-58013"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58014" id="CVE-2026-58014" type="cve" title="CVE-2026-58014"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58015" id="CVE-2026-58015" type="cve" title="CVE-2026-58015"/>
      <reference href="https://bugzilla.redhat.com/2492243" id="2492243" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492245" id="2492245" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492247" id="2492247" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492248" id="2492248" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492255" id="2492255" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492256" id="2492256" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2499675" id="2499675" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-57015.html" id="ALSA-2026:57015" type="self" title="ALSA-2026:57015"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="glib2-devel" version="2.80.4" release="12.el10_2.21" epoch="0" arch="x86_64_v2" src="glib2-2.80.4-12.el10_2.21.src.rpm">
          <filename>glib2-devel-2.80.4-12.el10_2.21.x86_64_v2.rpm</filename>
          <sum type="sha256">2ab88cda413d1e6ac9eec3f35b33120723071ee3cc29877280d43e174ea7b787</sum>
        </package>
        <package name="glib2-tests" version="2.80.4" release="12.el10_2.21" epoch="0" arch="x86_64_v2" src="glib2-2.80.4-12.el10_2.21.src.rpm">
          <filename>glib2-tests-2.80.4-12.el10_2.21.x86_64_v2.rpm</filename>
          <sum type="sha256">7048b3cdae6ae912000abd468795322a9f54a967df76a87178ffc33aced07e39</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:57126</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-20 10:14:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>yggdrasil security update</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.  

Security Fix(es):  

  * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:57126" id="RHSA-2026:57126" type="rhsa" title="RHSA-2026:57126"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33810" id="CVE-2026-33810" type="cve" title="CVE-2026-33810"/>
      <reference href="https://bugzilla.redhat.com/2456335" id="2456335" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-57126.html" id="ALSA-2026:57126" type="self" title="ALSA-2026:57126"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="yggdrasil" version="0.4.9.2" release="1.el10_2.2" epoch="0" arch="x86_64_v2" src="yggdrasil-0.4.9.2-1.el10_2.2.src.rpm">
          <filename>yggdrasil-0.4.9.2-1.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">3ff2c82a6f0e353b9fb9632cff6a89d06e767ddcf7bc4089345e3ef8665f7ef1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:57148</id>
    <title>Important: ansible-core security update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-21 09:20:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ansible-core security update</summary>
    <description>Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.  

Security Fix(es):  

  * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:57148" id="RHSA-2026:57148" type="rhsa" title="RHSA-2026:57148"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11332" id="CVE-2026-11332" type="cve" title="CVE-2026-11332"/>
      <reference href="https://bugzilla.redhat.com/2485379" id="2485379" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-57148.html" id="ALSA-2026:57148" type="self" title="ALSA-2026:57148"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="ansible-test" version="2.16.16" release="2.el10_2.1" epoch="1" arch="noarch" src="ansible-core-2.16.16-2.el10_2.1.src.rpm">
          <filename>ansible-test-2.16.16-2.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">278ed7a9b385cb985f51b9a6e708b16d47cae71cb98ba0d3c8d13b7c71d3f0de</sum>
        </package>
        <package name="ansible-core" version="2.16.16" release="2.el10_2.1" epoch="1" arch="noarch" src="ansible-core-2.16.16-2.el10_2.1.src.rpm">
          <filename>ansible-core-2.16.16-2.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">9e56e424dbf2c5ad2a45a0dfbe4d711e036865c0a60139679f71bec6f32d2897</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:57251</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-20 00:00:00"/>
    <updated date="2026-08-25 08:41:25"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
  * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)
  * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
  * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
  * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
  * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
  * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
  * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
  * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
  * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
  * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
  * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
  * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
  * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
  * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
  * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
  * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)
  * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
  * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
  * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
  * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
  * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
  * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
  * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)


Bug Fix(es) and Enhancement(s):  

  * CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:AlmaLinux-223954)
  * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z] (JIRA:AlmaLinux-224545)
  * cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459)
  * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z] (JIRA:AlmaLinux-235812)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:57251" id="RHSA-2026:57251" type="rhsa" title="RHSA-2026:57251"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43206" id="CVE-2026-43206" type="cve" title="CVE-2026-43206"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43237" id="CVE-2026-43237" type="cve" title="CVE-2026-43237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43493" id="CVE-2026-43493" type="cve" title="CVE-2026-43493"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45878" id="CVE-2026-45878" type="cve" title="CVE-2026-45878"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45991" id="CVE-2026-45991" type="cve" title="CVE-2026-45991"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46185" id="CVE-2026-46185" type="cve" title="CVE-2026-46185"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52991" id="CVE-2026-52991" type="cve" title="CVE-2026-52991"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53136" id="CVE-2026-53136" type="cve" title="CVE-2026-53136"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53143" id="CVE-2026-53143" type="cve" title="CVE-2026-53143"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53329" id="CVE-2026-53329" type="cve" title="CVE-2026-53329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53356" id="CVE-2026-53356" type="cve" title="CVE-2026-53356"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53374" id="CVE-2026-53374" type="cve" title="CVE-2026-53374"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-63879" id="CVE-2026-63879" type="cve" title="CVE-2026-63879"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-63884" id="CVE-2026-63884" type="cve" title="CVE-2026-63884"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-63886" id="CVE-2026-63886" type="cve" title="CVE-2026-63886"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-63888" id="CVE-2026-63888" type="cve" title="CVE-2026-63888"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-63952" id="CVE-2026-63952" type="cve" title="CVE-2026-63952"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64017" id="CVE-2026-64017" type="cve" title="CVE-2026-64017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64219" id="CVE-2026-64219" type="cve" title="CVE-2026-64219"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64379" id="CVE-2026-64379" type="cve" title="CVE-2026-64379"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64382" id="CVE-2026-64382" type="cve" title="CVE-2026-64382"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64386" id="CVE-2026-64386" type="cve" title="CVE-2026-64386"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64560" id="CVE-2026-64560" type="cve" title="CVE-2026-64560"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-68388" id="CVE-2026-68388" type="cve" title="CVE-2026-68388"/>
      <reference href="https://bugzilla.redhat.com/2467156" id="2467156" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467202" id="2467202" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479812" id="2479812" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482113" id="2482113" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482124" id="2482124" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482558" id="2482558" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492403" id="2492403" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492719" id="2492719" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492768" id="2492768" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2495941" id="2495941" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2495950" id="2495950" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502188" id="2502188" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502321" id="2502321" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502329" id="2502329" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502422" id="2502422" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502443" id="2502443" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502449" id="2502449" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502463" id="2502463" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2506790" id="2506790" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507042" id="2507042" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507135" id="2507135" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507216" id="2507216" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2508504" id="2508504" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2513470" id="2513470" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-57251.html" id="ALSA-2026:57251" type="self" title="ALSA-2026:57251"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.49.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">246731a322c2c865a9e626b9c0be133018206f6db8652c48453d46fdc34459d6</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.49.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">247fbd10a0e907662b73a08dd919514cba48a6ddb32c16c35be9c714f4557086</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.49.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4e32d17504ca3df1034314f776a8873f4f98b44660238413814decb06356bd55</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.49.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">648e9926d843639021a37e5c2bbdaea0f394c5e0d809d9f1a48d455d3f2df3b7</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.49.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">66dfd785e82a7d6a0b0e4fa0d52ab8eddc27db4f26adf98ce8f30ad8393770a8</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.49.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">744b1de98a33ec1d33c1ad7ab917f6bf57169b006e0d3345ed6aa387e678f104</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.49.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8bfaf769cbf0dad9d6d84aa29f084259968f6a241dcbb217af4473ee6a99dead</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.49.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a7beeec21ab117d3af062a83ff29b08117157ec19bc2d6579b84e1b9944ece16</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.49.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b358e2855445c4be683ae69198fe443361cf8b32f9f6052408e9c2dd7d7d8c24</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.49.1.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.49.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.49.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">fa0aa271a5107d8e7c76df7d5d7f84851635715ee107f8e7660e4563cce95715</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:57596</id>
    <title>Important: mrtg security update</title>
    <issued date="2026-08-20 00:00:00"/>
    <updated date="2026-08-24 11:00:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>mrtg security update</summary>
    <description>The Multi Router Traffic Grapher (MRTG) monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic.  

