<updates>
  <update from="releng@rockylinux.org" status="final" type="bugfix" version="2">
    <id>RLBA-2025:5309</id>
    <title>Moderate:mod_proxy_cluster bug fix and enhancement update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHBA-2025:5309 (https://access.redhat.com/errata/RHBA-2025:5309), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_proxy_cluster.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>For detailed information on changes in this release, see the Rocky Linux 10.0 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10306" id="CVE-2024-10306" type="cve" title="CVE-2024-10306" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2321302" id="2321302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLBA-2025:5309" id="RLBA-2025:5309" type="self" title="RLBA-2025:5309" />
      <reference href="https://access.redhat.com/errata/RHBA-2025:5309" id="RHBA-2025:5309" type="vendor" title="Red Hat RHBA-2025:5309" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_proxy_cluster" arch="x86_64" epoch="0" version="1.3.21" release="1.el10" src="mod_proxy_cluster-1.3.21-1.el10.src.rpm">
          <filename>mod_proxy_cluster-1.3.21-1.el10.x86_64.rpm</filename>
          <sum type="sha256">d47c785dca12aa85b80b4bb5a951c494434e77e0b6b1002fa9706aaf88706f29</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7496</id>
    <title>Important: libxslt security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7496 (https://access.redhat.com/errata/RHSA-2025:7496), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libxslt.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. 

Security Fix(es):

* libxslt: Use-After-Free in libxslt numbers.c (CVE-2025-24855)

* libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) (CVE-2024-55549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55549" id="CVE-2024-55549" type="cve" title="CVE-2024-55549" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24855" id="CVE-2025-24855" type="cve" title="CVE-2025-24855" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2352483" id="2352483" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2352484" id="2352484" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7496" id="RLSA-2025:7496" type="self" title="RLSA-2025:7496" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7496" id="RHSA-2025:7496" type="vendor" title="Red Hat RHSA-2025:7496" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libxslt" arch="x86_64" epoch="0" version="1.1.39" release="7.el10_0" src="libxslt-1.1.39-7.el10_0.src.rpm">
          <filename>libxslt-1.1.39-7.el10_0.x86_64.rpm</filename>
          <sum type="sha256">424ec2d278a17b6e0d7d062eb36acc9cc27dc9d7899342b8ff3595482909aab9</sum>
        </package>
        <package name="libxslt-devel" arch="x86_64" epoch="0" version="1.1.39" release="7.el10_0" src="libxslt-1.1.39-7.el10_0.src.rpm">
          <filename>libxslt-devel-1.1.39-7.el10_0.x86_64.rpm</filename>
          <sum type="sha256">45f92355021a4ea8aff8065a9d34a3c6497d528c6f9238774f96f303e10407d2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7466</id>
    <title>Moderate: delve and golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7466 (https://access.redhat.com/errata/RHSA-2025:7466), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for delve, golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341)

* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)

* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336" id="CVE-2024-45336" type="cve" title="CVE-2024-45336" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45341" id="CVE-2024-45341" type="cve" title="CVE-2024-45341" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22866" id="CVE-2025-22866" type="cve" title="CVE-2025-22866" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2341750" id="2341750" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2341751" id="2341751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2344219" id="2344219" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7466" id="RLSA-2025:7466" type="self" title="RLSA-2025:7466" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7466" id="RHSA-2025:7466" type="vendor" title="Red Hat RHSA-2025:7466" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.24.1" release="1.el10_0" src="delve-1.24.1-1.el10_0.src.rpm">
