<?xml version="1.0" encoding="UTF-8"?>
<updates>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18134</id>
    <title>Moderate: kernel security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-06-08 10:12:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)
  * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
  * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)
  * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)
  * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)
  * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)
  * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)
  * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)
  * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)
  * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)
  * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)
  * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)
  * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)
  * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
  * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
  * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)
  * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)
  * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
  * kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210)
  * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257)
  * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)
  * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)
  * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
  * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
  * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18134" id="RHSA-2026:18134" type="rhsa" title="RHSA-2026:18134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56633" id="CVE-2024-56633" type="cve" title="CVE-2024-56633"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-21839" id="CVE-2025-21839" type="cve" title="CVE-2025-21839"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-37980" id="CVE-2025-37980" type="cve" title="CVE-2025-37980"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38015" id="CVE-2025-38015" type="cve" title="CVE-2025-38015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38097" id="CVE-2025-38097" type="cve" title="CVE-2025-38097"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38166" id="CVE-2025-38166" type="cve" title="CVE-2025-38166"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38202" id="CVE-2025-38202" type="cve" title="CVE-2025-38202"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38267" id="CVE-2025-38267" type="cve" title="CVE-2025-38267"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38275" id="CVE-2025-38275" type="cve" title="CVE-2025-38275"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38279" id="CVE-2025-38279" type="cve" title="CVE-2025-38279"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38345" id="CVE-2025-38345" type="cve" title="CVE-2025-38345"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38346" id="CVE-2025-38346" type="cve" title="CVE-2025-38346"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38405" id="CVE-2025-38405" type="cve" title="CVE-2025-38405"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38441" id="CVE-2025-38441" type="cve" title="CVE-2025-38441"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38470" id="CVE-2025-38470" type="cve" title="CVE-2025-38470"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-39866" id="CVE-2025-39866" type="cve" title="CVE-2025-39866"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40034" id="CVE-2025-40034" type="cve" title="CVE-2025-40034"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40134" id="CVE-2025-40134" type="cve" title="CVE-2025-40134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40210" id="CVE-2025-40210" type="cve" title="CVE-2025-40210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40257" id="CVE-2025-40257" type="cve" title="CVE-2025-40257"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40320" id="CVE-2025-40320" type="cve" title="CVE-2025-40320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23040" id="CVE-2026-23040" type="cve" title="CVE-2026-23040"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23111" id="CVE-2026-23111" type="cve" title="CVE-2026-23111"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23210" id="CVE-2026-23210" type="cve" title="CVE-2026-23210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23243" id="CVE-2026-23243" type="cve" title="CVE-2026-23243"/>
      <reference href="https://bugzilla.redhat.com/2334549" id="2334549" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2350585" id="2350585" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2367614" id="2367614" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2373343" id="2373343" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376060" id="2376060" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376065" id="2376065" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376382" id="2376382" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379178" id="2379178" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379187" id="2379187" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379199" id="2379199" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379237" id="2379237" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379239" id="2379239" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383399" id="2383399" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383478" id="2383478" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383906" id="2383906" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2396940" id="2396940" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2406782" id="2406782" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2414468" id="2414468" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2416307" id="2416307" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2418880" id="2418880" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2419945" id="2419945" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436806" id="2436806" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439687" id="2439687" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439895" id="2439895" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448594" id="2448594" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18134.html" id="ALSA-2026:18134" type="self" title="ALSA-2026:18134"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.7.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">78db96b63b180a526d27658a5f66bd367e0d516ce72b83b9aa8ec6f642d3b051</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18142</id>
    <title>Low: NetworkManager security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>NetworkManager security update</summary>
    <description>NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.  

Security Fix(es):  

  * networkmanagr: NetworkManager File Access (CVE-2025-9615)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18142" id="RHSA-2026:18142" type="rhsa" title="RHSA-2026:18142"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-9615" id="CVE-2025-9615" type="cve" title="CVE-2025-9615"/>
      <reference href="https://bugzilla.redhat.com/2391503" id="2391503" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18142.html" id="ALSA-2026:18142" type="self" title="ALSA-2026:18142"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="NetworkManager-config-connectivity-redhat" version="1.56.0" release="1.el10" epoch="1" arch="noarch" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-config-connectivity-redhat-1.56.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">3c3510b6b69347004ae5092b71485721e86928b812cdbbb21a7a13cf2a6cf1ec</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18465</id>
    <title>Important: edk2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>edk2 security update</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   

Security Fix(es):  

  * edk2: EDK2: Improper Input Validation allows arbitrary command execution (CVE-2025-2296)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18465" id="RHSA-2026:18465" type="rhsa" title="RHSA-2026:18465"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-2296" id="CVE-2025-2296" type="cve" title="CVE-2025-2296"/>
      <reference href="https://bugzilla.redhat.com/2420637" id="2420637" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18465.html" id="ALSA-2026:18465" type="self" title="ALSA-2026:18465"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="edk2-ovmf" version="20251114" release="5.el10_2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">0440f37c3dfa7d8ed89074f19a592ec31ae69caf218c9c023a8e521cbedd1c05</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19017</id>
    <title>Important: podman security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19017" id="RHSA-2026:19017" type="rhsa" title="RHSA-2026:19017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455470" id="2455470" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19017.html" id="ALSA-2026:19017" type="self" title="ALSA-2026:19017"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="podman-docker" version="5.8.2" release="1.el10_2.alma.1" epoch="7" arch="noarch" src="podman-5.8.2-1.el10_2.alma.1.src.rpm">
          <filename>podman-docker-5.8.2-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">167be1b8d65574dac9045abe3e1e0b9208ed8e6c2c2c8b29b83d77c4173a468f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19022</id>
    <title>Important: golang security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>golang security update</summary>
    <description>The golang packages provide the Go programming language compiler.  

Security Fix(es):  

  * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19022" id="RHSA-2026:19022" type="rhsa" title="RHSA-2026:19022"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137"/>
      <reference href="https://bugzilla.redhat.com/2445345" id="2445345" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19022.html" id="ALSA-2026:19022" type="self" title="ALSA-2026:19022"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="golang-tests" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-tests-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">86ddbd7f00012fa580ea1c9edb33d9e5982eef71b38e0283ad2659fa61352095</sum>
        </package>
        <package name="golang-docs" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-docs-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">a7b9810b608f99d1d4e8dc8771e6e1493f6f39113e88f56ae83bd92548afe904</sum>
        </package>
        <package name="golang-src" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-src-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">dbf8e7996f83be39afa1954de0ab45d661a96b356a3e406a1960cd6be572a7bb</sum>
        </package>
        <package name="golang-misc" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-misc-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">ff930bc6ddd8d4469f1e7d1cab514142b71eff36da84ce419045251ce79e3e17</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19042</id>
    <title>Low: python-jwcrypto security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:39"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>python-jwcrypto security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19042" id="RHSA-2026:19042" type="rhsa" title="RHSA-2026:19042"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39373" id="CVE-2026-39373" type="cve" title="CVE-2026-39373"/>
      <reference href="https://bugzilla.redhat.com/2456187" id="2456187" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19042.html" id="ALSA-2026:19042" type="self" title="ALSA-2026:19042"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="python3-jwcrypto" version="1.5.6" release="5.el10_2" epoch="0" arch="noarch" src="python-jwcrypto-1.5.6-5.el10_2.src.rpm">
          <filename>python3-jwcrypto-1.5.6-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">db89aecbcd378aa983e05761a6b2cbca01c3a05e38a708730a9029e277498a12</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19054</id>
    <title>Important: tomcat security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:35:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>tomcat security update</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  

Security Fix(es):  

  * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19054" id="RHSA-2026:19054" type="rhsa" title="RHSA-2026:19054"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-24734" id="CVE-2026-24734" type="cve" title="CVE-2026-24734"/>
      <reference href="https://bugzilla.redhat.com/2440426" id="2440426" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19054.html" id="ALSA-2026:19054" type="self" title="ALSA-2026:19054"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="tomcat-jsp-3.1-api" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">032f9dfd26c60d1d72b363ff2061d11662e957528f62a47531f5bbf5f865b387</sum>
        </package>
        <package name="tomcat" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">30074a00cdb2fd116e1a86d0dd4fde4c0ee1ad6c1d76871cede1af36c10ad784</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">910908c4cbeb19192b15b52ff7bcb553a79de45a9fd931d50fa458956364dc8c</sum>
        </package>
        <package name="tomcat-el-5.0-api" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">a4ea29cfcc7dc0b39309a55f0cb9f6825d1b6965da13f87f41af81d7293301e1</sum>
        </package>
        <package name="tomcat-lib" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-lib-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">bf8d00201d00c1d371bcb29fde0b79354efbec1bdd757baaebc03477a5d83d5c</sum>
        </package>
        <package name="tomcat-docs-webapp" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">cd1899698b4ef517e177bafdcbdb1e1542a1f0c867d8b7fefb87b3e46b4b54bf</sum>
        </package>
        <package name="tomcat-admin-webapps" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">d5a2b5453e34039aa491637abe23194a845e0a52cb69be855ed09fbc360ed9f7</sum>
        </package>
        <package name="tomcat-webapps" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">fdbfa914a61bc11297a055cca8ba8bb8c9d37d90b771583e8b8b87d3a7a388c7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19061</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:39"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
  * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19061" id="RHSA-2026:19061" type="rhsa" title="RHSA-2026:19061"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4437" id="CVE-2026-4437" type="cve" title="CVE-2026-4437"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4438" id="CVE-2026-4438" type="cve" title="CVE-2026-4438"/>
      <reference href="https://bugzilla.redhat.com/2449777" id="2449777" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449783" id="2449783" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19061.html" id="ALSA-2026:19061" type="self" title="ALSA-2026:19061"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="glibc-doc" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-121.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8e5944044c77883ffcdf699a95b72c6bb5ec1b40fe769362ba84948c5c446f4b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19064</id>
    <title>Important: python3.12 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.12 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
  * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
  * cpython: Out-of-memory when loading Plist (CVE-2025-13837)
  * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
  * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19064" id="RHSA-2026:19064" type="rhsa" title="RHSA-2026:19064"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13837" id="CVE-2025-13837" type="cve" title="CVE-2025-13837"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-15282" id="CVE-2025-15282" type="cve" title="CVE-2025-15282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-59375" id="CVE-2025-59375" type="cve" title="CVE-2025-59375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-6075" id="CVE-2025-6075" type="cve" title="CVE-2025-6075"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0672" id="CVE-2026-0672" type="cve" title="CVE-2026-0672"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100"/>
      <reference href="https://bugzilla.redhat.com/2395108" id="2395108" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2408891" id="2408891" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2418084" id="2418084" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431366" id="2431366" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431374" id="2431374" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2444691" id="2444691" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448168" id="2448168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448181" id="2448181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449649" id="2449649" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457409" id="2457409" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457932" id="2457932" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19064.html" id="ALSA-2026:19064" type="self" title="ALSA-2026:19064"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="python-unversioned-command" version="3.12.13" release="2.el10_2" epoch="0" arch="noarch" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python-unversioned-command-3.12.13-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">e02dd9af1061d81e9eb4f3b2ab2cee1f8bcaa3917c0c834b9885fbcb4199da2e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19068</id>
    <title>Moderate: systemd security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>systemd security update</summary>
    <description>The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.  

Security Fix(es):  

  * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19068" id="RHSA-2026:19068" type="rhsa" title="RHSA-2026:19068"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29111" id="CVE-2026-29111" type="cve" title="CVE-2026-29111"/>
      <reference href="https://bugzilla.redhat.com/2450505" id="2450505" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19068.html" id="ALSA-2026:19068" type="self" title="ALSA-2026:19068"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="systemd-ukify" version="257" release="23.el10_2.1.alma.1" epoch="0" arch="noarch" src="systemd-257-23.el10_2.1.alma.1.src.rpm">
          <filename>systemd-ukify-257-23.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">b19a2e5d5ceb000880e9a0b2e332123c6cc5f6052003d8b27a6230bc528bca3a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19074</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060)
  * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
  * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677)
  * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19074" id="RHSA-2026:19074" type="rhsa" title="RHSA-2026:19074"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23060" id="CVE-2026-23060" type="cve" title="CVE-2026-23060"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31431" id="CVE-2026-31431" type="cve" title="CVE-2026-31431"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31677" id="CVE-2026-31677" type="cve" title="CVE-2026-31677"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43284" id="CVE-2026-43284" type="cve" title="CVE-2026-43284"/>
      <reference href="https://bugzilla.redhat.com/2436779" id="2436779" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460538" id="2460538" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461763" id="2461763" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467771" id="2467771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19074.html" id="ALSA-2026:19074" type="self" title="ALSA-2026:19074"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.7.3.el10_2.noarch.rpm</filename>
          <sum type="sha256">2a68239ba7e1ffded8f59859942aad0efdfdc10912c47834975a6dd22a799961</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19137</id>
    <title>Important: go-fdo-server security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:16"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>go-fdo-server security update</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.  

Security Fix(es):  

  * github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19137" id="RHSA-2026:19137" type="rhsa" title="RHSA-2026:19137"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33816" id="CVE-2026-33816" type="cve" title="CVE-2026-33816"/>
      <reference href="https://bugzilla.redhat.com/2455972" id="2455972" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19137.html" id="ALSA-2026:19137" type="self" title="ALSA-2026:19137"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="go-fdo-server-rendezvous" version="1.0.1" release="1.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">2f723b54c36ddf004e4bea960e425128bf2d983f8a3113e157997f07bad4fa7a</sum>
        </package>
        <package name="go-fdo-server-owner" version="1.0.1" release="1.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">4fdde5d0f325c9777d1a0493b93f5f958290c8b3b8c46095516d2e7e8ea2d03e</sum>
        </package>
        <package name="go-fdo-server-manufacturer" version="1.0.1" release="1.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">503719bae2e16f1ef8bfb6389d8210cb55c14a40a4f7f7f00e40c82bfd1f8095</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19152</id>
    <title>Important: rsync security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>rsync security update</summary>
    <description>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  

Security Fix(es):  

  * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19152" id="RHSA-2026:19152" type="rhsa" title="RHSA-2026:19152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41035" id="CVE-2026-41035" type="cve" title="CVE-2026-41035"/>
      <reference href="https://bugzilla.redhat.com/2458898" id="2458898" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19152.html" id="ALSA-2026:19152" type="self" title="ALSA-2026:19152"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="rsync-rrsync" version="3.4.1" release="6.el10_2" epoch="0" arch="noarch" src="rsync-3.4.1-6.el10_2.src.rpm">
          <filename>rsync-rrsync-3.4.1-6.el10_2.noarch.rpm</filename>
          <sum type="sha256">6ce73c87a6758941f9efbd47f3a5dd2a2ea31d8602fe86d9b50d137c2939e69a</sum>
        </package>
        <package name="rsync-daemon" version="3.4.1" release="6.el10_2" epoch="0" arch="noarch" src="rsync-3.4.1-6.el10_2.src.rpm">
          <filename>rsync-daemon-3.4.1-6.el10_2.noarch.rpm</filename>
          <sum type="sha256">9f76d6a1f61310d5e7fb2cad97fccf750d8a2777db08a53fec77160350cf917f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19159</id>
    <title>Critical: nginx security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19159" id="RHSA-2026:19159" type="rhsa" title="RHSA-2026:19159"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42945" id="CVE-2026-42945" type="cve" title="CVE-2026-42945"/>
      <reference href="https://bugzilla.redhat.com/2477116" id="2477116" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19159.html" id="ALSA-2026:19159" type="self" title="ALSA-2026:19159"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nginx-all-modules" version="1.26.3" release="6.el10_2.3" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">3f0c16ba9b852a8917cd5d6999e2c127f547446efc3c0f2cf3c5eefc43e389c4</sum>
        </package>
        <package name="nginx-filesystem" version="1.26.3" release="6.el10_2.3" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">8890f406349040013ca50201c62964d631bbd50b288c439c5ab1bfd5bafc9330</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19569</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-20 00:00:00"/>
    <updated date="2026-06-07 18:12:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
  * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)
  * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
  * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741)
  * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)
  * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401)
  * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
  * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
  * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)
  * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)
  * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)
  * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300)
  * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19569" id="RHSA-2026:19569" type="rhsa" title="RHSA-2026:19569"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56603" id="CVE-2024-56603" type="cve" title="CVE-2024-56603"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-39766" id="CVE-2025-39766" type="cve" title="CVE-2025-39766"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68724" id="CVE-2025-68724" type="cve" title="CVE-2025-68724"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68741" id="CVE-2025-68741" type="cve" title="CVE-2025-68741"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23270" id="CVE-2026-23270" type="cve" title="CVE-2026-23270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23401" id="CVE-2026-23401" type="cve" title="CVE-2026-23401"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31402" id="CVE-2026-31402" type="cve" title="CVE-2026-31402"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31408" id="CVE-2026-31408" type="cve" title="CVE-2026-31408"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31607" id="CVE-2026-31607" type="cve" title="CVE-2026-31607"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43128" id="CVE-2026-43128" type="cve" title="CVE-2026-43128"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43284" id="CVE-2026-43284" type="cve" title="CVE-2026-43284"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46300" id="CVE-2026-46300" type="cve" title="CVE-2026-46300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46333" id="CVE-2026-46333" type="cve" title="CVE-2026-46333"/>
      <reference href="https://bugzilla.redhat.com/2334439" id="2334439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2394648" id="2394648" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2424886" id="2424886" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2425046" id="2425046" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448745" id="2448745" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2453803" id="2453803" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454844" id="2454844" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455334" id="2455334" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461521" id="2461521" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467144" id="2467144" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467771" id="2467771" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477015" id="2477015" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477802" id="2477802" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19569.html" id="ALSA-2026:19569" type="self" title="ALSA-2026:19569"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.16.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">a30d005f590aa010563453b7942bdd2cfa63cee5945427cf1bda74dd421aed6b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20594</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-05-27 13:09:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20594" id="RHSA-2026:20594" type="rhsa" title="RHSA-2026:20594"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4046" id="CVE-2026-4046" type="cve" title="CVE-2026-4046"/>
      <reference href="https://bugzilla.redhat.com/2453117" id="2453117" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20594.html" id="ALSA-2026:20594" type="self" title="ALSA-2026:20594"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="glibc-doc" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-124.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">c589ecc76ade948f7fc3324ba9ed3bd004cb7f413e99688e10998fd997695708</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20693</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-05-27 12:56:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>mysql8.4 security update</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.  