Security Fix(es):  

  * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation (CVE-2026-72694)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:57596" id="RHSA-2026:57596" type="rhsa" title="RHSA-2026:57596"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-72694" id="CVE-2026-72694" type="cve" title="CVE-2026-72694"/>
      <reference href="https://bugzilla.redhat.com/2460973" id="2460973" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-57596.html" id="ALSA-2026:57596" type="self" title="ALSA-2026:57596"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="mrtg" version="2.17.10" release="12.el10_2.1" epoch="0" arch="x86_64_v2" src="mrtg-2.17.10-12.el10_2.1.src.rpm">
          <filename>mrtg-2.17.10-12.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">3f5ffa6545b0d7e24fc821f98a5996eef35394af6d8a3a48838a5c8503c2f04d</sum>
        </package>
        <package name="mrtg-selinux" version="2.17.10" release="12.el10_2.1" epoch="0" arch="noarch" src="mrtg-2.17.10-12.el10_2.1.src.rpm">
          <filename>mrtg-selinux-2.17.10-12.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">d7555e699b1e01e77cb85e1fbe4038f3f7826311959865d40f4c38eed8aa6134</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:58571</id>
    <title>Moderate: qemu-kvm security, bug fix, and enhancement update</title>
    <issued date="2026-08-24 00:00:00"/>
    <updated date="2026-08-25 08:36:51"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>qemu-kvm security, bug fix, and enhancement update</summary>
    <description>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.  

Security Fix(es):  

  * qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914)


Bug Fix(es) and Enhancement(s):  

  * qemu-kvm hung during drain after double pause [almalinux-10.2.z] (JIRA:AlmaLinux-190702)
  * qemu-img create/convert fails on target block device with 4k sector size [almalinux-10.2.z] (JIRA:AlmaLinux-207389)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:58571" id="RHSA-2026:58571" type="rhsa" title="RHSA-2026:58571"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48914" id="CVE-2026-48914" type="cve" title="CVE-2026-48914"/>
      <reference href="https://bugzilla.redhat.com/2488283" id="2488283" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-58571.html" id="ALSA-2026:58571" type="self" title="ALSA-2026:58571"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="qemu-kvm-device-usb-host" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-device-usb-host-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">06d49d8acde578a4969329110b4a68d6d64f42be192a5388ca4a95d35d185afc</sum>
        </package>
        <package name="qemu-kvm-docs" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-docs-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">195a1dc949dd772688adb16a8eb7bdf7e3cde26f365d31f285b34f122922d59b</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-vga" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-device-display-virtio-vga-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">33b98c158f16d5aff520b681c960078dacc7fec567e28a58d6d623d75f349a67</sum>
        </package>
        <package name="qemu-kvm-tools" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-tools-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">40f8e5ccde2017bc726cbf72a724d824298a0550bdc561ef7d73fcaf02d75c4e</sum>
        </package>
        <package name="qemu-pr-helper" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-pr-helper-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">46cbfddf5a7dc5b69fda5338fee8b51c563998581a131cd47531b8dc029b4290</sum>
        </package>
        <package name="qemu-kvm-audio-pa" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-audio-pa-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4a5ad50bc08faa4a5d5b3e1d83591c146444d0b16eaf6e0e08375a70a3b33eaa</sum>
        </package>
        <package name="qemu-kvm-ui-opengl" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-ui-opengl-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">50aa6f75501007306213b0c592b4cb51d181ab9f465ef6750e6d252fdaa92174</sum>
        </package>
        <package name="qemu-img" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-img-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">58d70e843bbffd14671567743a73d04b4b96afcc5ad55eec83d5f310b0cae926</sum>
        </package>
        <package name="qemu-kvm-block-blkio" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-block-blkio-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">66738b4f15d47688c1bb4ba4e2f94cf1bca90f538c32b8d6f7f3985f384df651</sum>
        </package>
        <package name="qemu-kvm-core" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-core-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">724580aa3518c9acb7b2707307f4b4155d066ae58ef21eba73fc71c8e9b38876</sum>
        </package>
        <package name="qemu-kvm" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">77f8ebbc515fc36abc2ddc8c06c58d8e996dbaf265d0527510cff2ff1ab930fa</sum>
        </package>
        <package name="qemu-kvm-block-rbd" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-block-rbd-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">801d7391417e9c09e22a685fdfad1ee1583a48c9f823939bc079d48c4a0f2675</sum>
        </package>
        <package name="qemu-kvm-common" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-common-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">9e9099d769801982b3cedb66b12dc6b30a595dffe10d009b98f5c50ed98ee90d</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu-pci" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">c0fca3ff76ea125f29a13df7fbe6a8a8b71c1953ed8ebecd5318b742f575135f</sum>
        </package>
        <package name="qemu-kvm-device-usb-redirect" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">c22249471790a4d4ba3a03d5cbcd95234652a940b033e2bdc08e879f55bf9462</sum>
        </package>
        <package name="qemu-kvm-ui-egl-headless" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-ui-egl-headless-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">c37ce813738a683272aeb5467835c870b13595b5de3bad50d61d98a51f258ae5</sum>
        </package>
        <package name="qemu-guest-agent" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-guest-agent-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">ca84f5cc894eab8693a1b63d65d1054121d67bd9264240b73b954c3cabe796f4</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">d1b1724ea87c69963471fe528e5a2184dce07894e5cdc55b87353447f3bbd45a</sum>
        </package>
        <package name="qemu-kvm-block-curl" version="10.1.0" release="16.el10_2.5.alma.1" epoch="18" arch="x86_64_v2" src="qemu-kvm-10.1.0-16.el10_2.5.alma.1.src.rpm">
          <filename>qemu-kvm-block-curl-10.1.0-16.el10_2.5.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">f2fce4d938f69f67a89d8d1b96b701ce6f3d3936f9a14f8a1f8e2bc9f2dfb3b4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:58819</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-08-24 00:00:00"/>
    <updated date="2026-08-25 08:37:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs24 security update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  

Security Fix(es):  

  * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:58819" id="RHSA-2026:58819" type="rhsa" title="RHSA-2026:58819"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14257" id="CVE-2026-14257" type="cve" title="CVE-2026-14257"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-54272" id="CVE-2026-54272" type="cve" title="CVE-2026-54272"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-69152" id="CVE-2026-69152" type="cve" title="CVE-2026-69152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-69192" id="CVE-2026-69192" type="cve" title="CVE-2026-69192"/>
      <reference href="https://bugzilla.redhat.com/2506433" id="2506433" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507593" id="2507593" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510722" id="2510722" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510801" id="2510801" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-58819.html" id="ALSA-2026:58819" type="self" title="ALSA-2026:58819"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs24-npm" version="11.16.0" release="1.24.18.0.5.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch.rpm</filename>
          <sum type="sha256">0b5823d155438be9e50559a2b2516af1f168e0c86471037562a2f1a8b8cc92f1</sum>
        </package>
        <package name="nodejs24-devel" version="24.18.0" release="5.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-devel-24.18.0-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4a901e8accd46aef9b841a4bbd63188984520f0581b7204fccfaf71f68f159e0</sum>
        </package>
        <package name="nodejs24" version="24.18.0" release="5.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-24.18.0-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a2d01a9d99241b062a970c22e7bbe7c78f74ff27842c0a14a8f39cc7ee2595bc</sum>
        </package>
        <package name="nodejs24-full-i18n" version="24.18.0" release="5.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-full-i18n-24.18.0-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a9e74fe3135119185c116ee214435b9722c03e6e326e0d5d701263efc7fd108b</sum>
        </package>
        <package name="nodejs24-libs" version="24.18.0" release="5.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-libs-24.18.0-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dd3eb4f08167b19ed8b008229fe2c72287439031713dfaf2fa4eb004b7f3b376</sum>
        </package>
        <package name="nodejs24-docs" version="24.18.0" release="5.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-docs-24.18.0-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">f376c79686cb878dbaf4e4b6b47534b7dad0ad97bbd2d659ad2f239bdb1d023c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:58899</id>
    <title>Important: firefox security update</title>
    <issued date="2026-08-24 00:00:00"/>
    <updated date="2026-08-26 06:49:51"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component (CVE-2026-74983)
  * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934)
  * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953)
  * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987)
  * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948)
  * firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-74943)
  * firefox: thunderbird: Information disclosure in the DOM: UI Events &amp; Focus Handling component (CVE-2026-74971)
  * firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component (CVE-2026-74941)
  * firefox: Privilege escalation in the Shell Integration component (CVE-2026-74965)
  * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-74946)
  * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973)
  * firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-74949)
  * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990)
  * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936)
  * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-74940)
  * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960)
  * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-74969)
  * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959)
  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976)
  * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974)
  * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957)
  * firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component (CVE-2026-74967)
  * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942)
  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939)
  * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972)
  * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945)
  * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963)
  * firefox: thunderbird: Use-after-free in the DOM: Core &amp; HTML component (CVE-2026-74944)
  * firefox: Integer overflow in the Graphics component (CVE-2026-74964)
  * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962)
  * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:58899" id="RHSA-2026:58899" type="rhsa" title="RHSA-2026:58899"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74934" id="CVE-2026-74934" type="cve" title="CVE-2026-74934"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74935" id="CVE-2026-74935" type="cve" title="CVE-2026-74935"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74936" id="CVE-2026-74936" type="cve" title="CVE-2026-74936"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74939" id="CVE-2026-74939" type="cve" title="CVE-2026-74939"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74940" id="CVE-2026-74940" type="cve" title="CVE-2026-74940"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74941" id="CVE-2026-74941" type="cve" title="CVE-2026-74941"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74942" id="CVE-2026-74942" type="cve" title="CVE-2026-74942"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74943" id="CVE-2026-74943" type="cve" title="CVE-2026-74943"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74944" id="CVE-2026-74944" type="cve" title="CVE-2026-74944"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74945" id="CVE-2026-74945" type="cve" title="CVE-2026-74945"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74946" id="CVE-2026-74946" type="cve" title="CVE-2026-74946"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74948" id="CVE-2026-74948" type="cve" title="CVE-2026-74948"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74949" id="CVE-2026-74949" type="cve" title="CVE-2026-74949"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74953" id="CVE-2026-74953" type="cve" title="CVE-2026-74953"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74957" id="CVE-2026-74957" type="cve" title="CVE-2026-74957"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74959" id="CVE-2026-74959" type="cve" title="CVE-2026-74959"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74960" id="CVE-2026-74960" type="cve" title="CVE-2026-74960"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74962" id="CVE-2026-74962" type="cve" title="CVE-2026-74962"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74963" id="CVE-2026-74963" type="cve" title="CVE-2026-74963"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74964" id="CVE-2026-74964" type="cve" title="CVE-2026-74964"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74965" id="CVE-2026-74965" type="cve" title="CVE-2026-74965"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74967" id="CVE-2026-74967" type="cve" title="CVE-2026-74967"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74969" id="CVE-2026-74969" type="cve" title="CVE-2026-74969"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74971" id="CVE-2026-74971" type="cve" title="CVE-2026-74971"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74972" id="CVE-2026-74972" type="cve" title="CVE-2026-74972"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74973" id="CVE-2026-74973" type="cve" title="CVE-2026-74973"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74974" id="CVE-2026-74974" type="cve" title="CVE-2026-74974"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74976" id="CVE-2026-74976" type="cve" title="CVE-2026-74976"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74983" id="CVE-2026-74983" type="cve" title="CVE-2026-74983"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74987" id="CVE-2026-74987" type="cve" title="CVE-2026-74987"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-74990" id="CVE-2026-74990" type="cve" title="CVE-2026-74990"/>
      <reference href="https://bugzilla.redhat.com/2517819" id="2517819" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517820" id="2517820" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517822" id="2517822" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517823" id="2517823" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517825" id="2517825" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517826" id="2517826" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517831" id="2517831" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517833" id="2517833" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517834" id="2517834" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517835" id="2517835" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517836" id="2517836" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517837" id="2517837" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517839" id="2517839" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517840" id="2517840" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517841" id="2517841" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517845" id="2517845" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517846" id="2517846" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517849" id="2517849" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517851" id="2517851" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517853" id="2517853" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517856" id="2517856" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517858" id="2517858" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517859" id="2517859" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517860" id="2517860" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517862" id="2517862" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517863" id="2517863" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517866" id="2517866" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517868" id="2517868" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517870" id="2517870" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517872" id="2517872" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2517874" id="2517874" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-58899.html" id="ALSA-2026:58899" type="self" title="ALSA-2026:58899"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.14.0" release="1.el10_2" epoch="0" arch="x86_64_v2" src="firefox-140.14.0-1.el10_2.src.rpm">
          <filename>firefox-140.14.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8a8b584c2d69510355f8a2d096e5851fb46c96f45e291b266ee2fdda120239f5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:58902</id>
    <title>Important: python3.12 security update</title>
    <issued date="2026-08-24 00:00:00"/>
    <updated date="2026-08-25 08:36:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.12 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:58902" id="RHSA-2026:58902" type="rhsa" title="RHSA-2026:58902"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11940" id="CVE-2026-11940" type="cve" title="CVE-2026-11940"/>
      <reference href="https://bugzilla.redhat.com/2491848" id="2491848" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-58902.html" id="ALSA-2026:58902" type="self" title="ALSA-2026:58902"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python-unversioned-command" version="3.12.14" release="1.el10_2" epoch="0" arch="noarch" src="python3.12-3.12.14-1.el10_2.src.rpm">
          <filename>python-unversioned-command-3.12.14-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">432002d2f2d16400a23c31dbfa20b3800372adba8054dfdfcb8877898640e6a9</sum>
        </package>
        <package name="python3-devel" version="3.12.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="python3.12-3.12.14-1.el10_2.src.rpm">
          <filename>python3-devel-3.12.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5815e14aac1297033c18aef37d186e618e68eb430ab8710d39ad59f30dcfa66a</sum>
        </package>
        <package name="python3-tkinter" version="3.12.14" release="1.el10_2" epoch="0" arch="x86_64_v2" src="python3.12-3.12.14-1.el10_2.src.rpm">
          <filename>python3-tkinter-3.12.14-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">6ec8c395063b2b5412a30939532c5bc79ef85c8201d17c0ab970bb4c43d1763a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:58927</id>
    <title>Important: sqlite security update</title>
    <issued date="2026-08-24 00:00:00"/>
    <updated date="2026-08-26 07:44:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>sqlite security update</summary>
    <description>SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.  