          <filename>delve-1.24.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3d8994c1eefdff65ec281695346f895e11411b23cdc99e0cb242746705e9742f</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-1.23.7-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">92a4267a632e10f6758bc0d347033ed0c1774c52aeff82bedc59b0a24b2e8682</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-bin-1.23.7-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">eefc1975a747f63c479e9426811a77a3db5332310d57719e611107592d936abe</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-docs-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">a173b0da2e4752bfec1cf06f363224f6fa16ddba7370e6f2ffb8247587a4bcf4</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-misc-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">7bc05ee75edf98cb9343ef66d21fe35c1c592c61ba91484f778ac863170b4c0f</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-src-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">96f3dbb87940a6cfb09e7cc728c9fa35b1823688d51cdc133a0f9d051890835a</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-tests-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">859c5d5d9e4832afaeaf815e3564bfe80ada878f8e9efec2845d1c0e0cadbe4f</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>go-toolset-1.23.7-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3e3532f951f9e51ad82f778aa05129910b1a9ea887588c3258a903af48d65884</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7476</id>
    <title>Important: python-jinja2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7476 (https://access.redhat.com/errata/RHSA-2025:7476), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-jinja2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27516" id="CVE-2025-27516" type="cve" title="CVE-2025-27516" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2350190" id="2350190" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7476" id="RLSA-2025:7476" type="self" title="RLSA-2025:7476" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7476" id="RHSA-2025:7476" type="vendor" title="Red Hat RHSA-2025:7476" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-jinja2" arch="noarch" epoch="0" version="3.1.6" release="1.el10_0" src="python-jinja2-3.1.6-1.el10_0.src.rpm">
          <filename>python3-jinja2-3.1.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">0be3f5f469b49779d362bfeb982bfa4e089c5ba06907aea63c842224e044f287</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7484</id>
    <title>Important: gvisor-tap-vsock security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7484 (https://access.redhat.com/errata/RHSA-2025:7484), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gvisor-tap-vsock.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

Security Fix(es):

* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22869" id="CVE-2025-22869" type="cve" title="CVE-2025-22869" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2348367" id="2348367" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7484" id="RLSA-2025:7484" type="self" title="RLSA-2025:7484" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7484" id="RHSA-2025:7484" type="vendor" title="Red Hat RHSA-2025:7484" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gvisor-tap-vsock" arch="x86_64" epoch="6" version="0.8.5" release="1.el10_0" src="gvisor-tap-vsock-0.8.5-1.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-0.8.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">807c60e65b497f3a7439d900e72dd8c7efe2f0d6d32a52a4f626953fc47ceec2</sum>
        </package>
        <package name="gvisor-tap-vsock-gvforwarder" arch="x86_64" epoch="6" version="0.8.5" release="1.el10_0" src="gvisor-tap-vsock-0.8.5-1.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-gvforwarder-0.8.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9ef0ba89cb4ea139e96688f28f124a4d4c433fcf63f821d85ac33d3fee278cce</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7500</id>
    <title>Important: perl security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7500 (https://access.redhat.com/errata/RHSA-2025:7500), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

* perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (CVE-2024-56406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56406" id="CVE-2024-56406" type="cve" title="CVE-2024-56406" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359290" id="2359290" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7500" id="RLSA-2025:7500" type="self" title="RLSA-2025:7500" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7500" id="RHSA-2025:7500" type="vendor" title="Red Hat RHSA-2025:7500" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl" arch="x86_64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dab36262fee2fcd5d657f2ed802f7f537ef92f365c0460fe5820a9336d284801</sum>
        </package>
        <package name="perl-Attribute-Handlers" arch="noarch" epoch="0" version="1.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Attribute-Handlers-1.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">df82bff8696134f3dc521dd8b8443178771c46142a732b5626990b8c50b7f322</sum>
        </package>
        <package name="perl-AutoLoader" arch="noarch" epoch="0" version="5.74" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-AutoLoader-5.74-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2b4fca6da03e83a1f282dd4752b9f8f01c285fbabd0ff41d03ab8726d63cf223</sum>
        </package>
        <package name="perl-AutoSplit" arch="noarch" epoch="0" version="5.74" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-AutoSplit-5.74-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">47d60990ce13c089eea37d3a61fcd0f19f9cd592c76e7f37c61feabc2dc9b63e</sum>
        </package>