Security Fix(es):  

  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004)
  * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238)
  * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236)
  * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304)
  * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20693" id="RHSA-2026:20693" type="rhsa" title="RHSA-2026:20693"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-21998" id="CVE-2026-21998" type="cve" title="CVE-2026-21998"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22001" id="CVE-2026-22001" type="cve" title="CVE-2026-22001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22002" id="CVE-2026-22002" type="cve" title="CVE-2026-22002"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22004" id="CVE-2026-22004" type="cve" title="CVE-2026-22004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22005" id="CVE-2026-22005" type="cve" title="CVE-2026-22005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22009" id="CVE-2026-22009" type="cve" title="CVE-2026-22009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22015" id="CVE-2026-22015" type="cve" title="CVE-2026-22015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22017" id="CVE-2026-22017" type="cve" title="CVE-2026-22017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34270" id="CVE-2026-34270" type="cve" title="CVE-2026-34270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34271" id="CVE-2026-34271" type="cve" title="CVE-2026-34271"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34276" id="CVE-2026-34276" type="cve" title="CVE-2026-34276"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34303" id="CVE-2026-34303" type="cve" title="CVE-2026-34303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34304" id="CVE-2026-34304" type="cve" title="CVE-2026-34304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34308" id="CVE-2026-34308" type="cve" title="CVE-2026-34308"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35236" id="CVE-2026-35236" type="cve" title="CVE-2026-35236"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35237" id="CVE-2026-35237" type="cve" title="CVE-2026-35237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35238" id="CVE-2026-35238" type="cve" title="CVE-2026-35238"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35239" id="CVE-2026-35239" type="cve" title="CVE-2026-35239"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35240" id="CVE-2026-35240" type="cve" title="CVE-2026-35240"/>
      <reference href="https://bugzilla.redhat.com/2460274" id="2460274" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460275" id="2460275" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460276" id="2460276" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460279" id="2460279" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460295" id="2460295" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460312" id="2460312" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460315" id="2460315" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460316" id="2460316" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460323" id="2460323" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460324" id="2460324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460325" id="2460325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460326" id="2460326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460329" id="2460329" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460335" id="2460335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460342" id="2460342" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460344" id="2460344" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460348" id="2460348" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460356" id="2460356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460358" id="2460358" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20693.html" id="ALSA-2026:20693" type="self" title="ALSA-2026:20693"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="mysql8.4-common" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-common-8.4.9-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">0d7ccc94e1089ffb6b3fbcd721eec0fed9e1f3494a20fd6d6458a4b6df88a845</sum>
        </package>
        <package name="mysql8.4-errmsg" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.9-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">1be911010c4913a85c01b874457f48ba4933cb9701ec3fe5760128223f810f45</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21433</id>
    <title>Important: httpd security update</title>
    <issued date="2026-05-27 00:00:00"/>
    <updated date="2026-05-28 12:35:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>httpd security update</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  

Security Fix(es):  

  * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
  * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
  * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
  * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
  * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21433" id="RHSA-2026:21433" type="rhsa" title="RHSA-2026:21433"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-28780" id="CVE-2026-28780" type="cve" title="CVE-2026-28780"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33007" id="CVE-2026-33007" type="cve" title="CVE-2026-33007"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33857" id="CVE-2026-33857" type="cve" title="CVE-2026-33857"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34032" id="CVE-2026-34032" type="cve" title="CVE-2026-34032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34059" id="CVE-2026-34059" type="cve" title="CVE-2026-34059"/>
      <reference href="https://bugzilla.redhat.com/2464940" id="2464940" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464952" id="2464952" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464953" id="2464953" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2465299" id="2465299" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2466913" id="2466913" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21433.html" id="ALSA-2026:21433" type="self" title="ALSA-2026:21433"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="httpd-filesystem" version="2.4.63" release="13.el10_2.1" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e031b93501860443509180fc94ca9fd2f55bb1e5c48013833c3648cf8b45ea9f</sum>
        </package>
        <package name="httpd-manual" version="2.4.63" release="13.el10_2.1" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e3cfbdbc5fcf4512653e1a0be2d6396861efc9b9c15498e4543c0fcbc556c07a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21557</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-06-08 09:59:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
  * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
  * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
  * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
  * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
  * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
  * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
  * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
  * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)
  * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
  * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
  * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
  * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
  * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
  * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
  * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)
  * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
  * kernel: mm/page_alloc: clear page-&gt;private in free_pages_prepare() (CVE-2026-43303)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21557" id="RHSA-2026:21557" type="rhsa" title="RHSA-2026:21557"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56645" id="CVE-2024-56645" type="cve" title="CVE-2024-56645"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68183" id="CVE-2025-68183" type="cve" title="CVE-2025-68183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23375" id="CVE-2026-23375" type="cve" title="CVE-2026-23375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23392" id="CVE-2026-23392" type="cve" title="CVE-2026-23392"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23455" id="CVE-2026-23455" type="cve" title="CVE-2026-23455"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31684" id="CVE-2026-31684" type="cve" title="CVE-2026-31684"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31685" id="CVE-2026-31685" type="cve" title="CVE-2026-31685"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43006" id="CVE-2026-43006" type="cve" title="CVE-2026-43006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43020" id="CVE-2026-43020" type="cve" title="CVE-2026-43020"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43023" id="CVE-2026-43023" type="cve" title="CVE-2026-43023"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43027" id="CVE-2026-43027" type="cve" title="CVE-2026-43027"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43051" id="CVE-2026-43051" type="cve" title="CVE-2026-43051"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43110" id="CVE-2026-43110" type="cve" title="CVE-2026-43110"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43116" id="CVE-2026-43116" type="cve" title="CVE-2026-43116"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43158" id="CVE-2026-43158" type="cve" title="CVE-2026-43158"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43190" id="CVE-2026-43190" type="cve" title="CVE-2026-43190"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43205" id="CVE-2026-43205" type="cve" title="CVE-2026-43205"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43303" id="CVE-2026-43303" type="cve" title="CVE-2026-43303"/>
      <reference href="https://bugzilla.redhat.com/2334560" id="2334560" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2422699" id="2422699" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451199" id="2451199" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451218" id="2451218" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454810" id="2454810" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461757" id="2461757" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461759" id="2461759" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464369" id="2464369" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464402" id="2464402" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464455" id="2464455" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464462" id="2464462" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464496" id="2464496" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467005" id="2467005" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467014" id="2467014" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467064" id="2467064" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467090" id="2467090" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467210" id="2467210" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468091" id="2468091" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21557.html" id="ALSA-2026:21557" type="self" title="ALSA-2026:21557"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.18.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">d65ef7f528d990c65a6b7fb8ffc6e3ded25ceee509be5fa08d627d0c203045e9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21676</id>
    <title>Important: cockpit security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-28 14:30:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>cockpit security update</summary>
    <description>Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.  

Security Fix(es):  

  * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21676" id="RHSA-2026:21676" type="rhsa" title="RHSA-2026:21676"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4802" id="CVE-2026-4802" type="cve" title="CVE-2026-4802"/>
      <reference href="https://bugzilla.redhat.com/2451155" id="2451155" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21676.html" id="ALSA-2026:21676" type="self" title="ALSA-2026:21676"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="cockpit-packagekit" version="356.2" release="1.el10_2" epoch="0" arch="noarch" src="cockpit-356.2-1.el10_2.src.rpm">
          <filename>cockpit-packagekit-356.2-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">29bea62d6da80ffe7185c0a5c07130c9f8bdd8cf3db5e6956ab11f4675ba353b</sum>
        </package>
        <package name="cockpit-storaged" version="356.2" release="1.el10_2" epoch="0" arch="noarch" src="cockpit-356.2-1.el10_2.src.rpm">
          <filename>cockpit-storaged-356.2-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">db2a2a221c93a54b55c9d8c46acdea7e845e9d978c1572d583e9113742dd59f2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21757</id>
    <title>Important: flatpak security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-29 12:28:05"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>flatpak security update</summary>
    <description>Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  

Security Fix(es):  

  * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
  * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21757" id="RHSA-2026:21757" type="rhsa" title="RHSA-2026:21757"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34078" id="CVE-2026-34078" type="cve" title="CVE-2026-34078"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34079" id="CVE-2026-34079" type="cve" title="CVE-2026-34079"/>
      <reference href="https://bugzilla.redhat.com/2456276" id="2456276" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456284" id="2456284" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21757.html" id="ALSA-2026:21757" type="self" title="ALSA-2026:21757"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="flatpak-selinux" version="1.16.0" release="9.el10_2.1" epoch="0" arch="noarch" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">22949ff4b832a5fbaf79d354cfc73af59a6746d662dcf4d0c294b24dcd69a9c7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22141</id>
    <title>Moderate: go-fdo-client and go-fdo-server security update</title>
    <issued date="2026-06-01 00:00:00"/>
    <updated date="2026-07-15 07:31:05"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>go-fdo-client and go-fdo-server security update</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.  

Security Fix(es):  

  * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22141" id="RHSA-2026:22141" type="rhsa" title="RHSA-2026:22141"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://bugzilla.redhat.com/2437111" id="2437111" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22141.html" id="ALSA-2026:22141" type="self" title="ALSA-2026:22141"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="go-fdo-server-owner" version="1.0.1" release="2.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">2f5a8bd1401f47c152f97edd4dcc2bcfe5b02e9edea564cd3f27e4152facb328</sum>
        </package>
        <package name="go-fdo-server-rendezvous" version="1.0.1" release="2.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">843e6a44fb5ab7ca974b5dc823978d86e2f4d3d2a91a9aef3292f97beafc75f3</sum>
        </package>
        <package name="go-fdo-server-manufacturer" version="1.0.1" release="2.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">b1739b5cbc00a312407f39f5c8b72d26a9a88f099f93f00e1d68db826a024bb9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22963</id>
    <title>Critical: samba security update</title>
    <issued date="2026-06-03 00:00:00"/>
    <updated date="2026-06-04 10:06:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>samba security update</summary>
    <description>Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.  

Security Fix(es):  

  * samba: Missing access check on reparse point operations (CVE-2026-1933)
  * samba: vfs_worm does not block directory modification (CVE-2026-2340)
  * samba: group policy certificate enrollment uses &lt;http://&gt; without validation (CVE-2026-3012)
  * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
  * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
  * samba: Remote Code Execution in SAMR (CVE-2026-4408)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22963" id="RHSA-2026:22963" type="rhsa" title="RHSA-2026:22963"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1933" id="CVE-2026-1933" type="cve" title="CVE-2026-1933"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2340" id="CVE-2026-2340" type="cve" title="CVE-2026-2340"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3012" id="CVE-2026-3012" type="cve" title="CVE-2026-3012"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40170" id="CVE-2026-40170" type="cve" title="CVE-2026-40170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4408" id="CVE-2026-4408" type="cve" title="CVE-2026-4408"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4480" id="CVE-2026-4480" type="cve" title="CVE-2026-4480"/>
      <reference href="https://bugzilla.redhat.com/2447317" id="2447317" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447318" id="2447318" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447319" id="2447319" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452232" id="2452232" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2459061" id="2459061" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479762" id="2479762" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22963.html" id="ALSA-2026:22963" type="self" title="ALSA-2026:22963"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="samba-gpupdate" version="4.23.5" release="109.el10_2" epoch="0" arch="noarch" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-gpupdate-4.23.5-109.el10_2.noarch.rpm</filename>
          <sum type="sha256">02ab33c4186fb468d4de6cffac56cd285836279fe4e2d03245fef1dcf26dd611</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23329</id>
    <title>Important: kernel security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-08 10:00:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
  * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
  * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
  * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
  * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
  * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322)
  * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23329" id="RHSA-2026:23329" type="rhsa" title="RHSA-2026:23329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38653" id="CVE-2025-38653" type="cve" title="CVE-2025-38653"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68366" id="CVE-2025-68366" type="cve" title="CVE-2025-68366"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31613" id="CVE-2026-31613" type="cve" title="CVE-2026-31613"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31709" id="CVE-2026-31709" type="cve" title="CVE-2026-31709"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43322" id="CVE-2026-43322" type="cve" title="CVE-2026-43322"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43329" id="CVE-2026-43329" type="cve" title="CVE-2026-43329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46243" id="CVE-2026-46243" type="cve" title="CVE-2026-46243"/>
      <reference href="https://bugzilla.redhat.com/2390372" id="2390372" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2424881" id="2424881" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461480" id="2461480" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464476" id="2464476" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468124" id="2468124" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468131" id="2468131" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481486" id="2481486" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23329.html" id="ALSA-2026:23329" type="self" title="ALSA-2026:23329"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.20.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">a836026e76d4d01a4cd956f4ff3470e96d192b18c9b27f6d4d5b5e46c6aa8694</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24338</id>
    <title>Important: bind security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-06-08 08:31:26"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>bind security update</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  

Security Fix(es):  

  * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
  * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24338" id="RHSA-2026:24338" type="rhsa" title="RHSA-2026:24338"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3039" id="CVE-2026-3039" type="cve" title="CVE-2026-3039"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5946" id="CVE-2026-5946" type="cve" title="CVE-2026-5946"/>
      <reference href="https://bugzilla.redhat.com/2479767" id="2479767" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479771" id="2479771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24338.html" id="ALSA-2026:24338" type="self" title="ALSA-2026:24338"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="bind-license" version="9.18.33" release="15.el10_2.2" epoch="32" arch="noarch" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-license-9.18.33-15.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">25696570fcae21d95d2b7b7d02efd735482defa1142c62286c36eabb4f6c2997</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24347</id>
    <title>Important: frr security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-07-08 11:52:51"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>frr security update</summary>
    <description>FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.   