Security Fix(es):  

  * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:58927" id="RHSA-2026:58927" type="rhsa" title="RHSA-2026:58927"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11822" id="CVE-2026-11822" type="cve" title="CVE-2026-11822"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11824" id="CVE-2026-11824" type="cve" title="CVE-2026-11824"/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-58927.html" id="ALSA-2026:58927" type="self" title="ALSA-2026:58927"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="sqlite-devel" version="3.46.1" release="6.el10_2" epoch="0" arch="x86_64_v2" src="sqlite-3.46.1-6.el10_2.src.rpm">
          <filename>sqlite-devel-3.46.1-6.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5d53eaef7408b6197a194c5ee9e6078f11a083dcf9596b056de9402edc7d6300</sum>
        </package>
        <package name="sqlite" version="3.46.1" release="6.el10_2" epoch="0" arch="x86_64_v2" src="sqlite-3.46.1-6.el10_2.src.rpm">
          <filename>sqlite-3.46.1-6.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">7007c70dd0690d506723a6a1e3afcdbfb3392f7825544223afaecde07edf8718</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:58928</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-08-24 00:00:00"/>
    <updated date="2026-08-25 08:35:49"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:58928" id="RHSA-2026:58928" type="rhsa" title="RHSA-2026:58928"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11940" id="CVE-2026-11940" type="cve" title="CVE-2026-11940"/>
      <reference href="https://bugzilla.redhat.com/2491848" id="2491848" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-58928.html" id="ALSA-2026:58928" type="self" title="ALSA-2026:58928"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3.14" version="3.14.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.7-2.el10_2.src.rpm">
          <filename>python3.14-3.14.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0f5170d0d4a6366b8721c4e9c2122707c5ef8e407bcd01bb515afbaf575870f6</sum>
        </package>
        <package name="python3.14-tkinter" version="3.14.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.7-2.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">14656cd8159c0c8cf04fb037dd2ab6f33c58d8a04c18fc15560e3a1b1a8aa36f</sum>
        </package>
        <package name="python3.14-devel" version="3.14.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.7-2.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d2627eab63db07e0cc6189f94513b985590f889d1900aec72b88ed8e5d71d0c8</sum>
        </package>
        <package name="python3.14-libs" version="3.14.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.7-2.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f4ee533350ccabedf24477c74ad639fa180c0ba0faa31aff8486f0b857bb606c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:59097</id>
    <title>Important: gstreamer1-plugins-base security update</title>
    <issued date="2026-08-24 00:00:00"/>
    <updated date="2026-08-25 08:35:08"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-base security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.  

Security Fix(es):  

  * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:59097" id="RHSA-2026:59097" type="rhsa" title="RHSA-2026:59097"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-18297" id="CVE-2026-18297" type="cve" title="CVE-2026-18297"/>
      <reference href="https://bugzilla.redhat.com/2520572" id="2520572" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-59097.html" id="ALSA-2026:59097" type="self" title="ALSA-2026:59097"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-base" version="1.26.7" release="2.el10_2.1" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-base-1.26.7-2.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">76e1fcf30067018588baa1b5d2e8f8685c4f976550c42bf538cb3664f55f9173</sum>
        </package>
        <package name="gstreamer1-plugins-base-devel" version="1.26.7" release="2.el10_2.1" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-base-devel-1.26.7-2.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">8f086f61ed7ee62768cbf969403c483ff98b6ebe463df03fcd2f9f58a147d417</sum>
        </package>
        <package name="gstreamer1-plugins-base-tools" version="1.26.7" release="2.el10_2.1" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-base-tools-1.26.7-2.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">f11eee3f7a7a725bbb3a781b3d650dd78e8526faca1a8e357ed6c54ca1b8a3d9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:59133</id>
    <title>Important: gstreamer1-plugins-good security update</title>
    <issued date="2026-08-24 00:00:00"/>
    <updated date="2026-08-26 07:45:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-good security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  

Security Fix(es):  

  * gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)
  * gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:59133" id="RHSA-2026:59133" type="rhsa" title="RHSA-2026:59133"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-18296" id="CVE-2026-18296" type="cve" title="CVE-2026-18296"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-18298" id="CVE-2026-18298" type="cve" title="CVE-2026-18298"/>
      <reference href="https://bugzilla.redhat.com/2520580" id="2520580" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2520590" id="2520590" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-59133.html" id="ALSA-2026:59133" type="self" title="ALSA-2026:59133"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-good-gtk" version="1.26.7" release="2.el10_2.7" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.7.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">8ed512a0799d9986cdbc4e1986b3cd55e13bb66156e8dba7bacb90d2d3b0ebbe</sum>
        </package>
        <package name="gstreamer1-plugins-good" version="1.26.7" release="2.el10_2.7" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.7.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.7.x86_64_v2.rpm</filename>
          <sum type="sha256">f762530391bf3d0d7ef9282051decac296674842f181ccb623d082e05751edfb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:59220</id>
    <title>Important: nginx security update</title>
    <issued date="2026-08-24 00:00:00"/>
    <updated date="2026-08-25 08:34:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)
  * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:59220" id="RHSA-2026:59220" type="rhsa" title="RHSA-2026:59220"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56434" id="CVE-2026-56434" type="cve" title="CVE-2026-56434"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60005" id="CVE-2026-60005" type="cve" title="CVE-2026-60005"/>
      <reference href="https://bugzilla.redhat.com/2500960" id="2500960" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500992" id="2500992" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-59220.html" id="ALSA-2026:59220" type="self" title="ALSA-2026:59220"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nginx-all-modules" version="1.26.3" release="6.el10_2.6" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.6.noarch.rpm</filename>
          <sum type="sha256">0ee1da66b42d7a7309fa3e289c5fb632caccf67d24aeab9708c03be35a50dd93</sum>
        </package>
        <package name="nginx-filesystem" version="1.26.3" release="6.el10_2.6" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.6.noarch.rpm</filename>
          <sum type="sha256">6a4302dfb7471b2cc3f0c8e4f7944909387b627464c4efe14fde80d576b946c0</sum>
        </package>
        <package name="nginx-mod-http-perl" version="1.26.3" release="6.el10_2.6" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">7350697101a72237173d7ea4798bf901635b1ca9293e4c725f06e01fedaa1da6</sum>
        </package>
        <package name="nginx" version="1.26.3" release="6.el10_2.6" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">9aef8c594e11bee61bce014aba925d26f1706d325a2307c7ea3dfd83b6a0d984</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" version="1.26.3" release="6.el10_2.6" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">a7353db721d03132a98c440eb4ffae49f0cdb5e870e8d45e121470e4e34ceb3c</sum>
        </package>
        <package name="nginx-mod-mail" version="1.26.3" release="6.el10_2.6" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">b3a48fd22613dc9aaad09fb5caa45bd95b97de3cbc5725eb4887cfbdae08c009</sum>
        </package>
        <package name="nginx-core" version="1.26.3" release="6.el10_2.6" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">b9991cb5d529414800e60ef962432003fea817a6b1d52cfed2162b8edb29c22e</sum>
        </package>
        <package name="nginx-mod-http-image-filter" version="1.26.3" release="6.el10_2.6" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">bb845ba053ecd84d4233296adf0e215cb06b752b68659ff78354e8e597f3a504</sum>
        </package>
        <package name="nginx-mod-stream" version="1.26.3" release="6.el10_2.6" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">fed1a89d39e328b940926f6d25122811471db926729d504a22a56eb178f3cb8e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:59243</id>
    <title>Important: python-pyasn1 security update</title>
    <issued date="2026-08-25 00:00:00"/>
    <updated date="2026-08-25 08:31:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python-pyasn1 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:59243" id="RHSA-2026:59243" type="rhsa" title="RHSA-2026:59243"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59886" id="CVE-2026-59886" type="cve" title="CVE-2026-59886"/>
      <reference href="https://bugzilla.redhat.com/2500041" id="2500041" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-59243.html" id="ALSA-2026:59243" type="self" title="ALSA-2026:59243"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="python3-pyasn1-modules" version="0.6.2" release="1.el10_2.1" epoch="0" arch="noarch" src="python-pyasn1-0.6.2-1.el10_2.1.src.rpm">
          <filename>python3-pyasn1-modules-0.6.2-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">05edb19dae2edc37e82548abae6af2808fd01ad0c9fb7d6e914cb343e2182e02</sum>
        </package>
        <package name="python3-pyasn1" version="0.6.2" release="1.el10_2.1" epoch="0" arch="noarch" src="python-pyasn1-0.6.2-1.el10_2.1.src.rpm">
          <filename>python3-pyasn1-0.6.2-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">5a44c6804ccdde9b93b518b3d47f1187e4ee407ae6a058b986bc2fa52399e8bc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:59372</id>
    <title>Moderate: assertj-core security update</title>
    <issued date="2026-08-25 00:00:00"/>
    <updated date="2026-08-26 15:47:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>assertj-core security update</summary>
    <description>A rich and intuitive set of strongly-typed assertions to use for unit testing (either with JUnit or TestNG).  