        <package name="perl-autouse" arch="noarch" epoch="0" version="1.11" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-autouse-1.11-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2aed9a5c5c3c64195602f3745dfae8ce3810635d8cffadc3c000cc890ddd103c</sum>
        </package>
        <package name="perl-B" arch="x86_64" epoch="0" version="1.89" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-B-1.89-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d7ce945009413f1423683bd51953c68814fd1bfd44e099420407281a71b1c7cd</sum>
        </package>
        <package name="perl-base" arch="noarch" epoch="0" version="2.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-base-2.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">64cb01cd07d0b974b1fe31dafc1ee5b2de90cd38f9e6a7885ec3903b83e8f0b4</sum>
        </package>
        <package name="perl-Benchmark" arch="noarch" epoch="0" version="1.25" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Benchmark-1.25-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">74ac8e111917550e3ae4bdc752e4021ce8d84ac96ea09db372c5902e59db11ae</sum>
        </package>
        <package name="perl-blib" arch="noarch" epoch="0" version="1.07" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-blib-1.07-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9105b51ea0d25e084761b4c0090ac6a7920e6ec963b8205050ef0bd5953b9adf</sum>
        </package>
        <package name="perl-Class-Struct" arch="noarch" epoch="0" version="0.68" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Class-Struct-0.68-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b0a5b9a9669ac59df8d16e5f193cc73e2cf6533f56f865fafc28ef0c9bcbe536</sum>
        </package>
        <package name="perl-Config-Extensions" arch="noarch" epoch="0" version="0.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Config-Extensions-0.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6f685d02211fce93b0617d99de4c02719ee94e418aaafa7e907a88e11fd861ec</sum>
        </package>
        <package name="perl-DBM_Filter" arch="noarch" epoch="0" version="0.06" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-DBM_Filter-0.06-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6f8f99b4dd16050e8554ca0dd65a11c063a26dfdffb224a626ccb3ae0633c5f8</sum>
        </package>
        <package name="perl-debugger" arch="noarch" epoch="0" version="1.60" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-debugger-1.60-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8fc7bfa0a4fe63fd2e0da152b148598355d27c933e2460d2e9cc79050b352a65</sum>
        </package>
        <package name="perl-deprecate" arch="noarch" epoch="0" version="0.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-deprecate-0.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9f0afea047f8b7135faf0867cddc951eb1866c137a2cdc16ed9d99c6498aba75</sum>
        </package>
        <package name="perl-devel" arch="x86_64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-devel-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">40a2bb840b71193175aac0ed8afa89591a5cc6eba95ce1409b65843599632207</sum>
        </package>
        <package name="perl-Devel-Peek" arch="x86_64" epoch="0" version="1.34" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Devel-Peek-1.34-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">981ab4855b79771240b99baf1c1e09020394177ac61cefb51229a45b871c8fdd</sum>
        </package>
        <package name="perl-Devel-SelfStubber" arch="noarch" epoch="0" version="1.06" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Devel-SelfStubber-1.06-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c5e20dc46a76c81d39581bec7dba3cd34e8bcbd55d0d1695738030c898c97bed</sum>
        </package>
        <package name="perl-diagnostics" arch="noarch" epoch="0" version="1.40" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-diagnostics-1.40-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9b993ecbf537f9b8cf7fcc2bba8e9237dcbe10fbd1e00fe8b8055b5e3d6a7a8f</sum>
        </package>
        <package name="perl-DirHandle" arch="noarch" epoch="0" version="1.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-DirHandle-1.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d64e1eccf3366c9be2a3998b26bdb732314caedfede71f45729f2b66e700a3aa</sum>
        </package>
        <package name="perl-doc" arch="noarch" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-doc-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ccbbf526615bcc2b8076d26e5b957bd587df1185b8a89f10050c80049edd50fc</sum>
        </package>
        <package name="perl-Dumpvalue" arch="noarch" epoch="0" version="2.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Dumpvalue-2.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">cae22391d31b927192b3be47b2727061f4455c0a2102000ae3ccdec554d5e0f6</sum>
        </package>
        <package name="perl-DynaLoader" arch="x86_64" epoch="0" version="1.56" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-DynaLoader-1.56-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e3d1b95e960eb91daf888d364117c261fa212d6a1c7467b99c10d882f8b5861a</sum>
        </package>