Security Fix(es):  

  * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)
  * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24347" id="RHSA-2026:24347" type="rhsa" title="RHSA-2026:24347"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-37457" id="CVE-2026-37457" type="cve" title="CVE-2026-37457"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-37459" id="CVE-2026-37459" type="cve" title="CVE-2026-37459"/>
      <reference href="https://bugzilla.redhat.com/2464548" id="2464548" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2466513" id="2466513" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24347.html" id="ALSA-2026:24347" type="self" title="ALSA-2026:24347"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="frr-selinux" version="10.4.4" release="1.el10_2" epoch="0" arch="noarch" src="frr-10.4.4-1.el10_2.src.rpm">
          <filename>frr-selinux-10.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">e52027fd1714316b10d57ad6d1986270e9103048cce6f181fddac53f9ff01c8c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24348</id>
    <title>Important: postgresql-jdbc security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-08-12 08:48:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql-jdbc security update</summary>
    <description>PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.  

Security Fix(es):  

  * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24348" id="RHSA-2026:24348" type="rhsa" title="RHSA-2026:24348"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42198" id="CVE-2026-42198" type="cve" title="CVE-2026-42198"/>
      <reference href="https://bugzilla.redhat.com/2463857" id="2463857" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24348.html" id="ALSA-2026:24348" type="self" title="ALSA-2026:24348"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="postgresql-jdbc" version="42.7.2" release="1.el10_2.2" epoch="0" arch="noarch" src="postgresql-jdbc-42.7.2-1.el10_2.2.src.rpm">
          <filename>postgresql-jdbc-42.7.2-1.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">12ad5a0377cc543161f693dbedf80444ce6430610d3c37c638d24895a91baf32</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24470</id>
    <title>Important: podman security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-06-11 08:50:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24470" id="RHSA-2026:24470" type="rhsa" title="RHSA-2026:24470"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24470.html" id="ALSA-2026:24470" type="self" title="ALSA-2026:24470"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="podman-docker" version="5.8.2" release="3.el10_2.alma.1" epoch="7" arch="noarch" src="podman-5.8.2-3.el10_2.alma.1.src.rpm">
          <filename>podman-docker-5.8.2-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">e205f2f26c5534f264de80514cb994d72b05f6a8fdd0b52239e7998ed355f6cd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25191</id>
    <title>Critical: kernel security update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-06-11 17:37:46"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
  * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467)
  * kernel: can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CVE-2026-31532)
  * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
  * kernel: ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (CVE-2026-43037)
  * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
  * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25191" id="RHSA-2026:25191" type="rhsa" title="RHSA-2026:25191"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31419" id="CVE-2026-31419" type="cve" title="CVE-2026-31419"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31467" id="CVE-2026-31467" type="cve" title="CVE-2026-31467"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31532" id="CVE-2026-31532" type="cve" title="CVE-2026-31532"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31581" id="CVE-2026-31581" type="cve" title="CVE-2026-31581"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43037" id="CVE-2026-43037" type="cve" title="CVE-2026-43037"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43501" id="CVE-2026-43501" type="cve" title="CVE-2026-43501"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46054" id="CVE-2026-46054" type="cve" title="CVE-2026-46054"/>
      <reference href="https://bugzilla.redhat.com/2457829" id="2457829" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460616" id="2460616" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461107" id="2461107" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461471" id="2461471" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464351" id="2464351" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480457" id="2480457" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482025" id="2482025" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25191.html" id="ALSA-2026:25191" type="self" title="ALSA-2026:25191"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.22.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1cb3d93030aca010c6182c61bd262ffa6d526fb1b80f5cac5d3a4e0ddfd0923a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25341</id>
    <title>Important: tomcat9 update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-07-08 11:54:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>tomcat9 update</summary>
    <description>Certificate revocation bypass due to improper OCSP response validation
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25341" id="RHSA-2026:25341" type="rhsa" title="RHSA-2026:25341"/>
      <reference href="https://bugzilla.redhat.com/2440426" id="2440426" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25341.html" id="ALSA-2026:25341" type="self" title="ALSA-2026:25341"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="tomcat9" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">05aa3bf0312387311b2ebee667eac72d7e7edec61d6304c2887bb89dce956ef9</sum>
        </package>
        <package name="tomcat9-lib" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-lib-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">112016e28c5036aafd2dc2c8c1106032281ee655ecf0ed4660e6a407a2be6530</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">20c189635df0064ff555758bfe0c95f21fb6875882b9d0af0d6a358047d9cf2b</sum>
        </package>
        <package name="tomcat9-webapps" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">4c2a31f2ac55f524c85ddedcf6348fb52bf25e3a8c51aa42bd636a679bc061ba</sum>
        </package>
        <package name="tomcat9-docs-webapp" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">69e8e77be4f060182be8e233a029cdac2dc6d78e5dede107e51f129760e53834</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8f03c1fb22b9b899ba5241ba26943941828f4092d11c3bf45acdfe457b177f1b</sum>
        </package>
        <package name="tomcat9-admin-webapps" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">cc3072eda709f80d8c5d5b108fe2a57d3bcc068e817a6dad877191d45431c79c</sum>
        </package>
        <package name="tomcat9-el-3.0-api" version="9.0.117" release="1.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-1.el10_2.alma.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">e88ff8acc2245391a6ac44a4bfd50bed1fb73d897208fbb93ff98452651fb8d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25902</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-06-15 00:00:00"/>
    <updated date="2026-07-17 10:20:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>fence-agents security update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   

Security Fix(es):  

  * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25902" id="RHSA-2026:25902" type="rhsa" title="RHSA-2026:25902"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48526" id="CVE-2026-48526" type="cve" title="CVE-2026-48526"/>
      <reference href="https://bugzilla.redhat.com/2482734" id="2482734" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25902.html" id="ALSA-2026:25902" type="self" title="ALSA-2026:25902"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="fence-agents-scsi" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-scsi-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">09ff1477d7c24e095b83789574d84696975330f2d0de542d54792c26e7974c16</sum>
        </package>
        <package name="fence-agents-lpar" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-lpar-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">12c9076e50ad52eac0fa9c9653ce73fa79643aee1f969bc507af2d7ff138569a</sum>
        </package>
        <package name="fence-agents-apc-snmp" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">298e8d7a3cc1d82a186ff6a6892e4568c0979e88cd2baebaf8d23a9e24fea0a9</sum>
        </package>
        <package name="fence-agents-eaton-snmp" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3e29269bd4baea6327c3f106e567ba79252914196c7d9d6de1691b9b887f5016</sum>
        </package>
        <package name="fence-agents-ifmib" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3eae36839b0c37587393fedd0a94d391c7c1b32d4e0038aeb872ce77dcbeac65</sum>
        </package>
        <package name="fence-agents-drac5" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-drac5-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3fd2c64de218b8f14a264b6d4c513527490c25f44ac7974c6ef31fb84798dd4c</sum>
        </package>
        <package name="fence-agents-eps" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-eps-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">50471bc1d7292ee0054f58620f7119f9f2224ef4260b8a953fba66633ec4adc0</sum>
        </package>
        <package name="fence-agents-rhevm" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">526fcda8f27eca140ad19bc1b50f05fde1e332027a94e23cb2595e6544c91903</sum>
        </package>
        <package name="fence-agents-cisco-ucs" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">5f0c4629ad31c1b9bd98c26300a2555a858e7da9be98323d3705bb2a17d23d33</sum>
        </package>
        <package name="fence-agents-apc" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-apc-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">600b0a86968f0aaae3296c8da0b70e18f2cc7836e9b007c314dafa38da84a8be</sum>
        </package>
        <package name="fence-agents-ibmblade" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">614315d7378c63e0844826317ca53254844a3938c32f3665bf1df10dacb31d62</sum>
        </package>
        <package name="fence-agents-ilo-mp" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">6731b497ac7785ff2dfa81e440a312e85ac8e725199bb261a3290e15f4a3d6d5</sum>
        </package>
        <package name="fence-agents-ibm-powervs" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">6ce383af0646539baeb184e2641a29ae6df028240286e91f57c016285057771a</sum>
        </package>
        <package name="fence-agents-ipdu" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">8368915fb9a5f0e382da7f974a5e4bad3c7a34142bd9ce52c57c100697a5e366</sum>
        </package>
        <package name="fence-agents-ilo-ssh" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">90c5f69dbd53eaddbb46b7de1584000376afcb442f82782208b63a07ddfc9bdf</sum>
        </package>
        <package name="fence-agents-nutanix-ahv" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-nutanix-ahv-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">970f4b76795e517102ff1e870b5e2a7be172ef477fd8821eb3e190b99f0af539</sum>
        </package>
        <package name="fence-agents-hpblade" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">a12bb2e9542b76485ce1221906f35e37ff7d6a8f2a241d21f6547347683b5a4a</sum>
        </package>
        <package name="fence-agents-vmware-rest" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">a236afaca18d09d042be0d498c52c254bca90aa39d7048b9c3d72fbe2a966a76</sum>
        </package>
        <package name="fence-agents-intelmodular" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">a2bd565e1af480ce00436ca7608818bf704d05480762acfa13b190ec1005bfcf</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">ab44451f3d94da168a7e3b360f7b9aedaa9e42107bdc97e68befbf4d4ee759d3</sum>
        </package>
        <package name="fence-agents-mpath" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-mpath-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">b2ccee8dd645e52151c781abd778eb861ab3d54b5f99a252ce703f56bd144800</sum>
        </package>
        <package name="fence-agents-emerson" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-emerson-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">bab15153adfef696f0496913ac9161a048bd71b538b1691aa0bf3c8d8ada5590</sum>
        </package>
        <package name="fence-agents-brocade" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-brocade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">bb0c8a0011dacba56e4874d5634add35a6f754e354513e4b6cd736bfa70e0cf8</sum>
        </package>
        <package name="fence-agents-heuristics-ping" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">bce9f617920cf266311a3e70eabdf9efc748e71a34550fc398f1d09a1f866c3c</sum>
        </package>
        <package name="fence-agents-amt-ws" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">c1311ad03e9d6aaecf221246f0a33f34e04186c91c4f94936a73ce91f0b8db62</sum>
        </package>
        <package name="fence-agents-sbd" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-sbd-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">cf3c3cd8d2407a4b215021e252553d437c3251f3f621c8600b1df2d2bf4c1be4</sum>
        </package>
        <package name="fence-agents-rsb" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rsb-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d1087cec15bbee8464f580cd85448b7b671ec9b6b50e7f414c01cebf25a27af6</sum>
        </package>
        <package name="fence-agents-wti" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-wti-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d4442641c3bdb9695e3303315183f9df36ea59d0979749e0fa73a2dc062a307c</sum>
        </package>
        <package name="fence-agents-virsh" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-virsh-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d4ea6c9d27d6b72c2ec4588d5b86ece102a2e5b5189970f0da144bdea249084d</sum>
        </package>
        <package name="fence-agents-ilo2" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">db55586c824957f510c58c45bb2f1e13b97c5a8e23cec28841a2fde724ad0cd5</sum>
        </package>
        <package name="fence-agents-ipmilan" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">e115cb7a9584a1268df698f1c2808d858f01ae1dcaa9502ab776538cc16b7458</sum>
        </package>
        <package name="fence-agents-rsa" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rsa-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">e50d48d8913ec8dddde456634ae7d0fe1110e61c50c0b31dc281bfc30173a4bb</sum>
        </package>
        <package name="fence-agents-vmware-soap" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">e5953455691ce0520db86e36d4a0520df1aa88bd8345553743a6c5d9eab94360</sum>
        </package>
        <package name="fence-agents-bladecenter" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">f2c5425b489f9273f19850815a2fd2af26422f93e9111fa72c09114aa8974593</sum>
        </package>
        <package name="fence-agents-cisco-mds" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">f65d2ca2ae09bc957279acfab3819afa89a6b4fad45c221655d3f53ba90126d5</sum>
        </package>
        <package name="fence-agents-ibm-vpc" version="4.16.0" release="21.el10_2.2" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">f86bf5b2eee3fe4a01366a531f4012957b6b7a9030f7c02c9ebae1fda6d2874f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:26332</id>
    <title>Important: rsync security, bug fix, and enhancement update</title>
    <issued date="2026-06-16 00:00:00"/>
    <updated date="2026-06-17 09:40:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>rsync security, bug fix, and enhancement update</summary>
    <description>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  

Security Fix(es):  

  * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)
  * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)


Bug Fix(es) and Enhancement(s):  

  * Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:26332" id="RHSA-2026:26332" type="rhsa" title="RHSA-2026:26332"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29518" id="CVE-2026-29518" type="cve" title="CVE-2026-29518"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43618" id="CVE-2026-43618" type="cve" title="CVE-2026-43618"/>
      <reference href="https://bugzilla.redhat.com/2469054" id="2469054" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2469055" id="2469055" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-26332.html" id="ALSA-2026:26332" type="self" title="ALSA-2026:26332"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="rsync-rrsync" version="3.4.4" release="1.el10_2" epoch="0" arch="noarch" src="rsync-3.4.4-1.el10_2.src.rpm">
          <filename>rsync-rrsync-3.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">540a428308cad863c69c33ed960b0bc940301aa9b2b59258a14f1fc3273c97b0</sum>
        </package>
        <package name="rsync-daemon" version="3.4.4" release="1.el10_2" epoch="0" arch="noarch" src="rsync-3.4.4-1.el10_2.src.rpm">
          <filename>rsync-daemon-3.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">c41feb2a21f43ce9aa84fc833bcabb0d96f6b707a7ee6ccbb51ade3b02c7e18a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27288</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-19 00:00:00"/>
    <updated date="2026-06-26 17:55:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
  * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
  * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
  * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
  * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
  * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
  * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
  * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
  * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
  * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
  * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
  * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
  * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
  * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
  * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)


Bug Fix(es) and Enhancement(s):  

  * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047)
  * AlmaLinux9.5 crash due to lpfc NULL ndlp-&gt;vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774)
  * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495)
  * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723)
  * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127)
  * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319)
  * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27288" id="RHSA-2026:27288" type="rhsa" title="RHSA-2026:27288"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31474" id="CVE-2026-31474" type="cve" title="CVE-2026-31474"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31641" id="CVE-2026-31641" type="cve" title="CVE-2026-31641"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31669" id="CVE-2026-31669" type="cve" title="CVE-2026-31669"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31772" id="CVE-2026-31772" type="cve" title="CVE-2026-31772"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31786" id="CVE-2026-31786" type="cve" title="CVE-2026-31786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31787" id="CVE-2026-31787" type="cve" title="CVE-2026-31787"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43056" id="CVE-2026-43056" type="cve" title="CVE-2026-43056"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43260" id="CVE-2026-43260" type="cve" title="CVE-2026-43260"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43330" id="CVE-2026-43330" type="cve" title="CVE-2026-43330"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46056" id="CVE-2026-46056" type="cve" title="CVE-2026-46056"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46125" id="CVE-2026-46125" type="cve" title="CVE-2026-46125"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46152" id="CVE-2026-46152" type="cve" title="CVE-2026-46152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46166" id="CVE-2026-46166" type="cve" title="CVE-2026-46166"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46173" id="CVE-2026-46173" type="cve" title="CVE-2026-46173"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46331" id="CVE-2026-46331" type="cve" title="CVE-2026-46331"/>
      <reference href="https://bugzilla.redhat.com/2460646" id="2460646" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461503" id="2461503" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461548" id="2461548" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464092" id="2464092" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464096" id="2464096" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464449" id="2464449" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464502" id="2464502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467083" id="2467083" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468061" id="2468061" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479492" id="2479492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482181" id="2482181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482563" id="2482563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482608" id="2482608" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482634" id="2482634" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482645" id="2482645" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27288.html" id="ALSA-2026:27288" type="self" title="ALSA-2026:27288"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.26.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">11db01dd6e6ddd890f4d22adb09a488c7d4dc0295f2128ecd209e94fadbced54</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27929</id>
    <title>Important: python3.14-urllib3 security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:10:05"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14-urllib3 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)
  * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27929" id="RHSA-2026:27929" type="rhsa" title="RHSA-2026:27929"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44431" id="CVE-2026-44431" type="cve" title="CVE-2026-44431"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44432" id="CVE-2026-44432" type="cve" title="CVE-2026-44432"/>
      <reference href="https://bugzilla.redhat.com/2477154" id="2477154" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477167" id="2477167" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27929.html" id="ALSA-2026:27929" type="self" title="ALSA-2026:27929"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="python3.14-urllib3" version="2.6.3" release="2.el10_2" epoch="0" arch="noarch" src="python3.14-urllib3-2.6.3-2.el10_2.src.rpm">
          <filename>python3.14-urllib3-2.6.3-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">57130c6cb8bb3cf561d8de37fc42674c447fb5b7868aa36aa521c9f85eb9cdd9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28582</id>
    <title>Moderate: keylime security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-08-13 08:14:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>keylime security update</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.  