Security Fix(es):  

  * assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:59372" id="RHSA-2026:59372" type="rhsa" title="RHSA-2026:59372"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-24400" id="CVE-2026-24400" type="cve" title="CVE-2026-24400"/>
      <reference href="https://bugzilla.redhat.com/2433116" id="2433116" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-59372.html" id="ALSA-2026:59372" type="self" title="ALSA-2026:59372"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="assertj-core" version="3.24.2" release="9.el10_2.1" epoch="0" arch="noarch" src="assertj-core-3.24.2-9.el10_2.1.src.rpm">
          <filename>assertj-core-3.24.2-9.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">2001c3bdd1cac076d06f46697038efbcaea5ed8fff25714109166daf9b16ee5c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:59379</id>
    <title>Moderate: pam security update</title>
    <issued date="2026-08-25 00:00:00"/>
    <updated date="2026-08-26 07:45:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>pam security update</summary>
    <description>Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.  

Security Fix(es):  

  * linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:59379" id="RHSA-2026:59379" type="rhsa" title="RHSA-2026:59379"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-54411" id="CVE-2026-54411" type="cve" title="CVE-2026-54411"/>
      <reference href="https://bugzilla.redhat.com/2488766" id="2488766" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-59379.html" id="ALSA-2026:59379" type="self" title="ALSA-2026:59379"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="pam-devel" version="1.6.1" release="9.el10_2.1" epoch="0" arch="x86_64_v2" src="pam-1.6.1-9.el10_2.1.src.rpm">
          <filename>pam-devel-1.6.1-9.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">129f98931d01ac366ec413def0cbbb003175c13dff2f987dc34c8e7709de2a2c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:59380</id>
    <title>Moderate: attr security update</title>
    <issued date="2026-08-25 00:00:00"/>
    <updated date="2026-08-26 07:45:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>attr security update</summary>
    <description>The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.  

Security Fix(es):  

  * attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:59380" id="RHSA-2026:59380" type="rhsa" title="RHSA-2026:59380"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-54371" id="CVE-2026-54371" type="cve" title="CVE-2026-54371"/>
      <reference href="https://bugzilla.redhat.com/2490283" id="2490283" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-59380.html" id="ALSA-2026:59380" type="self" title="ALSA-2026:59380"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libattr-devel" version="2.6.0" release="1.el10_2" epoch="0" arch="x86_64_v2" src="attr-2.6.0-1.el10_2.src.rpm">
          <filename>libattr-devel-2.6.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">94f0b9d2b4d83423a7fec6defe8bc07f659c28e2c51c167229eed854ea078fe6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:59972</id>
    <title>Important: gstreamer1-plugins-good security update</title>
    <issued date="2026-08-26 00:00:00"/>
    <updated date="2026-08-26 14:40:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-good security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  

Security Fix(es):  

  * gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:59972" id="RHSA-2026:59972" type="rhsa" title="RHSA-2026:59972"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-18299" id="CVE-2026-18299" type="cve" title="CVE-2026-18299"/>
      <reference href="https://bugzilla.redhat.com/2520605" id="2520605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-59972.html" id="ALSA-2026:59972" type="self" title="ALSA-2026:59972"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-good-gtk" version="1.26.7" release="2.el10_2.8" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.8.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.8.x86_64_v2.rpm</filename>
          <sum type="sha256">c9902bafc2742ad68689ca646e625212f728018d5d73f43fb4595507995c7b20</sum>
        </package>
        <package name="gstreamer1-plugins-good" version="1.26.7" release="2.el10_2.8" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.8.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.8.x86_64_v2.rpm</filename>
          <sum type="sha256">f8def2d456b9152de50359f536d5b771d2e33077fcee89037c600a1b0c9514c3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:59997</id>
    <title>Moderate: polkit security update</title>
    <issued date="2026-08-26 00:00:00"/>
    <updated date="2026-08-26 14:00:54"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>polkit security update</summary>
    <description>The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.  

Security Fix(es):  

  * polkit: Polkit: Denial of Service via unbounded input processing through standard input (CVE-2026-4897)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:59997" id="RHSA-2026:59997" type="rhsa" title="RHSA-2026:59997"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4897" id="CVE-2026-4897" type="cve" title="CVE-2026-4897"/>
      <reference href="https://bugzilla.redhat.com/2451739" id="2451739" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-59997.html" id="ALSA-2026:59997" type="self" title="ALSA-2026:59997"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="polkit-docs" version="125" release="4.el10_2.1" epoch="0" arch="noarch" src="polkit-125-4.el10_2.1.src.rpm">
          <filename>polkit-docs-125-4.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">305e34938bffb0db90d5a6ec9e239162450d0c39bf641873dcc7b0598bf2930e</sum>
        </package>
        <package name="polkit-devel" version="125" release="4.el10_2.1" epoch="0" arch="x86_64_v2" src="polkit-125-4.el10_2.1.src.rpm">
          <filename>polkit-devel-125-4.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">6b12a96c5a56e6ef4c101659bc7fa530e55866c18a59afe183df355fb8f7545f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:60004</id>
    <title>Low: httpd security update</title>
    <issued date="2026-08-26 00:00:00"/>
    <updated date="2026-08-27 08:10:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>httpd security update</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  

Security Fix(es):  

  * httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:60004" id="RHSA-2026:60004" type="rhsa" title="RHSA-2026:60004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29167" id="CVE-2026-29167" type="cve" title="CVE-2026-29167"/>
      <reference href="https://bugzilla.redhat.com/2486394" id="2486394" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-60004.html" id="ALSA-2026:60004" type="self" title="ALSA-2026:60004"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="httpd-devel" version="2.4.63" release="13.el10_2.6" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>httpd-devel-2.4.63-13.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">01f2fb5070151f4c24dda816a7cef9eeae72eb015fe5ab7bb4317d42dc26fa8f</sum>
        </package>
        <package name="httpd-filesystem" version="2.4.63" release="13.el10_2.6" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.6.noarch.rpm</filename>
          <sum type="sha256">2d887c9658de80e5f018347a72ff0e89acbb079bbd7a748b53ca6594ecae718a</sum>
        </package>
        <package name="httpd-core" version="2.4.63" release="13.el10_2.6" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>httpd-core-2.4.63-13.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">321e8df915e47e7933d12ac194455a5055daef2a11e93bcdcb871176b13aeca4</sum>
        </package>
        <package name="mod_ssl" version="2.4.63" release="13.el10_2.6" epoch="1" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>mod_ssl-2.4.63-13.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">391ab704c56f04a0ca0f7b3f02bf2e6b745269c468138820e7ce18566a1e5790</sum>
        </package>
        <package name="mod_ldap" version="2.4.63" release="13.el10_2.6" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>mod_ldap-2.4.63-13.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">4e86d009194f23426a66b102985d9d6d334f67980ba2160e9a57d7025b3ccd29</sum>
        </package>
        <package name="mod_lua" version="2.4.63" release="13.el10_2.6" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>mod_lua-2.4.63-13.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">62a0801734e88d682cc428a07428a66e7990afdc5aed185826c8ddcfbdf5f078</sum>
        </package>
        <package name="httpd-manual" version="2.4.63" release="13.el10_2.6" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.6.noarch.rpm</filename>
          <sum type="sha256">69567bdd1024b64882fe35313f7a8f2549cab4b9a577ea66ad31608c30f9ff84</sum>
        </package>
        <package name="httpd-tools" version="2.4.63" release="13.el10_2.6" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>httpd-tools-2.4.63-13.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">6cdaad7c70f23c03f21825d82be93cd016c1d69f4b41fb29aea88c70d1f4127b</sum>
        </package>
        <package name="mod_session" version="2.4.63" release="13.el10_2.6" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>mod_session-2.4.63-13.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">c72c9c605553fd3d56a656ce03ab915c314f53365f4423083dfc8faf8714943c</sum>
        </package>
        <package name="mod_proxy_html" version="2.4.63" release="13.el10_2.6" epoch="1" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>mod_proxy_html-2.4.63-13.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">ca2e6b3591f48c641a0616de1184be0fbce371d8f0dc25cdff914df4ecb73867</sum>
        </package>
        <package name="httpd" version="2.4.63" release="13.el10_2.6" epoch="0" arch="x86_64_v2" src="httpd-2.4.63-13.el10_2.6.src.rpm">
          <filename>httpd-2.4.63-13.el10_2.6.x86_64_v2.rpm</filename>
          <sum type="sha256">ddfa9895482fe3316717bee4190d89f23af12062fd891249b241a322dbcebbdf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:60306</id>
    <title>Important: golang security, bug fix, and enhancement update</title>
    <issued date="2026-08-26 00:00:00"/>
    <updated date="2026-08-27 08:19:16"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>golang security, bug fix, and enhancement update</summary>
    <description>The golang packages provide the Go programming language compiler.  

Security Fix(es):  

  * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
  * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)


Bug Fix(es) and Enhancement(s):  

  * Update Go to version 1.26.7+1 [almalinux-10.2.z] (JIRA:AlmaLinux-246423)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:60306" id="RHSA-2026:60306" type="rhsa" title="RHSA-2026:60306"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33818" id="CVE-2026-33818" type="cve" title="CVE-2026-33818"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56853" id="CVE-2026-56853" type="cve" title="CVE-2026-56853"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56858" id="CVE-2026-56858" type="cve" title="CVE-2026-56858"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56859" id="CVE-2026-56859" type="cve" title="CVE-2026-56859"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56860" id="CVE-2026-56860" type="cve" title="CVE-2026-56860"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56862" id="CVE-2026-56862" type="cve" title="CVE-2026-56862"/>
      <reference href="https://bugzilla.redhat.com/2515815" id="2515815" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515820" id="2515820" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515827" id="2515827" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515838" id="2515838" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515839" id="2515839" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515840" id="2515840" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-60306.html" id="ALSA-2026:60306" type="self" title="ALSA-2026:60306"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="golang-misc" version="1.26.7" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.7-1.el10_2.alma.1.src.rpm">
          <filename>golang-misc-1.26.7-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">1923dd6592518a5d2f4e4eef0ff7f7bf3b611a49230e03cd40caa092e84f83c5</sum>
        </package>
        <package name="golang-tests" version="1.26.7" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.7-1.el10_2.alma.1.src.rpm">
          <filename>golang-tests-1.26.7-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">2cd7fa5d945a940c336d1817cb06f166edf8869a955ca3e7b5638d0f77886aea</sum>
        </package>
        <package name="golang" version="1.26.7" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.7-1.el10_2.alma.1.src.rpm">
          <filename>golang-1.26.7-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">2ebf95fd9e8631ac843b41a40c18515c65e72ef9209233871ddc94407acbb3f8</sum>
        </package>
        <package name="golang-docs" version="1.26.7" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.7-1.el10_2.alma.1.src.rpm">
          <filename>golang-docs-1.26.7-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">36167694db02b79aff2148f3934c8d4bd287c3615d93d5a40f6356796ff2e299</sum>
        </package>
        <package name="golang-race" version="1.26.7" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.7-1.el10_2.alma.1.src.rpm">
          <filename>golang-race-1.26.7-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">8b741f53c1421caf9ae067584bc0e5e4fdfbf27267192c4770043e9a970017bc</sum>
        </package>
        <package name="go-toolset" version="1.26.7" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.7-1.el10_2.alma.1.src.rpm">
          <filename>go-toolset-1.26.7-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">d758ab466a82e3e01c8f21ad4b04bc101bacc936654b7c6b9e53d6f996330240</sum>
        </package>
        <package name="golang-src" version="1.26.7" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.7-1.el10_2.alma.1.src.rpm">
          <filename>golang-src-1.26.7-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">db81e8b2dcb9cce76b60048edd375ec23e8fb6a055cbceb28ee21bb48274cc6e</sum>
        </package>
        <package name="golang-bin" version="1.26.7" release="1.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="golang-1.26.7-1.el10_2.alma.1.src.rpm">
          <filename>golang-bin-1.26.7-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">f364b3570118b80208543122c4f589c0b72a1c9c82fadaa90caa3afbacee2789</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:60394</id>
    <title>Moderate: libxml2 security update</title>
    <issued date="2026-08-26 00:00:00"/>
    <updated date="2026-08-28 08:44:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libxml2 security update</summary>
    <description>The libxml2 library is a development toolbox providing the implementation of various XML standards.  

Security Fix(es):  

  * libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:60394" id="RHSA-2026:60394" type="rhsa" title="RHSA-2026:60394"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11979" id="CVE-2026-11979" type="cve" title="CVE-2026-11979"/>
      <reference href="https://bugzilla.redhat.com/2494191" id="2494191" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-60394.html" id="ALSA-2026:60394" type="self" title="ALSA-2026:60394"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="libxml2-devel" version="2.12.5" release="10.el10_2.3" epoch="0" arch="x86_64_v2" src="libxml2-2.12.5-10.el10_2.3.src.rpm">
          <filename>libxml2-devel-2.12.5-10.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">3e953e3436f7f7956a476a2c005e6be396d1e7e1415d60cd2a4787f606b24afe</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:61376</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-08-31 00:00:00"/>
    <updated date="2026-09-01 08:42:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs22 security update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.  