        <package name="perl-encoding-warnings" arch="noarch" epoch="0" version="0.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-encoding-warnings-0.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1fbd441fd14bde577f07caa18c9a65a54555bbc379fc93216692240e744d8d74</sum>
        </package>
        <package name="perl-English" arch="noarch" epoch="0" version="1.11" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-English-1.11-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b29f221e1a50532d874cd57b0640ccdab73bef336d474dc63b91370b064faa06</sum>
        </package>
        <package name="perl-Errno" arch="x86_64" epoch="0" version="1.38" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Errno-1.38-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d07b66dc675781913395f181004b92c5410bb757acddc907d718eadd8125832f</sum>
        </package>
        <package name="perl-ExtUtils-Constant" arch="noarch" epoch="0" version="0.25" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ExtUtils-Constant-0.25-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">673d5d8970de686dee8373ff9f98ac1c2402e68c83f39265122a76385961bc96</sum>
        </package>
        <package name="perl-ExtUtils-Embed" arch="noarch" epoch="0" version="1.35" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ExtUtils-Embed-1.35-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">fdb1db30f202624588f7cbf745a4a6c8fca01afdf97210a5770510e7b9c2ace5</sum>
        </package>
        <package name="perl-ExtUtils-Miniperl" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ExtUtils-Miniperl-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e72582fed4537442ae4e4a003b1dda5d9698598fb496633807bc081f0e9c15b9</sum>
        </package>
        <package name="perl-Fcntl" arch="x86_64" epoch="0" version="1.18" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Fcntl-1.18-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3bca9c5caef530dc901cb922df7b1b9df0bf8b01ad837417b2755c923a3186cb</sum>
        </package>
        <package name="perl-fields" arch="noarch" epoch="0" version="2.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-fields-2.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">76406839f2803d7b0cb0e251407e0b2a962badf80d05a23875258f25fce023b6</sum>
        </package>
        <package name="perl-File-Basename" arch="noarch" epoch="0" version="2.86" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Basename-2.86-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">18fe7a38257dc997a05f6c6c28982b7eeb3b2f3e5faf691fb96d0e937841428a</sum>
        </package>
        <package name="perl-FileCache" arch="noarch" epoch="0" version="1.10" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-FileCache-1.10-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2b487ea17c1aa09778b7dbbd7ac1b47dc6a93b26530fe20371b2bdb51258ad20</sum>
        </package>
        <package name="perl-File-Compare" arch="noarch" epoch="0" version="1.100.800" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Compare-1.100.800-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1881005b6b2bde554c16be1802d9bbcd5a909de38ee51ffec32a02583ddb0382</sum>
        </package>
        <package name="perl-File-Copy" arch="noarch" epoch="0" version="2.41" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Copy-2.41-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">fba17e4e04679f16bd6d6504978b8c6d087c92272c84dee25556d094a11c6d74</sum>
        </package>
        <package name="perl-File-DosGlob" arch="x86_64" epoch="0" version="1.12" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-DosGlob-1.12-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e67158989a020a01a02f76713b2de4af5602c6a5f0f00e5d1b4f400d8dfc3015</sum>
        </package>
        <package name="perl-File-Find" arch="noarch" epoch="0" version="1.44" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Find-1.44-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">4340329aebc6d4e2a20a4a0262490a02eab3c3f8c14cdbc56167041bfc406da6</sum>
        </package>
        <package name="perl-FileHandle" arch="noarch" epoch="0" version="2.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-FileHandle-2.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3e39fb116ad7d27753bedcef1a6e820f63a60b4c5063bc43fdb243b9650a993a</sum>
        </package>
        <package name="perl-File-stat" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-stat-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">69584b304b37a71085d1b1999832552e3dc1f121fa56d4f69a4e29a2e537fa65</sum>
        </package>
        <package name="perl-filetest" arch="noarch" epoch="0" version="1.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-filetest-1.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">40840e2b871078b6563e722341b7b125b6c9d53966929daeca5120eb6c5dd388</sum>
        </package>
        <package name="perl-FindBin" arch="noarch" epoch="0" version="1.54" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-FindBin-1.54-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9cad58324085e230d93182830c46360a175d1a0ffba308ceebc7b25f5a7a8038</sum>