Security Fix(es):  

  * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28582" id="RHSA-2026:28582" type="rhsa" title="RHSA-2026:28582"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6420" id="CVE-2026-6420" type="cve" title="CVE-2026-6420"/>
      <reference href="https://bugzilla.redhat.com/2458889" id="2458889" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28582.html" id="ALSA-2026:28582" type="self" title="ALSA-2026:28582"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="keylime-selinux" version="7.14.1" release="5.el10_2.1" epoch="0" arch="noarch" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-selinux-7.14.1-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">d087cd9f6da8c7f7422c92a84a47ffcc48661ffb612541d27410ec43622a490a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29874</id>
    <title>Important: nginx security update</title>
    <issued date="2026-06-25 00:00:00"/>
    <updated date="2026-06-26 12:49:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29874" id="RHSA-2026:29874" type="rhsa" title="RHSA-2026:29874"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9256" id="CVE-2026-9256" type="cve" title="CVE-2026-9256"/>
      <reference href="https://bugzilla.redhat.com/2480746" id="2480746" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29874.html" id="ALSA-2026:29874" type="self" title="ALSA-2026:29874"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nginx-all-modules" version="1.26.3" release="6.el10_2.4" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">562b83c5c4657fa12e3561c30f43284f0fbc49e4d410c9f9b7f57f8dffef487c</sum>
        </package>
        <package name="nginx-filesystem" version="1.26.3" release="6.el10_2.4" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">9f23da9e2b3a022ca250a77c0fe4ad02e555ea9d6fc291bd81545b117d01a511</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29980</id>
    <title>Moderate: golang security, bug fix, and enhancement update</title>
    <issued date="2026-06-25 00:00:00"/>
    <updated date="2026-06-27 15:22:00"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>golang security, bug fix, and enhancement update</summary>
    <description>The golang packages provide the Go programming language compiler.  

Security Fix(es):  

  * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)


Bug Fix(es) and Enhancement(s):  

  * Update Go to version 1.26.4+1 [almalinux-10.2.z] (JIRA:AlmaLinux-183347)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29980" id="RHSA-2026:29980" type="rhsa" title="RHSA-2026:29980"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42507" id="CVE-2026-42507" type="cve" title="CVE-2026-42507"/>
      <reference href="https://bugzilla.redhat.com/2484205" id="2484205" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29980.html" id="ALSA-2026:29980" type="self" title="ALSA-2026:29980"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="golang-tests" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-tests-1.26.4-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">3726ef009f97fa8d5d3a2547243c897a2ad61b3d3bf8c47c5d2bf97663366857</sum>
        </package>
        <package name="golang-docs" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-docs-1.26.4-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">833fa429b2a24d184ef4308625d865d9e06a1d3211c741a966b78c83ea469dd4</sum>
        </package>
        <package name="golang-misc" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-misc-1.26.4-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">902dcd6c5009e267bf17ad6a17c944bab1e8d0806d3951286a1e40c6bed7d271</sum>
        </package>
        <package name="golang-src" version="1.26.4" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.4-1.el10_2.alma.1.src.rpm">
          <filename>golang-src-1.26.4-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">cfe20b9d0486e89e04d2f4b28058235230bff4d282b1571fc4c5279579e60d21</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30129</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-25 00:00:00"/>
    <updated date="2026-06-27 12:59:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)
  * kernel: ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
  * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
  * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
  * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)
  * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
  * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
  * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)
  * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)


Bug Fix(es) and Enhancement(s):  

  * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30129" id="RHSA-2026:30129" type="rhsa" title="RHSA-2026:30129"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31636" id="CVE-2026-31636" type="cve" title="CVE-2026-31636"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43038" id="CVE-2026-43038" type="cve" title="CVE-2026-43038"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43198" id="CVE-2026-43198" type="cve" title="CVE-2026-43198"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43414" id="CVE-2026-43414" type="cve" title="CVE-2026-43414"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45898" id="CVE-2026-45898" type="cve" title="CVE-2026-45898"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46117" id="CVE-2026-46117" type="cve" title="CVE-2026-46117"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46135" id="CVE-2026-46135" type="cve" title="CVE-2026-46135"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46145" id="CVE-2026-46145" type="cve" title="CVE-2026-46145"/>
      <reference href="https://bugzilla.redhat.com/2461510" id="2461510" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464397" id="2464397" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467228" id="2467228" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468155" id="2468155" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482031" id="2482031" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482576" id="2482576" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482581" id="2482581" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482654" id="2482654" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30129.html" id="ALSA-2026:30129" type="self" title="ALSA-2026:30129"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.28.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">7017f858229dac25fead46f7a86ea9f48bda9ff21527d8dafd2ca37464130d2e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30857</id>
    <title>Important: perl-Archive-Tar security update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 10:44:29"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-Archive-Tar security update</summary>
    <description>Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.  

Security Fix(es):  

  * perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30857" id="RHSA-2026:30857" type="rhsa" title="RHSA-2026:30857"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42496" id="CVE-2026-42496" type="cve" title="CVE-2026-42496"/>
      <reference href="https://bugzilla.redhat.com/2481314" id="2481314" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30857.html" id="ALSA-2026:30857" type="self" title="ALSA-2026:30857"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="perl-Archive-Tar" version="3.02" release="512.el10_2.1" epoch="0" arch="noarch" src="perl-Archive-Tar-3.02-512.el10_2.1.src.rpm">
          <filename>perl-Archive-Tar-3.02-512.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e6efbbe6db7984a333245143097f48825a68f0f7cc2d488c57fd1eec9db1d08b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30860</id>
    <title>Important: perl-IO-Compress security update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 10:35:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-IO-Compress security update</summary>
    <description>This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. IO-Compress supports reading and writing of bzip2, RFC 1950, RFC 1951, RFC 1952 (i.e. gzip) and zip files/buffers. The following modules used to be distributed separately, but are now included with the IO-Compress distribution:  

  * Compress-Zlib
  * IO-Compress-Zlib
  * IO-Compress-Bzip2
  * IO-Compress-Base


Security Fix(es):  

  * perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30860" id="RHSA-2026:30860" type="rhsa" title="RHSA-2026:30860"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48962" id="CVE-2026-48962" type="cve" title="CVE-2026-48962"/>
      <reference href="https://bugzilla.redhat.com/2481767" id="2481767" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30860.html" id="ALSA-2026:30860" type="self" title="ALSA-2026:30860"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="perl-IO-Compress" version="2.212" release="512.el10_2.1" epoch="0" arch="noarch" src="perl-IO-Compress-2.212-512.el10_2.1.src.rpm">
          <filename>perl-IO-Compress-2.212-512.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">741508f5ad1fac081838f6f573ee7ee5aed1ab60be165fde7eab4c556b6b2f28</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33092</id>
    <title>Moderate: glibc security, bug fix, and enhancement update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 13:43:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security, bug fix, and enhancement update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450)


Bug Fix(es) and Enhancement(s):  

  * Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on AlmaLinux 10 [almalinux-10] (JIRA:AlmaLinux-174869)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33092" id="RHSA-2026:33092" type="rhsa" title="RHSA-2026:33092"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5450" id="CVE-2026-5450" type="cve" title="CVE-2026-5450"/>
      <reference href="https://bugzilla.redhat.com/2459853" id="2459853" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33092.html" id="ALSA-2026:33092" type="self" title="ALSA-2026:33092"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="glibc-doc" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-126.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">07f1c0fec3d86d729f94febb97a600a9829176f2de6b4eac4354dc95cf165db1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33093</id>
    <title>Important: mariadb10.11 security, bug fix, and enhancement update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 10:36:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>mariadb10.11 security, bug fix, and enhancement update</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.  

Security Fix(es):  

  * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)


Bug Fix(es) and Enhancement(s):  

  * Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux10 (JIRA:AlmaLinux-183086)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33093" id="RHSA-2026:33093" type="rhsa" title="RHSA-2026:33093"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-49261" id="CVE-2026-49261" type="cve" title="CVE-2026-49261"/>
      <reference href="https://bugzilla.redhat.com/2487957" id="2487957" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33093.html" id="ALSA-2026:33093" type="self" title="ALSA-2026:33093"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="mariadb-common" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="noarch" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-common-10.11.18-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">681f8ea6830f9775d238ef434fe0cb1d7ae292f04e23bb51b564dd3396b48a53</sum>
        </package>
        <package name="mariadb-errmsg" version="10.11.18" release="1.el10_2.alma.1" epoch="3" arch="noarch" src="mariadb10.11-10.11.18-1.el10_2.alma.1.src.rpm">
          <filename>mariadb-errmsg-10.11.18-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">714e7719347d3e47e8ad2c0770a97c3dca85f00f5f67c30868bbc81cbeae8dea</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33412</id>
    <title>Important: galera and mariadb11.8 security, bug fix, and enhancement update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-06-30 10:34:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>galera and mariadb11.8 security, bug fix, and enhancement update</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.  

Security Fix(es):  

  * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)


Bug Fix(es) and Enhancement(s):  

  * Rebase MariaDB 11.8 to 11.8.8 in AlmaLinux10 (JIRA:AlmaLinux-183084)
  * Rebase Galera to 26.4.27 in AlmaLinux10 (JIRA:AlmaLinux-183259)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33412" id="RHSA-2026:33412" type="rhsa" title="RHSA-2026:33412"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-49261" id="CVE-2026-49261" type="cve" title="CVE-2026-49261"/>
      <reference href="https://bugzilla.redhat.com/2487957" id="2487957" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33412.html" id="ALSA-2026:33412" type="self" title="ALSA-2026:33412"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="mariadb11.8-client-utils" version="11.8.8" release="1.el10_2" epoch="3" arch="noarch" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-client-utils-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1b8213a94b5a803fee91159889715d18dce58d1206715acfe2ca987d9c88560c</sum>
        </package>
        <package name="mariadb11.8-server-utils" version="11.8.8" release="1.el10_2" epoch="3" arch="noarch" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-server-utils-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">9b959318939709d585735442a771104817080a3fa715a214b85e0185a5e94ac0</sum>
        </package>
        <package name="mariadb11.8-common" version="11.8.8" release="1.el10_2" epoch="3" arch="noarch" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-common-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">bf247857f833df313151be70c72cf6cc08b2708a50410ff68503d30347ea33e0</sum>
        </package>
        <package name="mariadb11.8-errmsg" version="11.8.8" release="1.el10_2" epoch="3" arch="noarch" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-errmsg-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">cedb5ef493d966e6486d252d6067e6b53503d8ae6ebdb7dd3e8f68edfd7f05aa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33565</id>
    <title>Important: ruby security update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 10:23:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ruby security update</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  

Security Fix(es):  

  * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245)
  * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258)
  * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33565" id="RHSA-2026:33565" type="rhsa" title="RHSA-2026:33565"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42245" id="CVE-2026-42245" type="cve" title="CVE-2026-42245"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42246" id="CVE-2026-42246" type="cve" title="CVE-2026-42246"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42258" id="CVE-2026-42258" type="cve" title="CVE-2026-42258"/>
      <reference href="https://bugzilla.redhat.com/2468495" id="2468495" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468498" id="2468498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468499" id="2468499" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33565.html" id="ALSA-2026:33565" type="self" title="ALSA-2026:33565"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="rubygems" version="3.5.22" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygems-3.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">2f09c90f0b4981535ebbe0b5b7b4ba60dd9bf5785c27f0948403aee04d0d5b28</sum>
        </package>
        <package name="ruby-default-gems" version="3.3.10" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-default-gems-3.3.10-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">39ee09200809903651fa2e054e18cb445e9dae3f0c19984efe4045642eba7d34</sum>
        </package>
        <package name="rubygem-irb" version="1.13.1" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-irb-1.13.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">5fe9dfe4760320749f19a851ab422764bf54367af0eb5510c9e54a95549daba8</sum>
        </package>
        <package name="rubygem-rss" version="0.3.1" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rss-0.3.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">77dbae3e8147ddc42bab5b6ea0d18c2e4118e0105e415dcfe6fde5793202bb0a</sum>
        </package>
        <package name="rubygem-rdoc" version="6.6.3.1" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">84f1915103438280abdc5b9e57ca39fb26ffae2bf1bc21027bd6ffc6d79f3a9b</sum>
        </package>
        <package name="rubygem-test-unit" version="3.6.1" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-test-unit-3.6.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">866eeea21e0bb345ada37a03f5d13b57a0399196476d646d5eb5506909bc81d2</sum>
        </package>
        <package name="rubygem-minitest" version="5.20.0" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-minitest-5.20.0-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">8d9d188779b8666f560bb68d91edd4391c9dc0cf440b9130fc0564c11966ea8f</sum>
        </package>
        <package name="rubygem-rake" version="13.1.0" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rake-13.1.0-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">9b79c2f558b1658de031381b86dd753b030592a6199883a0022919c04b379525</sum>
        </package>
        <package name="rubygems-devel" version="3.5.22" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygems-devel-3.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">9c2bdfcca295e0d66484e9c97a77cd7f3e0ac57cfdb203043fc7933c70d2ca71</sum>
        </package>
        <package name="rubygem-typeprof" version="0.21.9" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-typeprof-0.21.9-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">d3a54b16ced51c5e321382a648a7fb7a1a9cac1940df6d3e2b907de4669c5d3e</sum>
        </package>
        <package name="rubygem-bundler" version="2.5.22" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-bundler-2.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">dd71e0f69e1f86a3e4c35e6fd46db1e3360041d19976243b46e4612a81b06606</sum>
        </package>
        <package name="rubygem-power_assert" version="2.0.3" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-power_assert-2.0.3-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">ed105a1583192586a2f3343deb1cbc054e85193e938c0fb1822c3397f0e7ffa2</sum>
        </package>
        <package name="rubygem-rexml" version="3.4.4" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rexml-3.4.4-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">f59082b3a7963f92107e82ec2557edc1e4be848f32ef1752978e61ea1311d1c2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33685</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 20:19:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
  * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
  * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
  * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)


Bug Fix(es) and Enhancement(s):  

  * CLONE - [AlmaLinux 10.2 Bug] qla2xxx flash image validation failure [almalinux-10.2.z] (JIRA:AlmaLinux-181887)
  * tegra-se fixes and updates [almalinux-10.2.z] (JIRA:AlmaLinux-182759)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33685" id="RHSA-2026:33685" type="rhsa" title="RHSA-2026:33685"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43279" id="CVE-2026-43279" type="cve" title="CVE-2026-43279"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46090" id="CVE-2026-46090" type="cve" title="CVE-2026-46090"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46176" id="CVE-2026-46176" type="cve" title="CVE-2026-46176"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46189" id="CVE-2026-46189" type="cve" title="CVE-2026-46189"/>
      <reference href="https://bugzilla.redhat.com/2467215" id="2467215" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481980" id="2481980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482588" id="2482588" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482594" id="2482594" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33685.html" id="ALSA-2026:33685" type="self" title="ALSA-2026:33685"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.29.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b836e329534f6755772c1ddbdf8b9206b050a9efd1b92e1c01c0d98fdd9037c7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:34109</id>
    <title>Important: httpd security, bug fix, and enhancement update</title>
    <issued date="2026-07-01 00:00:00"/>
    <updated date="2026-07-01 12:00:25"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>httpd security, bug fix, and enhancement update</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  

Security Fix(es):  

  * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
  * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
  * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
  * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)
  * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)