Security Fix(es):  

  * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
  * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
  * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:61376" id="RHSA-2026:61376" type="rhsa" title="RHSA-2026:61376"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56846" id="CVE-2026-56846" type="cve" title="CVE-2026-56846"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56848" id="CVE-2026-56848" type="cve" title="CVE-2026-56848"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58043" id="CVE-2026-58043" type="cve" title="CVE-2026-58043"/>
      <reference href="https://bugzilla.redhat.com/2509171" id="2509171" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510856" id="2510856" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-61376.html" id="ALSA-2026:61376" type="self" title="ALSA-2026:61376"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs-devel" version="22.23.2" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.2-1.el10_2.src.rpm">
          <filename>nodejs-devel-22.23.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1b45c899a6632b8ac813b1a0867e3310fad522dfcd5a75f17ec4b08858880c2c</sum>
        </package>
        <package name="nodejs-npm" version="10.9.8" release="1.22.23.2.1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.2-1.el10_2.src.rpm">
          <filename>nodejs-npm-10.9.8-1.22.23.2.1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">23ea80cd46c7df768c5b302fb2adb4f9b3842f78417174198585b2d25d699237</sum>
        </package>
        <package name="nodejs-full-i18n" version="22.23.2" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.2-1.el10_2.src.rpm">
          <filename>nodejs-full-i18n-22.23.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3f2dfb8b07c38fd2d9d9719796d0772b4c922ed825feff69d436c3d487ae6c21</sum>
        </package>
        <package name="nodejs" version="22.23.2" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.2-1.el10_2.src.rpm">
          <filename>nodejs-22.23.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">89bd1ef7ee09f17db42700cd9940ec74ec253ba380f7058b936981403bd9b565</sum>
        </package>
        <package name="nodejs-libs" version="22.23.2" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs22-22.23.2-1.el10_2.src.rpm">
          <filename>nodejs-libs-22.23.2-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">bb68d290def26ff11ebf4edb34480c9b0c41171dc6916eb86c824671215fef15</sum>
        </package>
        <package name="nodejs-docs" version="22.23.2" release="1.el10_2" epoch="1" arch="noarch" src="nodejs22-22.23.2-1.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.2-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">c9f5cc58213b857b0d4326ca1f1f1fd1cda4ecc64776646fcfb759c191300495</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:61377</id>
    <title>Important: nodejs24 security, bug fix, and enhancement update</title>
    <issued date="2026-08-31 00:00:00"/>
    <updated date="2026-09-01 10:13:59"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs24 security, bug fix, and enhancement update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  

Security Fix(es):  

  * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
  * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
  * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)


Bug Fix(es) and Enhancement(s):  

  * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-220543)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:61377" id="RHSA-2026:61377" type="rhsa" title="RHSA-2026:61377"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56846" id="CVE-2026-56846" type="cve" title="CVE-2026-56846"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56848" id="CVE-2026-56848" type="cve" title="CVE-2026-56848"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58043" id="CVE-2026-58043" type="cve" title="CVE-2026-58043"/>
      <reference href="https://bugzilla.redhat.com/2509171" id="2509171" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510856" id="2510856" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-61377.html" id="ALSA-2026:61377" type="self" title="ALSA-2026:61377"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="nodejs24-devel" version="24.19.0" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.19.0-1.el10_2.src.rpm">
          <filename>nodejs24-devel-24.19.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2379ae0df61fcc1f0ad2828de105527366343367a7e68c0420f303a10734bd13</sum>
        </package>
        <package name="nodejs24-libs" version="24.19.0" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.19.0-1.el10_2.src.rpm">
          <filename>nodejs24-libs-24.19.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">52300ed252fd0295b746717516bd8418cf7f0166db5b56ad5ba2b8dd6b349d4c</sum>
        </package>
        <package name="nodejs24-npm" version="11.17.0" release="1.24.19.0.1.el10_2" epoch="1" arch="noarch" src="nodejs24-24.19.0-1.el10_2.src.rpm">
          <filename>nodejs24-npm-11.17.0-1.24.19.0.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">afa3166dc5e00f1d8df5f85611a54b62dab8bd37e034efff70b640de418fbf6d</sum>
        </package>
        <package name="nodejs24-full-i18n" version="24.19.0" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.19.0-1.el10_2.src.rpm">
          <filename>nodejs24-full-i18n-24.19.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">b5a82a7b0ea12ecf1f0d85ab64c5cdc5c2482bf1848dab56a4a6670d3d9c3b82</sum>
        </package>
        <package name="nodejs24" version="24.19.0" release="1.el10_2" epoch="1" arch="x86_64_v2" src="nodejs24-24.19.0-1.el10_2.src.rpm">
          <filename>nodejs24-24.19.0-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">caae5f1865909b10c9ecd25f7956e91177935fc3f3970f69618d974255d161f6</sum>
        </package>
        <package name="nodejs24-docs" version="24.19.0" release="1.el10_2" epoch="1" arch="noarch" src="nodejs24-24.19.0-1.el10_2.src.rpm">
          <filename>nodejs24-docs-24.19.0-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">d3d3383f8710db59beae06da2be66237d330acc7d4a195352659f94e3a452149</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:61680</id>
    <title>Important: iperf3 security update</title>
    <issued date="2026-08-31 00:00:00"/>
    <updated date="2026-09-01 10:13:25"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>iperf3 security update</summary>
    <description>Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.  

Security Fix(es):  

  * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (CVE-2026-71217)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:61680" id="RHSA-2026:61680" type="rhsa" title="RHSA-2026:61680"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-71217" id="CVE-2026-71217" type="cve" title="CVE-2026-71217"/>
      <reference href="https://bugzilla.redhat.com/2460984" id="2460984" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-61680.html" id="ALSA-2026:61680" type="self" title="ALSA-2026:61680"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="iperf3" version="3.17.1" release="6.el10_2.1" epoch="0" arch="x86_64_v2" src="iperf3-3.17.1-6.el10_2.1.src.rpm">
          <filename>iperf3-3.17.1-6.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">2568b470c0cbf32ab51332433f7df6dab43c9b81599255272451da4cee4fde0e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:62142</id>
    <title>Moderate: wget security, bug fix, and enhancement update</title>
    <issued date="2026-09-01 00:00:00"/>
    <updated date="2026-09-02 09:08:03"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>wget security, bug fix, and enhancement update</summary>
    <description>The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.  

Security Fix(es):  

  * wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption (CVE-2026-58471)
  * wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute (CVE-2026-58472)


Bug Fix(es) and Enhancement(s):  

  * wget async unsafe code in signal handler context [almalinux-10.2.z] (JIRA:AlmaLinux-220498)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:62142" id="RHSA-2026:62142" type="rhsa" title="RHSA-2026:62142"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58471" id="CVE-2026-58471" type="cve" title="CVE-2026-58471"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58472" id="CVE-2026-58472" type="cve" title="CVE-2026-58472"/>
      <reference href="https://bugzilla.redhat.com/2497850" id="2497850" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2497857" id="2497857" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-62142.html" id="ALSA-2026:62142" type="self" title="ALSA-2026:62142"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="wget" version="1.24.5" release="8.el10_2" epoch="0" arch="x86_64_v2" src="wget-1.24.5-8.el10_2.src.rpm">
          <filename>wget-1.24.5-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">46c791ddc173d4e6bccfa9145df954c3cd70a90514698c1372c8b75987fa0919</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:62578</id>
    <title>Important: go-fdo-server security update</title>
    <issued date="2026-09-02 00:00:00"/>
    <updated date="2026-09-03 08:45:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>go-fdo-server security update</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.  

Security Fix(es):  

  * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
  * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:62578" id="RHSA-2026:62578" type="rhsa" title="RHSA-2026:62578"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33810" id="CVE-2026-33810" type="cve" title="CVE-2026-33810"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33818" id="CVE-2026-33818" type="cve" title="CVE-2026-33818"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56853" id="CVE-2026-56853" type="cve" title="CVE-2026-56853"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56860" id="CVE-2026-56860" type="cve" title="CVE-2026-56860"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56862" id="CVE-2026-56862" type="cve" title="CVE-2026-56862"/>
      <reference href="https://bugzilla.redhat.com/2456335" id="2456335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515815" id="2515815" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515820" id="2515820" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515827" id="2515827" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515839" id="2515839" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-62578.html" id="ALSA-2026:62578" type="self" title="ALSA-2026:62578"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="go-fdo-server-rendezvous" version="1.0.1" release="2.el10_2.4" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.4.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-2.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">0211aa299091abf4cfdbbe76f87520827c571e8db4a3770fdd0349a146e1d8c0</sum>
        </package>
        <package name="go-fdo-server" version="1.0.1" release="2.el10_2.4" epoch="0" arch="x86_64_v2" src="go-fdo-server-1.0.1-2.el10_2.4.src.rpm">
          <filename>go-fdo-server-1.0.1-2.el10_2.4.x86_64_v2.rpm</filename>
          <sum type="sha256">129618859d7e7e51555f1114292207f6bbb9f12aee014d76dedc91de3ddea775</sum>
        </package>
        <package name="go-fdo-server-manufacturer" version="1.0.1" release="2.el10_2.4" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.4.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-2.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">84881985faeb5b98d8a5aa9bcdf5c151015a891734684a6dfae3071d412b6e96</sum>
        </package>
        <package name="go-fdo-server-owner" version="1.0.1" release="2.el10_2.4" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.4.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-2.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">df71d99ab263c33a04002cecffd3691380cb99ec2d02cac000f9c35a6af35a83</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:62614</id>
    <title>Important: php security, bug fix, and enhancement update</title>
    <issued date="2026-09-02 00:00:00"/>
    <updated date="2026-09-02 14:05:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>php security, bug fix, and enhancement update</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.  