        </package>
        <package name="perl-GDBM_File" arch="x86_64" epoch="1" version="1.24" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-GDBM_File-1.24-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1b7766f5326ea66720f16e17aa3637b8723b88213993ea30445b6f887f51614a</sum>
        </package>
        <package name="perl-Getopt-Std" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Getopt-Std-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">99dcfad5e06149134c3ec786f6740c6c72b20ab6edb1cdc03369e2d4b2eb7767</sum>
        </package>
        <package name="perl-Hash-Util" arch="x86_64" epoch="0" version="0.32" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Hash-Util-0.32-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">68bac4efc4c630bd9a9314b88518b44b1b09f0863cbc70f14453be380cb69085</sum>
        </package>
        <package name="perl-Hash-Util-FieldHash" arch="x86_64" epoch="0" version="1.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Hash-Util-FieldHash-1.27-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0e280af670366baac4b0dc2ddd745a8270d5ffbadbc919031e2f512fb88db7d5</sum>
        </package>
        <package name="perl-I18N-Collate" arch="noarch" epoch="0" version="1.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-I18N-Collate-1.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6d20a8498404c9197de54883101b165edfe2b93c5c62070b361e40ae8e3b7f30</sum>
        </package>
        <package name="perl-I18N-Langinfo" arch="x86_64" epoch="0" version="0.24" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-I18N-Langinfo-0.24-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2fc394642249abdecf6d7fd9cfef95afa28f48c55a920df9c39ccf8453aa73d7</sum>
        </package>
        <package name="perl-I18N-LangTags" arch="noarch" epoch="0" version="0.45" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-I18N-LangTags-0.45-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">7f3c00984f9daf4674a3946e5cd3e42d38241c28cd50a538ad65b933038acb3b</sum>
        </package>
        <package name="perl-if" arch="noarch" epoch="0" version="0.61.000" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-if-0.61.000-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">0e7302913d6133623cbe84b6f7cac2e372e6b05d5f79158b1856baf46a731c51</sum>
        </package>
        <package name="perl-interpreter" arch="x86_64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-interpreter-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8b422784838b09c8b7fdf74245dd28af4e1977ef5bc79a1684b8d930ae4dd645</sum>
        </package>
        <package name="perl-IO" arch="x86_64" epoch="0" version="1.55" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-IO-1.55-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e1855bc4c63117138c9babff75d7144eaad8e208c36b6f1d00dd410124f182eb</sum>
        </package>
        <package name="perl-IPC-Open3" arch="noarch" epoch="0" version="1.22" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-IPC-Open3-1.22-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b457c4435a6f06fbc648180db5a51c4438d66b150001498f77ea7c211b372769</sum>
        </package>
        <package name="perl-less" arch="noarch" epoch="0" version="0.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-less-0.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">670ebc3d46f7503f84b3d69f79b0cb7ff7958b8e7253c1b33c195be31fc9e680</sum>
        </package>
        <package name="perl-lib" arch="x86_64" epoch="0" version="0.65" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-lib-0.65-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d1dd10cd7302af86e9936fea486efa016e7cebfa81a6f1d7cda157cb86888938</sum>
        </package>
        <package name="perl-libnetcfg" arch="noarch" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-libnetcfg-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">41de6c67a452247623014006b4ddb34678ea17acceb43e9df3d2c76725d51ae2</sum>
        </package>
        <package name="perl-libs" arch="x86_64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-libs-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e661a2a8107bd9cf2698c50adfa0163a166e57cc3820531ed99946c791a7540b</sum>
        </package>
        <package name="perl-locale" arch="noarch" epoch="0" version="1.12" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-locale-1.12-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d20218fb1d4cfb6ba774c3c65ada3fc3ed221a352046a7888d828c9cc1f04b53</sum>
        </package>
        <package name="perl-Locale-Maketext-Simple" arch="noarch" epoch="1" version="0.21" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Locale-Maketext-Simple-0.21-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">0748651e441428a3fe630edd8e59c7c4bd1298c11f73609870dd47f6f1fdbdea</sum>
        </package>
        <package name="perl-macros" arch="noarch" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-macros-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">29508d63ad1c04709cc244b49fee772f1b739c98a5cf40ef77655047e9cb9ab4</sum>