Bug Fix(es) and Enhancement(s):  

  * address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:34109" id="RHSA-2026:34109" type="rhsa" title="RHSA-2026:34109"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-42516" id="CVE-2024-42516" type="cve" title="CVE-2024-42516"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29169" id="CVE-2026-29169" type="cve" title="CVE-2026-29169"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34355" id="CVE-2026-34355" type="cve" title="CVE-2026-34355"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34356" id="CVE-2026-34356" type="cve" title="CVE-2026-34356"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42536" id="CVE-2026-42536" type="cve" title="CVE-2026-42536"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44185" id="CVE-2026-44185" type="cve" title="CVE-2026-44185"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44631" id="CVE-2026-44631" type="cve" title="CVE-2026-44631"/>
      <reference href="https://bugzilla.redhat.com/2374549" id="2374549" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2465296" id="2465296" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486395" id="2486395" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486397" id="2486397" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486399" id="2486399" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486411" id="2486411" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486414" id="2486414" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-34109.html" id="ALSA-2026:34109" type="self" title="ALSA-2026:34109"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="httpd-filesystem" version="2.4.63" release="13.el10_2.4" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">30a9431c19d9b0eaee77dd0b3a9c83a8c8a3a28bd86f1779bae9f85de7bc9f30</sum>
        </package>
        <package name="httpd-manual" version="2.4.63" release="13.el10_2.4" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">5e32be7a095c8c1c4519272d18d660a3422b7a943ac850a731cff5f11027152d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:34911</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-02 00:00:00"/>
    <updated date="2026-07-04 22:29:53"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
  * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)
  * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209)
  * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
  * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263)
  * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)
  * kernel: kernel: ipv6 frag escape ()


Bug Fix(es) and Enhancement(s):  

  * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z] (JIRA:AlmaLinux-182537)
  * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:34911" id="RHSA-2026:34911" type="rhsa" title="RHSA-2026:34911"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-10263" id="CVE-2025-10263" type="cve" title="CVE-2025-10263"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43112" id="CVE-2026-43112" type="cve" title="CVE-2026-43112"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45998" id="CVE-2026-45998" type="cve" title="CVE-2026-45998"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46209" id="CVE-2026-46209" type="cve" title="CVE-2026-46209"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46244" id="CVE-2026-46244" type="cve" title="CVE-2026-46244"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46316" id="CVE-2026-46316" type="cve" title="CVE-2026-46316"/>
      <reference href="https://bugzilla.redhat.com/2467015" id="2467015" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482024" id="2482024" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482636" id="2482636" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484451" id="2484451" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486958" id="2486958" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486982" id="2486982" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-34911.html" id="ALSA-2026:34911" type="self" title="ALSA-2026:34911"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.30.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">37071c47ef6d33902382a8ed775082ac0e87202627db8e9d81a39e5f0fbdfabc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:35841</id>
    <title>Important: nodejs24 security, bug fix, and enhancement update</title>
    <issued date="2026-07-06 00:00:00"/>
    <updated date="2026-07-06 12:42:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs24 security, bug fix, and enhancement update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  

Security Fix(es):  

  * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)


Bug Fix(es) and Enhancement(s):  

  * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:35841" id="RHSA-2026:35841" type="rhsa" title="RHSA-2026:35841"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11525" id="CVE-2026-11525" type="cve" title="CVE-2026-11525"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12151" id="CVE-2026-12151" type="cve" title="CVE-2026-12151"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42338" id="CVE-2026-42338" type="cve" title="CVE-2026-42338"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48615" id="CVE-2026-48615" type="cve" title="CVE-2026-48615"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48618" id="CVE-2026-48618" type="cve" title="CVE-2026-48618"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48619" id="CVE-2026-48619" type="cve" title="CVE-2026-48619"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48928" id="CVE-2026-48928" type="cve" title="CVE-2026-48928"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48930" id="CVE-2026-48930" type="cve" title="CVE-2026-48930"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48933" id="CVE-2026-48933" type="cve" title="CVE-2026-48933"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48934" id="CVE-2026-48934" type="cve" title="CVE-2026-48934"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48935" id="CVE-2026-48935" type="cve" title="CVE-2026-48935"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6733" id="CVE-2026-6733" type="cve" title="CVE-2026-6733"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6734" id="CVE-2026-6734" type="cve" title="CVE-2026-6734"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9678" id="CVE-2026-9678" type="cve" title="CVE-2026-9678"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9697" id="CVE-2026-9697" type="cve" title="CVE-2026-9697"/>
      <reference href="https://bugzilla.redhat.com/2476810" id="2476810" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489980" id="2489980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490000" id="2490000" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490006" id="2490006" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490008" id="2490008" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490018" id="2490018" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490024" id="2490024" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493325" id="2493325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493326" id="2493326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493329" id="2493329" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493331" id="2493331" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493332" id="2493332" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493333" id="2493333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493335" id="2493335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493337" id="2493337" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-35841.html" id="ALSA-2026:35841" type="self" title="ALSA-2026:35841"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nodejs24-npm" version="11.16.0" release="1.24.18.0.1.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-npm-11.16.0-1.24.18.0.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b26d8267ca66276f7e691e6ae46d36fc0beaccc3064246c73bf7e97f5437ff7d</sum>
        </package>
        <package name="nodejs24-docs" version="24.18.0" release="1.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-docs-24.18.0-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">cfbfb133600350bcd79f384de1fe77fa2508bf7bbac0e804b4b4b5991450e772</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:35842</id>
    <title>Important: nodejs22 security, bug fix, and enhancement update</title>
    <issued date="2026-07-06 00:00:00"/>
    <updated date="2026-07-06 12:41:53"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs22 security, bug fix, and enhancement update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.  

Security Fix(es):  

  * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)


Bug Fix(es) and Enhancement(s):  

  * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:35842" id="RHSA-2026:35842" type="rhsa" title="RHSA-2026:35842"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11525" id="CVE-2026-11525" type="cve" title="CVE-2026-11525"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12151" id="CVE-2026-12151" type="cve" title="CVE-2026-12151"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42338" id="CVE-2026-42338" type="cve" title="CVE-2026-42338"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48615" id="CVE-2026-48615" type="cve" title="CVE-2026-48615"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48618" id="CVE-2026-48618" type="cve" title="CVE-2026-48618"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48619" id="CVE-2026-48619" type="cve" title="CVE-2026-48619"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48928" id="CVE-2026-48928" type="cve" title="CVE-2026-48928"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48930" id="CVE-2026-48930" type="cve" title="CVE-2026-48930"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48933" id="CVE-2026-48933" type="cve" title="CVE-2026-48933"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48934" id="CVE-2026-48934" type="cve" title="CVE-2026-48934"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48935" id="CVE-2026-48935" type="cve" title="CVE-2026-48935"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6733" id="CVE-2026-6733" type="cve" title="CVE-2026-6733"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9678" id="CVE-2026-9678" type="cve" title="CVE-2026-9678"/>
      <reference href="https://bugzilla.redhat.com/2476810" id="2476810" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489980" id="2489980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490000" id="2490000" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490006" id="2490006" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2490008" id="2490008" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493325" id="2493325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493326" id="2493326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493329" id="2493329" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493331" id="2493331" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493332" id="2493332" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493333" id="2493333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493335" id="2493335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493337" id="2493337" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-35842.html" id="ALSA-2026:35842" type="self" title="ALSA-2026:35842"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nodejs-docs" version="22.23.1" release="2.el10_2" epoch="1" arch="noarch" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">492a598f325fdb1de667b1cf3eb563ff290a931816399634238410c6852efc36</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36193</id>
    <title>Important: python3.14-pip security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-08 11:49:47"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14-pip security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36193" id="RHSA-2026:36193" type="rhsa" title="RHSA-2026:36193"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8643" id="CVE-2026-8643" type="cve" title="CVE-2026-8643"/>
      <reference href="https://bugzilla.redhat.com/2460927" id="2460927" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36193.html" id="ALSA-2026:36193" type="self" title="ALSA-2026:36193"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="python3.14-pip-wheel" version="25.2" release="3.el10_2.5" epoch="0" arch="noarch" src="python3.14-pip-25.2-3.el10_2.5.src.rpm">
          <filename>python3.14-pip-wheel-25.2-3.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">80456c6bf4f96a398309a5858cf83bf96d5c0f655b8b581a95e3ff83b8664e80</sum>
        </package>
        <package name="python3.14-pip" version="25.2" release="3.el10_2.5" epoch="0" arch="noarch" src="python3.14-pip-25.2-3.el10_2.5.src.rpm">
          <filename>python3.14-pip-25.2-3.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">927cdfb0565ce93516e52106bc6c1092e3eb33f3170f0a74c8dfae46233929be</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36196</id>
    <title>Important: 389-ds-base security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-21 13:11:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>389-ds-base security update</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.  

Security Fix(es):  

  * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
  * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36196" id="RHSA-2026:36196" type="rhsa" title="RHSA-2026:36196"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11610" id="CVE-2026-11610" type="cve" title="CVE-2026-11610"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11774" id="CVE-2026-11774" type="cve" title="CVE-2026-11774"/>
      <reference href="https://bugzilla.redhat.com/2484414" id="2484414" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484916" id="2484916" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36196.html" id="ALSA-2026:36196" type="self" title="ALSA-2026:36196"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="python3-lib389" version="3.2.0" release="8.el10_2" epoch="0" arch="noarch" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>python3-lib389-3.2.0-8.el10_2.noarch.rpm</filename>
          <sum type="sha256">db8acba0242228f0760021708fbba6f09ec6c3ed8b57470de69e594a8a184aa0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36364</id>
    <title>Important: nginx security, bug fix, and enhancement update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-08 11:42:27"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nginx security, bug fix, and enhancement update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055)


Bug Fix(es) and Enhancement(s):  

  * "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-10.2.z] (JIRA:AlmaLinux-191778)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36364" id="RHSA-2026:36364" type="rhsa" title="RHSA-2026:36364"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42055" id="CVE-2026-42055" type="cve" title="CVE-2026-42055"/>
      <reference href="https://bugzilla.redhat.com/2489866" id="2489866" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36364.html" id="ALSA-2026:36364" type="self" title="ALSA-2026:36364"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nginx-all-modules" version="1.26.3" release="6.el10_2.5" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">63783f2757ef9f4c14eb7739660124c6c7d8094475d4b3333f54aa552c72f0fd</sum>
        </package>
        <package name="nginx-filesystem" version="1.26.3" release="6.el10_2.5" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">e33cd1bd4272896159c0e7c1cd3fb48f85a85d98e7641fd3ac67aa121ff5fae5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36541</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-09 11:20:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)
  * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
  * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)
  * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
  * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)
  * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)


Bug Fix(es) and Enhancement(s):  

  * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z] (JIRA:AlmaLinux-162140)
  * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z] (JIRA:AlmaLinux-182770)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36541" id="RHSA-2026:36541" type="rhsa" title="RHSA-2026:36541"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43074" id="CVE-2026-43074" type="cve" title="CVE-2026-43074"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43276" id="CVE-2026-43276" type="cve" title="CVE-2026-43276"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43341" id="CVE-2026-43341" type="cve" title="CVE-2026-43341"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46155" id="CVE-2026-46155" type="cve" title="CVE-2026-46155"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46242" id="CVE-2026-46242" type="cve" title="CVE-2026-46242"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46259" id="CVE-2026-46259" type="cve" title="CVE-2026-46259"/>
      <reference href="https://bugzilla.redhat.com/2467019" id="2467019" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467113" id="2467113" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468097" id="2468097" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482660" id="2482660" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483519" id="2483519" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484477" id="2484477" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36541.html" id="ALSA-2026:36541" type="self" title="ALSA-2026:36541"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.31.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">89b91f15b9a6c2c75be8b2c7e16409d5457cac0e17efe5cccd145ffe6964e501</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36788</id>
    <title>Important: tomcat security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-13 09:45:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>tomcat security, bug fix, and enhancement update</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  

Security Fix(es):  

  * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
  * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)


Bug Fix(es) and Enhancement(s):  

  * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36788" id="RHSA-2026:36788" type="rhsa" title="RHSA-2026:36788"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29146" id="CVE-2026-29146" type="cve" title="CVE-2026-29146"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34486" id="CVE-2026-34486" type="cve" title="CVE-2026-34486"/>
      <reference href="https://bugzilla.redhat.com/2457020" id="2457020" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457027" id="2457027" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36788.html" id="ALSA-2026:36788" type="self" title="ALSA-2026:36788"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="tomcat-jsp-3.1-api" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">1819dbffc1a4bca43680dfb716f9f6bfca480b2c4603395e77e0a419a58fbf40</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">2554b1cd27aae45d566ee543e529a7f8b631976f3dc644dccaa3151198093639</sum>
        </package>
        <package name="tomcat-el-5.0-api" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">4b09a49a6a830ea70914354fdb2180be3d73be82a0bebb83bdfefc3d3432cb85</sum>
        </package>
        <package name="tomcat" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">7a52ade066f085dc82c61eb86e4ef336c98d2ac6ba70eff0127686795e779fa3</sum>
        </package>
        <package name="tomcat-lib" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-lib-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8493861578941c0333c0447a8fba9719aa909187e4dfce1eb7ea6f9689eb73f4</sum>
        </package>
        <package name="tomcat-webapps" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8545fc47344bf1f124375700093b8bd550c7b5bbd3885316391a2c6901779bf3</sum>
        </package>
        <package name="tomcat-docs-webapp" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">cd529a071ef3d5271bd60e65c7097b158dc762889174cff1d29908a19942df9b</sum>
        </package>
        <package name="tomcat-admin-webapps" version="10.1.49" release="3.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-3.el10_2.alma.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">f1ca32a57c82c415745065d6ad5dee139ea70ca3e4b206c2c5213577fb413f9f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36790</id>
    <title>Important: tomcat9 security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-08-07 12:55:05"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>tomcat9 security, bug fix, and enhancement update</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.  

Security Fix(es):  

  * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
  * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)


Bug Fix(es) and Enhancement(s):  

  * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36790" id="RHSA-2026:36790" type="rhsa" title="RHSA-2026:36790"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29146" id="CVE-2026-29146" type="cve" title="CVE-2026-29146"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34486" id="CVE-2026-34486" type="cve" title="CVE-2026-34486"/>
      <reference href="https://bugzilla.redhat.com/2457020" id="2457020" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457027" id="2457027" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36790.html" id="ALSA-2026:36790" type="self" title="ALSA-2026:36790"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2025-66614.html" id="CVE-2025-66614" type="cve" title="CVE-2025-66614"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-24733.html" id="CVE-2026-24733" type="cve" title="CVE-2026-24733"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-24734.html" id="CVE-2026-24734" type="cve" title="CVE-2026-24734"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-24880.html" id="CVE-2026-24880" type="cve" title="CVE-2026-24880"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-25854.html" id="CVE-2026-25854" type="cve" title="CVE-2026-25854"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-29129.html" id="CVE-2026-29129" type="cve" title="CVE-2026-29129"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-29145.html" id="CVE-2026-29145" type="cve" title="CVE-2026-29145"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-32990.html" id="CVE-2026-32990" type="cve" title="CVE-2026-32990"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-34483.html" id="CVE-2026-34483" type="cve" title="CVE-2026-34483"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-34487.html" id="CVE-2026-34487" type="cve" title="CVE-2026-34487"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-34500.html" id="CVE-2026-34500" type="cve" title="CVE-2026-34500"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="tomcat9-el-3.0-api" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">1e7a1f290d83d33dca1568da1d68c956d2ff9d703a7b398d2955f8f881f6c51c</sum>
        </package>
        <package name="tomcat9-admin-webapps" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">35f74b44de15b3b04a6bc454a111d3dfb26dfee6c7ad16644fb1a88130dce735</sum>
        </package>
        <package name="tomcat9-webapps" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">3682120341af35136b188a86d60de457c2c5936026aea99b5a7b1317d71f90f2</sum>
        </package>
        <package name="tomcat9-lib" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-lib-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">3a1e23335ca4fc1ca27006743516d5c74f7da734dc74dcdc72f5a4bed710668b</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">42f01e89a5d4c20d96e5212710be93238f72ce04851d86ae714c53b925109a88</sum>
        </package>
        <package name="tomcat9" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">7b18a53d3580ad05f99f8ee76bc0a5408bc9f0a2ca45465fd3446184546c2cb9</sum>
        </package>
        <package name="tomcat9-docs-webapp" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">a59f4bad7f545f5287804da402c7f5be36cbae0c74cf7b8b5f691c3473fe68b6</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" version="9.0.117" release="2.el10_2.alma.1" epoch="1" arch="noarch" src="tomcat9-9.0.117-2.el10_2.alma.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.117-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">ac4d0fe0045a2723cfb5b6f43bdf719a027a0d7e5f26985bc08e3b4c1c91feb3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36956</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-09 00:00:00"/>
    <updated date="2026-07-10 09:19:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066)
  * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
  * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)
  * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36956" id="RHSA-2026:36956" type="rhsa" title="RHSA-2026:36956"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71066" id="CVE-2025-71066" type="cve" title="CVE-2025-71066"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46113" id="CVE-2026-46113" type="cve" title="CVE-2026-46113"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46227" id="CVE-2026-46227" type="cve" title="CVE-2026-46227"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53359" id="CVE-2026-53359" type="cve" title="CVE-2026-53359"/>
      <reference href="https://bugzilla.redhat.com/2429036" id="2429036" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482564" id="2482564" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482587" id="2482587" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2497033" id="2497033" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36956.html" id="ALSA-2026:36956" type="self" title="ALSA-2026:36956"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.32.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">4f6f025dca58da64c2300881e18f8767aa214eab6914aec981f04cad4cabb279</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:37436</id>
    <title>Important: golang security, bug fix, and enhancement update</title>
    <issued date="2026-07-09 00:00:00"/>
    <updated date="2026-08-07 12:55:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>golang security, bug fix, and enhancement update</summary>
    <description>The golang packages provide the Go programming language compiler.  