Security Fix(es):  

  * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)
  * php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260)


Bug Fix(es) and Enhancement(s):  

  * Rebase PHP to 8.3.33 for CVE-2026-17543 and CVE-2026-7260 in 10.2.z (JIRA:AlmaLinux-223946)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:62614" id="RHSA-2026:62614" type="rhsa" title="RHSA-2026:62614"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-17543" id="CVE-2026-17543" type="cve" title="CVE-2026-17543"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7260" id="CVE-2026-7260" type="cve" title="CVE-2026-7260"/>
      <reference href="https://bugzilla.redhat.com/2509254" id="2509254" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-62614.html" id="ALSA-2026:62614" type="self" title="ALSA-2026:62614"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="php-dba" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-dba-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">096fbe6ef5c68e7234db923d181a5207990da1bc6db371081f1089c5f08b4188</sum>
        </package>
        <package name="php-cli" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-cli-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0e4747d7cf661738af4d86f645e126ff481f9c00f0e5c4f6c87a763b818c9089</sum>
        </package>
        <package name="php-devel" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-devel-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0eaad2e848c9c2468252ffe330a0d49414d0a305bc9310fed98b86de22e05c30</sum>
        </package>
        <package name="php-embedded" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-embedded-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0f6db89328ee33d44258cebcc815e7b094703fc3fdea25a7935f92c9998bce2d</sum>
        </package>
        <package name="php-snmp" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-snmp-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">147a6dd4a86bcc7e0d4fa283c1ae9e08eda4d5518ece18bac4214ded0b99449d</sum>
        </package>
        <package name="php-bcmath" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-bcmath-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">1a108fe794d1e9347e9c5ad925745e708d92475245a993eb0a846b85e0acd111</sum>
        </package>
        <package name="php-soap" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-soap-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">219292020d4e07a33bd3ae9950fa337c9d60707845c34f2ca70e4f35dc000081</sum>
        </package>
        <package name="php-enchant" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-enchant-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">2bc9aebf64fbb63ce625afa845b3c007ce92a91c673d19e0559aa11cff9bd133</sum>
        </package>
        <package name="php-odbc" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-odbc-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">3b8358b1f541507bedeea50ec21502a9878574dc3b69f792196a87ec994dc606</sum>
        </package>
        <package name="php" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">4e4929816fe1f40ba24bfc4604044d8314e77179866536bc0f7cbff3a148148f</sum>
        </package>
        <package name="php-pgsql" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-pgsql-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">534f9fec7dee1ab76f3ec2646a37199cfc335bacda4f7b7d84626003880de02a</sum>
        </package>
        <package name="php-intl" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-intl-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">53f7434adacc136f21f64a9956da34bb1f9b1f6ed30aa103724897079669d763</sum>
        </package>
        <package name="php-mbstring" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-mbstring-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">54df09ac640da5bb0c80e41d0f360a3c4e8666e12760e0fa7709326fefd869e0</sum>
        </package>
        <package name="php-gmp" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-gmp-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5e57148d07aca22fff2cd3d35b49903835795f05e578de052608f81b5432636c</sum>
        </package>
        <package name="php-common" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-common-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">844edf952528c3b81c6e4f058e9605246dfb8d267da9180b53b7ba679edf157e</sum>
        </package>
        <package name="php-dbg" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-dbg-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">87185cd5abbae83564808a945c58d9af6867f199c9d32a43954391d308df188e</sum>
        </package>
        <package name="php-xml" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-xml-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8a7a27b51c4022e032d43ae91979660972fce6090b624f341d5125f312e37286</sum>
        </package>
        <package name="php-ldap" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-ldap-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9a7d90eafe411883070838be066e576ca9fa7910ebdd76616f37058c5b1723f7</sum>
        </package>
        <package name="php-mysqlnd" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-mysqlnd-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">9be1f00306fa8e0cee21f4ad702e02ad796cd0e536fb7ac46853a6bd8ac88029</sum>
        </package>
        <package name="php-opcache" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-opcache-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c07e904ede2b47f26e6d88d79b9b62df7f7a4505cc0c1a35a94896d1d6996717</sum>
        </package>
        <package name="php-pdo" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-pdo-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d0395845940963d68eb2cb17924e347fa8ab3fe66e73469979829601173ee261</sum>
        </package>
        <package name="php-gd" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-gd-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d1f1a4af4f966fcf6f8531e552619c5953bdfde1b42b3ff6e3cdbdbff186131b</sum>
        </package>
        <package name="php-ffi" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-ffi-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d4e4de4e8d326c9389a0599131b4f17cb797d60dd6b8993bfe39f745fc48c97a</sum>
        </package>
        <package name="php-process" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-process-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">db2b651685d9be0f2ac92024137fdaa16d63e2d9d9e7d13f4b64b497897daff1</sum>
        </package>
        <package name="php-fpm" version="8.3.33" release="1.el10_2" epoch="0" arch="x86_64_v2" src="php-8.3.33-1.el10_2.src.rpm">
          <filename>php-fpm-8.3.33-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">f044c3b9b86b8d80d38c5208c6e27dfbd162cb111b51916a3be1dd7ae907354b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:62631</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-09-02 00:00:00"/>
    <updated date="2026-09-03 08:39:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>golang-github-openprinting-ipp-usb security update</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables  
driverless support for USB devices capable of using IPP-over-USB protocol.  

Security Fix(es):  

  * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
  * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
  * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:62631" id="RHSA-2026:62631" type="rhsa" title="RHSA-2026:62631"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33818" id="CVE-2026-33818" type="cve" title="CVE-2026-33818"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42504" id="CVE-2026-42504" type="cve" title="CVE-2026-42504"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56853" id="CVE-2026-56853" type="cve" title="CVE-2026-56853"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56859" id="CVE-2026-56859" type="cve" title="CVE-2026-56859"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56860" id="CVE-2026-56860" type="cve" title="CVE-2026-56860"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56862" id="CVE-2026-56862" type="cve" title="CVE-2026-56862"/>
      <reference href="https://bugzilla.redhat.com/2484204" id="2484204" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515815" id="2515815" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515820" id="2515820" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515827" id="2515827" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515839" id="2515839" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2515840" id="2515840" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-62631.html" id="ALSA-2026:62631" type="self" title="ALSA-2026:62631"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-appstream-rpms__10_0_default</name>
        <package name="ipp-usb" version="0.9.27" release="7.el10_2.3" epoch="0" arch="x86_64_v2" src="golang-github-openprinting-ipp-usb-0.9.27-7.el10_2.3.src.rpm">
          <filename>ipp-usb-0.9.27-7.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">a761a88724f2a8bcb27a7d9e964ce31af4008307809b16d011fcc03578fdb6f0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>