        </package>
        <package name="perl-Math-Complex" arch="noarch" epoch="0" version="1.62" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Math-Complex-1.62-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c65895672c9bb24c35443a82c397d44f2f1eaba3153f78cac25c474240025754</sum>
        </package>
        <package name="perl-Memoize" arch="noarch" epoch="0" version="1.16" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Memoize-1.16-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d7bce1afae95fba04201089bb45eda58f4a6dffe75e15396ae01735f47020508</sum>
        </package>
        <package name="perl-meta-notation" arch="noarch" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-meta-notation-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ceb2b652e10eb44fa6b0ab9d404ea5d1a504148c788298974b7f0dda845c996b</sum>
        </package>
        <package name="perl-Module-Loaded" arch="noarch" epoch="1" version="0.08" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Module-Loaded-0.08-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c4802ec4db4c080bf27de5740f4460b02dac0afcf04c90e96895d73d81e70caa</sum>
        </package>
        <package name="perl-mro" arch="x86_64" epoch="0" version="1.29" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-mro-1.29-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3eac9e5583d2d83d280027dc43136fe0a8b104607e8758cff91ec393da0e4e1f</sum>
        </package>
        <package name="perl-NDBM_File" arch="x86_64" epoch="0" version="1.17" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-NDBM_File-1.17-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ea2d682eb97e5b124ca61c1b93e142d79dbb115c45fd22672fa25027501079aa</sum>
        </package>
        <package name="perl-Net" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Net-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3f05fb3a1ccdbf490a8da8d17a6b2f49eb891ce079d12d37896a678226717001</sum>
        </package>
        <package name="perl-NEXT" arch="noarch" epoch="0" version="0.69" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-NEXT-0.69-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9bc98bc8feb85d727a82b56b0005d351538fa826649abcdc0d7f94dda0a3f72a</sum>
        </package>
        <package name="perl-ODBM_File" arch="x86_64" epoch="0" version="1.18" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ODBM_File-1.18-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d64775f4e228d5e4a4a74a7c395e64d9a413e83f296c4e8ec4f7f0ce5f176449</sum>
        </package>
        <package name="perl-Opcode" arch="x86_64" epoch="0" version="1.65" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Opcode-1.65-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">66f32a70830cf973627ff5ab77425032e44736460175530425957c66f2d06fd6</sum>
        </package>
        <package name="perl-open" arch="noarch" epoch="0" version="1.13" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-open-1.13-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">5805aba0d8aac827b89fa9b1c6af7998c911c1189b0967b32307a0216270d0d5</sum>
        </package>
        <package name="perl-overload" arch="noarch" epoch="0" version="1.37" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-overload-1.37-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9c701c301917c4cd0a536917ee80b2fc29c532745afa6d840aac1e73ae420502</sum>
        </package>
        <package name="perl-overloading" arch="noarch" epoch="0" version="0.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-overloading-0.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1567b7808f7d0a3664abddb60175c5009f301886b2b15a1c81ead50987300c5b</sum>
        </package>
        <package name="perl-ph" arch="x86_64" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ph-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9f95abe13ef1f4cf36936ee77de025740289a025ad0ca91f166d42aedc584869</sum>
        </package>
        <package name="perl-Pod-Functions" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Pod-Functions-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">eeb09288b3ad9d99f248311e87142e9a46f7bc9989727a881b363ba4f6005c22</sum>
        </package>
        <package name="perl-Pod-Html" arch="noarch" epoch="0" version="1.35" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Pod-Html-1.35-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8221ab5df8c2b1ee30ecb1582bbdf7ec18586516e5c84ebf0cb4f6555da9a7c2</sum>
        </package>
        <package name="perl-POSIX" arch="x86_64" epoch="0" version="2.20" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-POSIX-2.20-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">47b661a5a42f9159ad9b8e5ab4f736c9449eab86f06ee996916767d6ea4ef83f</sum>
        </package>
        <package name="perl-Safe" arch="noarch" epoch="0" version="2.46" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Safe-2.46-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6144a8a3c79c9e5a80b8607af9c539b134abb4008bcfa2eb0880a18a8459441f</sum>
        </package>