Security Fix(es):  

  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)


Bug Fix(es) and Enhancement(s):  

  * Update Go to version 1.26.5+1 [almalinux-10.2.z] (JIRA:AlmaLinux-193473)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:37436" id="RHSA-2026:37436" type="rhsa" title="RHSA-2026:37436"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822"/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-37436.html" id="ALSA-2026:37436" type="self" title="ALSA-2026:37436"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-42505.html" id="CVE-2026-42505" type="cve" title="CVE-2026-42505"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="golang-misc" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-misc-1.26.5-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8b1baa3232557c008b80897b0d878d2d32cb781b8cc9b3418c2541f114ab8bd2</sum>
        </package>
        <package name="golang-docs" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-docs-1.26.5-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">e79232aca5b77e65b500df22bd8d4d8328e0c2dce6833e3fc94730d5830a9c07</sum>
        </package>
        <package name="golang-tests" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-tests-1.26.5-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">e793fc42fe1650f9a19106e8b5b7a3d9bdb7d8d0204ee5e5af2c808d2d66a9bc</sum>
        </package>
        <package name="golang-src" version="1.26.5" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.5-1.el10_2.alma.1.src.rpm">
          <filename>golang-src-1.26.5-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">ec33bba2e56c497962b088c3e47106cc014d357d9e7a0743489c3b9f1da82635</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38492</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-13 20:55:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
  * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
  * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38492" id="RHSA-2026:38492" type="rhsa" title="RHSA-2026:38492"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43163" id="CVE-2026-43163" type="cve" title="CVE-2026-43163"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43499" id="CVE-2026-43499" type="cve" title="CVE-2026-43499"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53166" id="CVE-2026-53166" type="cve" title="CVE-2026-53166"/>
      <reference href="https://bugzilla.redhat.com/2467059" id="2467059" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480453" id="2480453" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492805" id="2492805" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38492.html" id="ALSA-2026:38492" type="self" title="ALSA-2026:38492"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.33.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">cb6b5ac15159f9f1673206a9a80d24ed89608d643c0b10f5ae9295c1579474e0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38495</id>
    <title>Important: podman security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-14 08:52:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38495" id="RHSA-2026:38495" type="rhsa" title="RHSA-2026:38495"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822"/>
      <reference href="https://bugzilla.redhat.com/2498152" id="2498152" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38495.html" id="ALSA-2026:38495" type="self" title="ALSA-2026:38495"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="podman-docker" version="5.8.2" release="5.el10_2.alma.1" epoch="7" arch="noarch" src="podman-5.8.2-5.el10_2.alma.1.src.rpm">
          <filename>podman-docker-5.8.2-5.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">6d642e7bf54d7d8737244e959bd94e167100278c8303a9671587b40898d8f8a0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38514</id>
    <title>Important: plexus-utils security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-14 08:49:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>plexus-utils security update</summary>
    <description>The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage.  

Security Fix(es):  

  * org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38514" id="RHSA-2026:38514" type="rhsa" title="RHSA-2026:38514"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-67030" id="CVE-2025-67030" type="cve" title="CVE-2025-67030"/>
      <reference href="https://bugzilla.redhat.com/2451409" id="2451409" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38514.html" id="ALSA-2026:38514" type="self" title="ALSA-2026:38514"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="plexus-utils" version="3.5.1" release="9.el10_2" epoch="0" arch="noarch" src="plexus-utils-3.5.1-9.el10_2.src.rpm">
          <filename>plexus-utils-3.5.1-9.el10_2.noarch.rpm</filename>
          <sum type="sha256">0e05d395f8b55a153026dfa3c8010ad4245d0439c34d80e42db758da41ab8738</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39183</id>
    <title>Important: python3.12 security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 08:44:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.12 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39183" id="RHSA-2026:39183" type="rhsa" title="RHSA-2026:39183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15308" id="CVE-2026-15308" type="cve" title="CVE-2026-15308"/>
      <reference href="https://bugzilla.redhat.com/2498608" id="2498608" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39183.html" id="ALSA-2026:39183" type="self" title="ALSA-2026:39183"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="python-unversioned-command" version="3.12.13" release="2.el10_2.1" epoch="0" arch="noarch" src="python3.12-3.12.13-2.el10_2.1.src.rpm">
          <filename>python-unversioned-command-3.12.13-2.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">01fd0cfaa34357b582559770297e93d57c2b9e0ffb6f529c89ba4cd34d50ce96</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39297</id>
    <title>Moderate: edk2 security, bug fix, and enhancement update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-08-13 08:05:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>edk2 security, bug fix, and enhancement update</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   

Security Fix(es):  

  * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)
  * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)


Bug Fix(es) and Enhancement(s):  

  * edk2/x64: re-enable legacy kernel loader [almalinux-10.2.z] (JIRA:AlmaLinux-182421)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39297" id="RHSA-2026:39297" type="rhsa" title="RHSA-2026:39297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-28390" id="CVE-2026-28390" type="cve" title="CVE-2026-28390"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31790" id="CVE-2026-31790" type="cve" title="CVE-2026-31790"/>
      <reference href="https://bugzilla.redhat.com/2451094" id="2451094" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456314" id="2456314" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39297.html" id="ALSA-2026:39297" type="self" title="ALSA-2026:39297"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="edk2-ovmf" version="20251114" release="5.el10_2.2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.2.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">15c2aa72562324380757fa4e4264b27e8d215a4ead60505448e6556096472823</sum>
        </package>
        <package name="edk2-aarch64" version="20251114" release="5.el10_2.2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.2.src.rpm">
          <filename>edk2-aarch64-20251114-5.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">5ebf1586f73cdbb4f6af4b6fac8634e21e96c81337572dd52d11cb6022b477ab</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39494</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-08-07 12:56:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
  * kernel: XFS data corruption using reflink ()


Bug Fix(es) and Enhancement(s):  

  * [Exploits (KEV)] kernel: XFS data corruption using reflink [almalinux-10.2.z] (JIRA:AlmaLinux-193945)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39494" id="RHSA-2026:39494" type="rhsa" title="RHSA-2026:39494"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53016" id="CVE-2026-53016" type="cve" title="CVE-2026-53016"/>
      <reference href="https://bugzilla.redhat.com/2492269" id="2492269" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498915" id="2498915" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39494.html" id="ALSA-2026:39494" type="self" title="ALSA-2026:39494"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-64600.html" id="CVE-2026-64600" type="cve" title="CVE-2026-64600"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.34.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">f70c0c028135ad9c40726ef7b16d8d2b3251fe80614da1fb1532d5c0d7eb97a4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:40833</id>
    <title>Important: pacemaker security update</title>
    <issued date="2026-07-16 00:00:00"/>
    <updated date="2026-08-13 08:05:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>pacemaker security update</summary>
    <description>The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures.   

Security Fix(es):  

  * pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:40833" id="RHSA-2026:40833" type="rhsa" title="RHSA-2026:40833"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10649" id="CVE-2026-10649" type="cve" title="CVE-2026-10649"/>
      <reference href="https://bugzilla.redhat.com/2462817" id="2462817" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-40833.html" id="ALSA-2026:40833" type="self" title="ALSA-2026:40833"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="pacemaker-schemas" version="3.0.1" release="5.el10_2.1" epoch="0" arch="noarch" src="pacemaker-3.0.1-5.el10_2.1.src.rpm">
          <filename>pacemaker-schemas-3.0.1-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6e3da70c121af183095ce7a58c2b0a382194143758f71b5c897c62fa60a07c53</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42694</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-07-21 00:00:00"/>
    <updated date="2026-07-22 13:46:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)
  * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
  * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42694" id="RHSA-2026:42694" type="rhsa" title="RHSA-2026:42694"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5435" id="CVE-2026-5435" type="cve" title="CVE-2026-5435"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5928" id="CVE-2026-5928" type="cve" title="CVE-2026-5928"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6238" id="CVE-2026-6238" type="cve" title="CVE-2026-6238"/>
      <reference href="https://bugzilla.redhat.com/2459854" id="2459854" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463465" id="2463465" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463539" id="2463539" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42694.html" id="ALSA-2026:42694" type="self" title="ALSA-2026:42694"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="glibc-doc" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-128.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">ec6e77a457ba7f13faf9ac4994f0f83f6fa55864f6690c7cb0495903d28a82f2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42919</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-21 00:00:00"/>
    <updated date="2026-07-24 10:19:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)
  * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
  * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)
  * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)
  * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
  * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
  * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)
  * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)
  * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)
  * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)
  * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)
  * kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()


Bug Fix(es) and Enhancement(s):  

  * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:AlmaLinux-173103)
  * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975)
  * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [almalinux-10.2.z] (JIRA:AlmaLinux-186311)
  * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42919" id="RHSA-2026:42919" type="rhsa" title="RHSA-2026:42919"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71113" id="CVE-2025-71113" type="cve" title="CVE-2025-71113"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71147" id="CVE-2025-71147" type="cve" title="CVE-2025-71147"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23168" id="CVE-2026-23168" type="cve" title="CVE-2026-23168"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31530" id="CVE-2026-31530" type="cve" title="CVE-2026-31530"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46116" id="CVE-2026-46116" type="cve" title="CVE-2026-46116"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46150" id="CVE-2026-46150" type="cve" title="CVE-2026-46150"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46215" id="CVE-2026-46215" type="cve" title="CVE-2026-46215"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52950" id="CVE-2026-52950" type="cve" title="CVE-2026-52950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52976" id="CVE-2026-52976" type="cve" title="CVE-2026-52976"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53009" id="CVE-2026-53009" type="cve" title="CVE-2026-53009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53071" id="CVE-2026-53071" type="cve" title="CVE-2026-53071"/>
      <reference href="https://bugzilla.redhat.com/2429611" id="2429611" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2432366" id="2432366" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439941" id="2439941" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460644" id="2460644" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482523" id="2482523" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482612" id="2482612" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482615" id="2482615" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492284" id="2492284" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492318" id="2492318" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492390" id="2492390" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492458" id="2492458" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42919.html" id="ALSA-2026:42919" type="self" title="ALSA-2026:42919"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.37.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">87d31242d05551914e981aae0b0f4d898f16e6999a0326758830d5c4a4582d3f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:43400</id>
    <title>Important: dogtag-pki security update</title>
    <issued date="2026-07-22 00:00:00"/>
    <updated date="2026-07-22 13:34:25"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dogtag-pki security update</summary>
    <description>IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:   

  * Certificate Authority (CA)
  * Key Recovery Authority (KRA)
  * Online Certificate Status Protocol (OCSP) Manager
  * Token Key Service (TKS)
  * Token Processing Service (TPS)
  * Automatic Certificate Management Environment (ACME) Responder
  * Enrollment over Secure Transport (EST) Responder


Security Fix(es):  

  * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)
  * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:43400" id="RHSA-2026:43400" type="rhsa" title="RHSA-2026:43400"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-54512" id="CVE-2026-54512" type="cve" title="CVE-2026-54512"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-54513" id="CVE-2026-54513" type="cve" title="CVE-2026-54513"/>
      <reference href="https://bugzilla.redhat.com/2492010" id="2492010" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492015" id="2492015" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-43400.html" id="ALSA-2026:43400" type="self" title="ALSA-2026:43400"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="idm-pki-kra" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-kra-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">0969cdaf908804a41b9168709166a69e8aa7ae8fcc2e747357080f04a1172f5e</sum>
        </package>
        <package name="idm-pki-ca" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-ca-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">0b735f0dd0d261caa3582e67de71f6261dbab4015274cff710fc04879b00b9e9</sum>
        </package>
        <package name="idm-pki-java" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-java-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">19db97d8c3e96b064b9b644b115703383e1a284592656856fb4c10b17f0ff783</sum>
        </package>
        <package name="idm-pki-base" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-base-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">2078148c1821766f42e07686376b4f47372e0d8d1f28117d64c14ecfa9c35ec2</sum>
        </package>
        <package name="idm-pki-acme" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-acme-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">65f47e5c5837435369b77d7a6e0414cfd4e2ab76ac728e69b36043659fdf4ae8</sum>
        </package>
        <package name="python3-idm-pki" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>python3-idm-pki-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">6e8938d303bc048889247d06f240b4f4e4629de2d3a8d8d05230791ef281e8a6</sum>
        </package>
        <package name="idm-pki-server" version="11.9.0" release="4.el10_2.alma.1" epoch="0" arch="noarch" src="dogtag-pki-11.9.0-4.el10_2.alma.1.src.rpm">
          <filename>idm-pki-server-11.9.0-4.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">b82532ebd593f44ece5bc792082777393864e54da71878f86dc5d3f9abd9a78a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:44270</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-23 00:00:00"/>
    <updated date="2026-07-25 07:46:54"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:44270" id="RHSA-2026:44270" type="rhsa" title="RHSA-2026:44270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46323" id="CVE-2026-46323" type="cve" title="CVE-2026-46323"/>
      <reference href="https://bugzilla.redhat.com/2479832" id="2479832" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-44270.html" id="ALSA-2026:44270" type="self" title="ALSA-2026:44270"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.38.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">4a069b5675e58961c90a55b7563fc8b4cdfeb44341f929a948dd293d00bbc4cb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:45114</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-24 00:00:00"/>
    <updated date="2026-08-07 12:56:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237)
  * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)
  * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)
  * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)
  * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973)
  * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)


</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:45114" id="RHSA-2026:45114" type="rhsa" title="RHSA-2026:45114"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40237" id="CVE-2025-40237" type="cve" title="CVE-2025-40237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23110" id="CVE-2026-23110" type="cve" title="CVE-2026-23110"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31692" id="CVE-2026-31692" type="cve" title="CVE-2026-31692"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46099" id="CVE-2026-46099" type="cve" title="CVE-2026-46099"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52973" id="CVE-2026-52973" type="cve" title="CVE-2026-52973"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53059" id="CVE-2026-53059" type="cve" title="CVE-2026-53059"/>
      <reference href="https://bugzilla.redhat.com/2418829" id="2418829" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436755" id="2436755" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464093" id="2464093" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481972" id="2481972" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492277" id="2492277" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492413" id="2492413" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-45114.html" id="ALSA-2026:45114" type="self" title="ALSA-2026:45114"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-64561.html" id="CVE-2026-64561" type="cve" title="CVE-2026-64561"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.39.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">bed818f0799b768ff6cfc2f657938405ca4fdd836ecda0511057e50c36a60fb4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:46395</id>
    <title>Important: go-fdo-server security update</title>
    <issued date="2026-07-27 00:00:00"/>
    <updated date="2026-07-28 10:57:05"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>go-fdo-server security update</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.  

Security Fix(es):  

  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:46395" id="RHSA-2026:46395" type="rhsa" title="RHSA-2026:46395"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484207" id="2484207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-46395.html" id="ALSA-2026:46395" type="self" title="ALSA-2026:46395"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="go-fdo-server-owner" version="1.0.1" release="2.el10_2.3" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.3.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-2.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">8a1f12fb60dd6f709e8d044b6d020d14de7e6afbde8dda5848544a5e669cff85</sum>
        </package>
        <package name="go-fdo-server-rendezvous" version="1.0.1" release="2.el10_2.3" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.3.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-2.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">caf1db0da6a4940dc368733c9e45509fe9a782dd4331421e6ca8bcf1a5779321</sum>
        </package>
        <package name="go-fdo-server-manufacturer" version="1.0.1" release="2.el10_2.3" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-2.el10_2.3.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-2.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">cb7c2a74215550a5f2ce3d4355be09b754b0e502285caecb7e0f536ef2a0011f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47017</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-08-01 22:58:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)
  * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)
  * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)
  * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281)


Bug Fix(es) and Enhancement(s):  

  * rxrpc: Address CVE-2026-43500 [almalinux-10.2.z] (JIRA:AlmaLinux-178254)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47017" id="RHSA-2026:47017" type="rhsa" title="RHSA-2026:47017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46086" id="CVE-2026-46086" type="cve" title="CVE-2026-46086"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52993" id="CVE-2026-52993" type="cve" title="CVE-2026-52993"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53006" id="CVE-2026-53006" type="cve" title="CVE-2026-53006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53281" id="CVE-2026-53281" type="cve" title="CVE-2026-53281"/>
      <reference href="https://bugzilla.redhat.com/2481989" id="2481989" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492363" id="2492363" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492437" id="2492437" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493728" id="2493728" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47017.html" id="ALSA-2026:47017" type="self" title="ALSA-2026:47017"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.40.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">3f33284f7c4ea3f56149f8190f4db9d0acabacfef1186c7aa7ad46d25395aa49</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48032</id>
    <title>Important: nodejs-nodemon security update</title>
    <issued date="2026-07-29 00:00:00"/>
    <updated date="2026-07-30 13:20:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs-nodemon security update</summary>
    <description>Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.  

Security Fix(es):  

  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48032" id="RHSA-2026:48032" type="rhsa" title="RHSA-2026:48032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13149" id="CVE-2026-13149" type="cve" title="CVE-2026-13149"/>
      <reference href="https://bugzilla.redhat.com/2494813" id="2494813" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48032.html" id="ALSA-2026:48032" type="self" title="ALSA-2026:48032"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nodejs-nodemon" version="3.1.14" release="2.el10_2" epoch="0" arch="noarch" src="nodejs-nodemon-3.1.14-2.el10_2.src.rpm">
          <filename>nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">bbd3e0be33345b40f7140ed617b9d6ac035fa7d714eef964005b4f634524f37c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48033</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-07-29 00:00:00"/>
    <updated date="2026-07-30 13:20:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs22 security update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.  

Security Fix(es):  

  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48033" id="RHSA-2026:48033" type="rhsa" title="RHSA-2026:48033"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13149" id="CVE-2026-13149" type="cve" title="CVE-2026-13149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59873" id="CVE-2026-59873" type="cve" title="CVE-2026-59873"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59874" id="CVE-2026-59874" type="cve" title="CVE-2026-59874"/>
      <reference href="https://bugzilla.redhat.com/2494813" id="2494813" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498116" id="2498116" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498120" id="2498120" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48033.html" id="ALSA-2026:48033" type="self" title="ALSA-2026:48033"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nodejs-docs" version="22.23.1" release="4.el10_2" epoch="1" arch="noarch" src="nodejs22-22.23.1-4.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-4.el10_2.noarch.rpm</filename>
          <sum type="sha256">4a83c12224f35412b6625e9741ade14adf2898f3deb3cc76c129e06984205bf2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48034</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-07-29 00:00:00"/>
    <updated date="2026-07-30 13:20:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs24 security update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  

Security Fix(es):  

  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48034" id="RHSA-2026:48034" type="rhsa" title="RHSA-2026:48034"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13149" id="CVE-2026-13149" type="cve" title="CVE-2026-13149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59873" id="CVE-2026-59873" type="cve" title="CVE-2026-59873"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59874" id="CVE-2026-59874" type="cve" title="CVE-2026-59874"/>
      <reference href="https://bugzilla.redhat.com/2494813" id="2494813" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498116" id="2498116" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498120" id="2498120" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48034.html" id="ALSA-2026:48034" type="self" title="ALSA-2026:48034"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nodejs24-docs" version="24.18.0" release="3.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-docs-24.18.0-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">89066bd3e4a424f6060b375e6c02c05394b0753a9457c3f2bea0b8ca3a7ef097</sum>
        </package>
        <package name="nodejs24-npm" version="11.16.0" release="1.24.18.0.3.el10_2" epoch="1" arch="noarch" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm</filename>
          <sum type="sha256">a0d67f6698a66c5d36c8a723a620bfc3e7512941af628d160a75f70e47142745</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:48585</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-07-30 00:00:00"/>
    <updated date="2026-07-31 09:23:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>fence-agents security update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   

Security Fix(es):  

  * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:48585" id="RHSA-2026:48585" type="rhsa" title="RHSA-2026:48585"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59939" id="CVE-2026-59939" type="cve" title="CVE-2026-59939"/>
      <reference href="https://bugzilla.redhat.com/2498212" id="2498212" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-48585.html" id="ALSA-2026:48585" type="self" title="ALSA-2026:48585"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="fence-agents-scsi" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-scsi-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">02a9562b78a8a24d7e333970efbc532e24161062499846a84fe75f07c16df2e2</sum>
        </package>
        <package name="fence-agents-cisco-mds" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">0585c3e9f38920e515019f74ebdb69e2987cda9c3fc8f55553b0d5b46a04667e</sum>
        </package>
        <package name="fence-agents-ifmib" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">079ef24bb4d641ff4713ab43de2a354ad8dc7350f764f31380313fb52bb8e396</sum>
        </package>
        <package name="fence-agents-eaton-snmp" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">089facbd88cf4480c948daef5080d8a4e863f876af741e894953a052c18472f1</sum>
        </package>
        <package name="fence-agents-apc-snmp" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">0ed42a2237e32de2ee788e8d1ce0205de2e3e3668fe8621b0454862360f4cae9</sum>
        </package>
        <package name="fence-agents-virsh" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-virsh-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">0fbe596f99db8f892c67c85f7cca46ccd883667a63ee6aa5c0a06fc771d1546a</sum>
        </package>
        <package name="fence-agents-rsa" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-rsa-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">1af89745129e72d3cf10835d0b18dc20f4fbb3c87def696fa64d2677f26078eb</sum>
        </package>
        <package name="fence-agents-rsb" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-rsb-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">205874c6618128431f134d578571738ee9368d524e16f9991bf507a48a1fc4af</sum>
        </package>
        <package name="fence-agents-wti" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-wti-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">2ac50c4183e12154477c90ad233354a1b426ce6ada8318cd9ff1c95783d0a6e9</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">33a6033ef28cbf57fe6ae177ba899bee9efa2586458cfc9f4b17d8816f4852e9</sum>
        </package>
        <package name="fence-agents-sbd" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-sbd-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">393ba16d2124e745058334be1a9ea19466f1ea2ed79be749f9534c0eb2eae3a0</sum>
        </package>
        <package name="fence-agents-ilo-ssh" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">3b06b3b6370f1542f6c561b830148802a761f1a54cced27f5b897bc72bbf000c</sum>
        </package>
        <package name="fence-agents-bladecenter" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">43be7813f12ea8487c7144e058efdca667f8ee63e3b8fb3688b1ee768242c4db</sum>
        </package>
        <package name="fence-agents-amt-ws" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">4f4f9455dc2124c09068d3955018c52d59c5e5787e20c74b56664df7585682b8</sum>
        </package>
        <package name="fence-agents-brocade" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-brocade-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">512d3a91950b1d4aba9d521f1b1298cb5281a94cc741007163fdefa3ff9c6d6b</sum>
        </package>
        <package name="fence-agents-mpath" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-mpath-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">63316b6226135353f691c6e8611077a5d55c61e96e1bbd2f0feae1ef1156055f</sum>
        </package>
        <package name="fence-agents-eps" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-eps-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">70805cb3186ce3b83c61dd6a92392e10e2269d97bb12901831a705caa2e13e67</sum>
        </package>
        <package name="fence-agents-ibm-powervs" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">769c27a5bdf674e7ae7d3e284ca2ef59c325032952f687138b4de3eb49bbf684</sum>
        </package>
        <package name="fence-agents-ibmblade" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">7d422de49cf099ef097c46e463774d835a7a6341739f62bf21f362bf0369b424</sum>
        </package>
        <package name="fence-agents-hpblade" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">89fef3d43f7585019392d0dc5d961f1c4648edbad79329024e184b6e229a1f31</sum>
        </package>
        <package name="fence-agents-lpar" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-lpar-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">91ae58cf021e245e1a1bf1024c70c1f559915400b560633a3068c117a652dbec</sum>
        </package>
        <package name="fence-agents-cisco-ucs" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">9380d9758dfd4d1453e71e86b6de038363038a4d33fa19c298d368038b30f2cd</sum>
        </package>
        <package name="fence-agents-vmware-soap" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">998f6222b512104dd6ebeef7539b27e306dc5fcfa10ff8331e8975e680821aff</sum>
        </package>
        <package name="fence-agents-heuristics-ping" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">9a5a0dc003e77f5a9ea108f92a622c5d6976e36a844c4b748e069257b31f1021</sum>
        </package>
        <package name="fence-agents-intelmodular" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">af75659dc64c53a891fd4636e3b0602ad519684579d5271ea03c01a7caa278b2</sum>
        </package>
        <package name="fence-agents-emerson" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-emerson-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">b3ba20e516f6f7d2812656bf61775f98e42e342544de7b9ed01aa80028d7e454</sum>
        </package>
        <package name="fence-agents-vmware-rest" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">bc1b3776aff2e7d3bbe29a17599074c9bf396e5e1b77fe5ab1defede6847358b</sum>
        </package>
        <package name="fence-agents-apc" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-apc-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">bec0c532edc9657fca3d85daa3a0597c46af622904928c2339a37f0adf7ed7ce</sum>
        </package>
        <package name="fence-agents-nutanix-ahv" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-nutanix-ahv-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">c009350e071848c015df98437c80cab01c9ca98f0801415e0e5a445ee998c502</sum>
        </package>
        <package name="fence-agents-rhevm" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">c41641cbe4507b116bd310318f52a3d80536a50089c6df7dca2a11a7a759457c</sum>
        </package>
        <package name="fence-agents-drac5" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-drac5-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">c72dc94ebe3471be09580a457d1e65fd832107047626548b5bfb15a04b9060dc</sum>
        </package>
        <package name="fence-agents-ipmilan" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">cc3c20cef2b889d5204bd8db41430e7e4147d375fba2c598f1d7f4ae9a00fd26</sum>
        </package>
        <package name="fence-agents-ilo2" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">eb84f77d4c349914d249a21e99b260421c5f9152deb8ab4f6aefcad2c4b71e68</sum>
        </package>
        <package name="fence-agents-ilo-mp" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">eeb9b2bc6cde8b87c3ec4e65ba4ab628d789e89f6bb675f9de06ddff240c830a</sum>
        </package>
        <package name="fence-agents-ibm-vpc" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">f902c8e652433f804325f4d993ebdaaa7d96b4806e8da803c04d74fd44eb47e5</sum>
        </package>
        <package name="fence-agents-ipdu" version="4.16.0" release="21.el10_2.5" epoch="0" arch="noarch" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">fc9de80e97011d49b8861f131eb3794c92c566c1c4502d917365892d71a8bb61</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49211</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-31 00:00:00"/>
    <updated date="2026-08-06 14:44:59"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)
  * kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303)
  * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle ()


Bug Fix(es) and Enhancement(s):  

  * [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [almalinux-10.2.z] (JIRA:AlmaLinux-185669)
  * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-10.2.z] (JIRA:AlmaLinux-212063)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49211" id="RHSA-2026:49211" type="rhsa" title="RHSA-2026:49211"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68211" id="CVE-2025-68211" type="cve" title="CVE-2025-68211"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46303" id="CVE-2026-46303" type="cve" title="CVE-2026-46303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64530" id="CVE-2026-64530" type="cve" title="CVE-2026-64530"/>
      <reference href="https://bugzilla.redhat.com/2422696" id="2422696" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486471" id="2486471" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504052" id="2504052" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49211.html" id="ALSA-2026:49211" type="self" title="ALSA-2026:49211"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.42.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">bf419056c1f25a425baf0071c6b140681f7a5be5fb6970d09bdaddba8a9d6353</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49523</id>
    <title>Important: perl-Archive-Tar security update</title>
    <issued date="2026-08-03 00:00:00"/>
    <updated date="2026-08-04 16:37:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-Archive-Tar security update</summary>
    <description>Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.  

Security Fix(es):  

  * perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size (CVE-2026-9538)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49523" id="RHSA-2026:49523" type="rhsa" title="RHSA-2026:49523"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9538" id="CVE-2026-9538" type="cve" title="CVE-2026-9538"/>
      <reference href="https://bugzilla.redhat.com/2481315" id="2481315" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49523.html" id="ALSA-2026:49523" type="self" title="ALSA-2026:49523"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="perl-Archive-Tar" version="3.02" release="512.el10_2.2" epoch="0" arch="noarch" src="perl-Archive-Tar-3.02-512.el10_2.2.src.rpm">
          <filename>perl-Archive-Tar-3.02-512.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d2c6df33777b5bff8ce63f4a073d414a7c9afac6e1da152d7b5a41393951e548</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49871</id>
    <title>Moderate: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-04 00:00:00"/>
    <updated date="2026-08-07 08:58:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214)
  * kernel: procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199)


Bug Fix(es) and Enhancement(s):  

  * [Lenovo] Graphics not working on T14 G7 Intel (Pantherlake) (JIRA:AlmaLinux-172832)
  * Possible regression with FM350GL [almalinux-10.2.z] (JIRA:AlmaLinux-184266)
  * [10.2 FEAT] CNB102: dpll: sync with upstream (JIRA:AlmaLinux-211011)
  * backport make module and modules-core provides use variant [almalinux-10.2.z] (JIRA:AlmaLinux-213965)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49871" id="RHSA-2026:49871" type="rhsa" title="RHSA-2026:49871"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68214" id="CVE-2025-68214" type="cve" title="CVE-2025-68214"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23199" id="CVE-2026-23199" type="cve" title="CVE-2026-23199"/>
      <reference href="https://bugzilla.redhat.com/2422686" id="2422686" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439919" id="2439919" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49871.html" id="ALSA-2026:49871" type="self" title="ALSA-2026:49871"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.43.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1c74553d75296b52e5083e8873de03e04a8574cf085839e5ac3f4e2003a287ca</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:51295</id>
    <title>Moderate: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-06 00:00:00"/>
    <updated date="2026-08-11 08:56:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CVE-2026-43186)


Bug Fix(es) and Enhancement(s):  

  * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-10.2.z] (JIRA:AlmaLinux-186345)
  * ice: driver update 2026-06, part 2 [almalinux-10.2.z] (JIRA:AlmaLinux-193134)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:51295" id="RHSA-2026:51295" type="rhsa" title="RHSA-2026:51295"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43186" id="CVE-2026-43186" type="cve" title="CVE-2026-43186"/>
      <reference href="https://bugzilla.redhat.com/2467143" id="2467143" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-51295.html" id="ALSA-2026:51295" type="self" title="ALSA-2026:51295"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.44.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.44.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.44.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1c4aade5d5fb516248eb660f2819523377e9feca8b77c696901ba628dcc0602a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:52841</id>
    <title>Important: nodejs-nodemon security update</title>
    <issued date="2026-08-10 00:00:00"/>
    <updated date="2026-08-11 08:56:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs-nodemon security update</summary>
    <description>Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.  

Security Fix(es):  

  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:52841" id="RHSA-2026:52841" type="rhsa" title="RHSA-2026:52841"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-69152" id="CVE-2026-69152" type="cve" title="CVE-2026-69152"/>
      <reference href="https://bugzilla.redhat.com/2510722" id="2510722" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-52841.html" id="ALSA-2026:52841" type="self" title="ALSA-2026:52841"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nodejs-nodemon" version="3.1.14" release="3.el10_2" epoch="0" arch="noarch" src="nodejs-nodemon-3.1.14-3.el10_2.src.rpm">
          <filename>nodejs-nodemon-3.1.14-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">754dbb75c7096126fe89e0025ab2e31e63eda960fb77226c5e627a74feb18d21</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:53330</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-11 00:00:00"/>
    <updated date="2026-08-13 09:17:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: fsnotify: Fix ordering of iput() and watched_objects decrement (CVE-2024-53143)
  * kernel: shmem: fix recovery on rename failures (CVE-2025-71072)
  * kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415)
  * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)
  * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)
  * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368)
  * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)


Bug Fix(es) and Enhancement(s):  

  * Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-10.2.z] (JIRA:AlmaLinux-213035)
  * AlmaLinux10.0 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-10.2.z] (JIRA:AlmaLinux-222503)
  * AlmaLinux10.0 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-10.2.z] (JIRA:AlmaLinux-222505)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:53330" id="RHSA-2026:53330" type="rhsa" title="RHSA-2026:53330"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-53143" id="CVE-2024-53143" type="cve" title="CVE-2024-53143"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71072" id="CVE-2025-71072" type="cve" title="CVE-2025-71072"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23415" id="CVE-2026-23415" type="cve" title="CVE-2026-23415"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31488" id="CVE-2026-31488" type="cve" title="CVE-2026-31488"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52923" id="CVE-2026-52923" type="cve" title="CVE-2026-52923"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64368" id="CVE-2026-64368" type="cve" title="CVE-2026-64368"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64531" id="CVE-2026-64531" type="cve" title="CVE-2026-64531"/>
      <reference href="https://bugzilla.redhat.com/2330957" id="2330957" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2429083" id="2429083" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454320" id="2454320" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460619" id="2460619" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492094" id="2492094" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507213" id="2507213" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507402" id="2507402" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-53330.html" id="ALSA-2026:53330" type="self" title="ALSA-2026:53330"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.46.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.46.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.46.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">889073b12cc0ea295f2ca8fe44265cfc363bf64df9f9389e1236bf5667da86f5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:54343</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-12 00:00:00"/>
    <updated date="2026-08-14 10:45:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202)
  * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
  * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)
  * kernel: perf/aux: Fix page UAF in map_range() (CVE-2026-64300)
  * kernel: af_unix: set gc_in_progress to true in unix_gc() (CVE-2026-53361)


Bug Fix(es) and Enhancement(s):  

  * netfilter: CVE backports for AlmaLinux 10.2.z (JIRA:AlmaLinux-185311)
  * tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-10.2.z] (JIRA:AlmaLinux-214436)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:54343" id="RHSA-2026:54343" type="rhsa" title="RHSA-2026:54343"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53202" id="CVE-2026-53202" type="cve" title="CVE-2026-53202"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53264" id="CVE-2026-53264" type="cve" title="CVE-2026-53264"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-63887" id="CVE-2026-63887" type="cve" title="CVE-2026-63887"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64300" id="CVE-2026-64300" type="cve" title="CVE-2026-64300"/>
      <reference href="https://bugzilla.redhat.com/2492823" id="2492823" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492851" id="2492851" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502447" id="2502447" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2507040" id="2507040" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-54343.html" id="ALSA-2026:54343" type="self" title="ALSA-2026:54343"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.47.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.47.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.47.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b6ea785a24bb7a5f9f936164f09340cbc926d13f91290fde4caa9d611fc41c48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55424</id>
    <title>Important: 389-ds-base security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:58:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>389-ds-base security update</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.  

Security Fix(es):  

  * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770)
  * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788)
  * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55424" id="RHSA-2026:55424" type="rhsa" title="RHSA-2026:55424"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11770" id="CVE-2026-11770" type="cve" title="CVE-2026-11770"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11788" id="CVE-2026-11788" type="cve" title="CVE-2026-11788"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15722" id="CVE-2026-15722" type="cve" title="CVE-2026-15722"/>
      <reference href="https://bugzilla.redhat.com/2484802" id="2484802" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2485423" id="2485423" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2499961" id="2499961" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55424.html" id="ALSA-2026:55424" type="self" title="ALSA-2026:55424"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="python3-lib389" version="3.2.0" release="9.el10_2" epoch="0" arch="noarch" src="389-ds-base-3.2.0-9.el10_2.src.rpm">
          <filename>python3-lib389-3.2.0-9.el10_2.noarch.rpm</filename>
          <sum type="sha256">27cf3e06e99257f4c51c72088b1f9e5f48d590b294e516768385c0f484ac53a2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55437</id>
    <title>Important: bind security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 08:56:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>bind security update</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  

Security Fix(es):  

  * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
  * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
  * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)
  * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
  * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
  * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55437" id="RHSA-2026:55437" type="rhsa" title="RHSA-2026:55437"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10723" id="CVE-2026-10723" type="cve" title="CVE-2026-10723"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11331" id="CVE-2026-11331" type="cve" title="CVE-2026-11331"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11622" id="CVE-2026-11622" type="cve" title="CVE-2026-11622"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11721" id="CVE-2026-11721" type="cve" title="CVE-2026-11721"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13204" id="CVE-2026-13204" type="cve" title="CVE-2026-13204"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-13321" id="CVE-2026-13321" type="cve" title="CVE-2026-13321"/>
      <reference href="https://bugzilla.redhat.com/2503721" id="2503721" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504166" id="2504166" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504298" id="2504298" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504338" id="2504338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504447" id="2504447" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504560" id="2504560" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55437.html" id="ALSA-2026:55437" type="self" title="ALSA-2026:55437"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="bind-license" version="9.18.33" release="15.el10_2.10" epoch="32" arch="noarch" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-license-9.18.33-15.el10_2.10.noarch.rpm</filename>
          <sum type="sha256">e7269f3a04d0f19af0b01cb87ae997a2d63f8b901c3fbbbd06b2be1ac756d519</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55541</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-18 11:35:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nodejs22 security update</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.  

Security Fix(es):  

  * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55541" id="RHSA-2026:55541" type="rhsa" title="RHSA-2026:55541"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14257" id="CVE-2026-14257" type="cve" title="CVE-2026-14257"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-69152" id="CVE-2026-69152" type="cve" title="CVE-2026-69152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-69192" id="CVE-2026-69192" type="cve" title="CVE-2026-69192"/>
      <reference href="https://bugzilla.redhat.com/2506433" id="2506433" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510722" id="2510722" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2510801" id="2510801" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55541.html" id="ALSA-2026:55541" type="self" title="ALSA-2026:55541"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="nodejs-docs" version="22.23.1" release="6.el10_2" epoch="1" arch="noarch" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-6.el10_2.noarch.rpm</filename>
          <sum type="sha256">a4cf7db461223295f0f82718617815510079e00e6e5e5f79921d8490e5169df3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:55617</id>
    <title>Important: pcp security update</title>
    <issued date="2026-08-17 00:00:00"/>
    <updated date="2026-08-19 12:22:54"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>pcp security update</summary>
    <description>Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.  

Security Fix(es):  

  * PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524)
  * PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526)
  * PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527)
  * PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:55617" id="RHSA-2026:55617" type="rhsa" title="RHSA-2026:55617"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16524" id="CVE-2026-16524" type="cve" title="CVE-2026-16524"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16526" id="CVE-2026-16526" type="cve" title="CVE-2026-16526"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16527" id="CVE-2026-16527" type="cve" title="CVE-2026-16527"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16529" id="CVE-2026-16529" type="cve" title="CVE-2026-16529"/>
      <reference href="https://bugzilla.redhat.com/2506023" id="2506023" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2506026" id="2506026" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2506031" id="2506031" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2506032" id="2506032" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-55617.html" id="ALSA-2026:55617" type="self" title="ALSA-2026:55617"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="pcp-doc" version="7.0.3" release="5.el10_2" epoch="0" arch="noarch" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-doc-7.0.3-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">94a7dc3f75afab71ce735dd038541108a4e6b18e03790db4d1e46bbc272ecb1d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:56007</id>
    <title>Important: mysql8.4 security, bug fix, and enhancement update</title>
    <issued date="2026-08-18 00:00:00"/>
    <updated date="2026-08-19 14:17:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>mysql8.4 security, bug fix, and enhancement update</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.  

Security Fix(es):  

  * mysql: Performance Schema unspecified vulnerability (CPU Jul 2026) (CVE-2026-61081)
  * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47064)
  * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47012)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60331)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60190)
  * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60177)
  * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-60145)
  * mysql: DDL unspecified vulnerability (CPU Jul 2026) (CVE-2026-46936)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60186)
  * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60315)
  * mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026) (CVE-2026-61096)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60163)
  * mysql: InnoDB unspecified vulnerability (CPU Jul 2026) (CVE-2026-47052)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60188)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60184)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60185)
  * mysql: JSON unspecified vulnerability (CPU Jul 2026) (CVE-2026-61109)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60191)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-61094)
  * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60178)
  * mysql: Group Replication GCS unspecified vulnerability (CPU Jul 2026) (CVE-2026-60332)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60189)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60747)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-47023)
  * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60183)
  * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60316)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60187)
  * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60585)
  * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60182)


Bug Fix(es) and Enhancement(s):  

  * [tracker] Rebase MySQL to 8.4.11 (JIRA:AlmaLinux-188044)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:56007" id="RHSA-2026:56007" type="rhsa" title="RHSA-2026:56007"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46936" id="CVE-2026-46936" type="cve" title="CVE-2026-46936"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47012" id="CVE-2026-47012" type="cve" title="CVE-2026-47012"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47023" id="CVE-2026-47023" type="cve" title="CVE-2026-47023"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47052" id="CVE-2026-47052" type="cve" title="CVE-2026-47052"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47064" id="CVE-2026-47064" type="cve" title="CVE-2026-47064"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60145" id="CVE-2026-60145" type="cve" title="CVE-2026-60145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60163" id="CVE-2026-60163" type="cve" title="CVE-2026-60163"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60177" id="CVE-2026-60177" type="cve" title="CVE-2026-60177"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60178" id="CVE-2026-60178" type="cve" title="CVE-2026-60178"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60182" id="CVE-2026-60182" type="cve" title="CVE-2026-60182"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60183" id="CVE-2026-60183" type="cve" title="CVE-2026-60183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60184" id="CVE-2026-60184" type="cve" title="CVE-2026-60184"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60185" id="CVE-2026-60185" type="cve" title="CVE-2026-60185"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60186" id="CVE-2026-60186" type="cve" title="CVE-2026-60186"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60187" id="CVE-2026-60187" type="cve" title="CVE-2026-60187"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60188" id="CVE-2026-60188" type="cve" title="CVE-2026-60188"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60189" id="CVE-2026-60189" type="cve" title="CVE-2026-60189"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60190" id="CVE-2026-60190" type="cve" title="CVE-2026-60190"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60191" id="CVE-2026-60191" type="cve" title="CVE-2026-60191"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60315" id="CVE-2026-60315" type="cve" title="CVE-2026-60315"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60316" id="CVE-2026-60316" type="cve" title="CVE-2026-60316"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60331" id="CVE-2026-60331" type="cve" title="CVE-2026-60331"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60332" id="CVE-2026-60332" type="cve" title="CVE-2026-60332"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60585" id="CVE-2026-60585" type="cve" title="CVE-2026-60585"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60747" id="CVE-2026-60747" type="cve" title="CVE-2026-60747"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61081" id="CVE-2026-61081" type="cve" title="CVE-2026-61081"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61094" id="CVE-2026-61094" type="cve" title="CVE-2026-61094"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61096" id="CVE-2026-61096" type="cve" title="CVE-2026-61096"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-61109" id="CVE-2026-61109" type="cve" title="CVE-2026-61109"/>
      <reference href="https://bugzilla.redhat.com/2504779" id="2504779" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504823" id="2504823" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504848" id="2504848" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504855" id="2504855" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504877" id="2504877" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504925" id="2504925" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504940" id="2504940" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505001" id="2505001" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505002" id="2505002" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505027" id="2505027" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505182" id="2505182" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505200" id="2505200" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505215" id="2505215" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505259" id="2505259" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505262" id="2505262" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505300" id="2505300" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505310" id="2505310" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505319" id="2505319" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505509" id="2505509" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505594" id="2505594" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505643" id="2505643" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505699" id="2505699" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505711" id="2505711" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505722" id="2505722" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505844" id="2505844" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505868" id="2505868" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505891" id="2505891" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505923" id="2505923" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2505927" id="2505927" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-56007.html" id="ALSA-2026:56007" type="self" title="ALSA-2026:56007"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="mysql8.4-errmsg" version="8.4.11" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.11-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.11-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">363b90f121ea2698cc9695f9f3309d5ffa0b6afbaa96304878cd6e0f4729dc7e</sum>
        </package>
        <package name="mysql8.4-common" version="8.4.11" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.11-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-common-8.4.11-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">c88645f04b3cebf77c1371c06af54dbc511288a9c7e60b32a1b8566680f797db</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:56971</id>
    <title>Important: perl-Date-Manip security update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-20 10:13:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-Date-Manip security update</summary>
    <description>Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.  

Security Fix(es):  

  * perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:56971" id="RHSA-2026:56971" type="rhsa" title="RHSA-2026:56971"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60075" id="CVE-2026-60075" type="cve" title="CVE-2026-60075"/>
      <reference href="https://bugzilla.redhat.com/2509486" id="2509486" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-56971.html" id="ALSA-2026:56971" type="self" title="ALSA-2026:56971"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="perl-Date-Manip" version="6.94" release="5.el10_2.1" epoch="0" arch="noarch" src="perl-Date-Manip-6.94-5.el10_2.1.src.rpm">
          <filename>perl-Date-Manip-6.94-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">10d103055b714ff49d9c99838b44a6ae39437022daa8f3446516cf8eca19f1d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:57148</id>
    <title>Important: ansible-core security update</title>
    <issued date="2026-08-19 00:00:00"/>
    <updated date="2026-08-21 09:20:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ansible-core security update</summary>
    <description>Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.  

Security Fix(es):  

  * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:57148" id="RHSA-2026:57148" type="rhsa" title="RHSA-2026:57148"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11332" id="CVE-2026-11332" type="cve" title="CVE-2026-11332"/>
      <reference href="https://bugzilla.redhat.com/2485379" id="2485379" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-57148.html" id="ALSA-2026:57148" type="self" title="ALSA-2026:57148"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-i686-appstream-rpms__10_0_default">
        <name>almalinux-10-for-i686-appstream-rpms__10_0_default</name>
        <package name="ansible-test" version="2.16.16" release="2.el10_2.1" epoch="1" arch="noarch" src="ansible-core-2.16.16-2.el10_2.1.src.rpm">
          <filename>ansible-test-2.16.16-2.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">278ed7a9b385cb985f51b9a6e708b16d47cae71cb98ba0d3c8d13b7c71d3f0de</sum>
        </package>
        <package name="ansible-core" version="2.16.16" release="2.el10_2.1" epoch="1" arch="noarch" src="ansible-core-2.16.16-2.el10_2.1.src.rpm">
          <filename>ansible-core-2.16.16-2.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">9e56e424dbf2c5ad2a45a0dfbe4d711e036865c0a60139679f71bec6f32d2897</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>