        <package name="perl-Search-Dict" arch="noarch" epoch="0" version="1.07" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Search-Dict-1.07-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">51c258972fdd46bbd373502c17e6b48644f119ea220152a0d3a4b51c1700a0c5</sum>
        </package>
        <package name="perl-SelectSaver" arch="noarch" epoch="0" version="1.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-SelectSaver-1.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8431cdd6e9d962bbf1298e488b9e5af8bc7f184ecb81ddadb8fadf58ca223e88</sum>
        </package>
        <package name="perl-SelfLoader" arch="noarch" epoch="0" version="1.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-SelfLoader-1.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">28d0a2be3dc6a6d05b9e81f46a68fee3d91b26b4461388400dce5b0f27966800</sum>
        </package>
        <package name="perl-sigtrap" arch="noarch" epoch="0" version="1.10" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-sigtrap-1.10-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d02f886ef561027bc19c4418b8de4b5bc7537fe3d35a17db4c2be08d5db132f6</sum>
        </package>
        <package name="perl-sort" arch="noarch" epoch="0" version="2.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-sort-2.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f1430143b9693f9bc1e12d1a9df1544d48cd424fc43c3ba61502be710bc60740</sum>
        </package>
        <package name="perl-subs" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-subs-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8918c1a21617b7914d8634e7eac6abde85e395b50e6a6e321b93a3968e7f3da4</sum>
        </package>
        <package name="perl-Symbol" arch="noarch" epoch="0" version="1.09" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Symbol-1.09-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">17ead97396a311f64f762f306ccf538c25d49404c16e5012fcfff7795db9a969</sum>
        </package>
        <package name="perl-Sys-Hostname" arch="x86_64" epoch="0" version="1.25" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Sys-Hostname-1.25-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">49b9ac284a4348889a6b0477402b103528ad8667b27068ddbc4217e4fa013f50</sum>
        </package>
        <package name="perl-Term-Complete" arch="noarch" epoch="0" version="1.403" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Term-Complete-1.403-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">66b362c03c004559eb0df57b25449a54fee5c3c473bf9ad824a949a0b9b7de9a</sum>
        </package>
        <package name="perl-Term-ReadLine" arch="noarch" epoch="0" version="1.17" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Term-ReadLine-1.17-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9634510df64298d518d9da81f0498e3c32b5770f5b09ca13b173d29b223c7621</sum>
        </package>
        <package name="perl-Test" arch="noarch" epoch="0" version="1.31" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Test-1.31-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">526ad97e3b7dcd8863fc3e778974b1472368f7d1a8f17b80a05788fa8a6fdd98</sum>
        </package>
        <package name="perl-Text-Abbrev" arch="noarch" epoch="0" version="1.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Text-Abbrev-1.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">4281e15c48c90708addcc97d41dd25ed9b69c773df3edfc024191d6446d1a506</sum>
        </package>
        <package name="perl-Thread" arch="noarch" epoch="0" version="3.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Thread-3.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">cc65ce65130f119bce6de89dccb7175ccb960bd6bbbbb2adfc271c4f74ea68cd</sum>
        </package>
        <package name="perl-Thread-Semaphore" arch="noarch" epoch="0" version="2.13" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Thread-Semaphore-2.13-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">86a92e6eb3c9000fb6ea1184ee93b94e0fb0a3ebb51fc4a69672ddf1dbb39749</sum>
        </package>
        <package name="perl-Tie" arch="noarch" epoch="0" version="4.6" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Tie-4.6-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c504397313693520cb3b5ac42a41f4e460526b0a166eba98ebfe0267c58f9aff</sum>
        </package>
        <package name="perl-Tie-File" arch="noarch" epoch="0" version="1.09" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Tie-File-1.09-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">81d7b7e5cbc4c391f219ebb42adc67dabfe157c3f33b1d3f1ad9e54aa2b884d4</sum>
        </package>
        <package name="perl-Tie-Memoize" arch="noarch" epoch="0" version="1.1" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Tie-Memoize-1.1-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">21cc178b7ea848ba45ef3ffa2fe36ed8904fcae31f89b18a48d6cc535ac83a09</sum>
        </package>
        <package name="perl-Time" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Time-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1086aba3487a8b2a57d839272fb1e3cf43753f814604070a7469ef0e965d27ed</sum>
        </package>
        <package name="perl-Time-Piece" arch="x86_64" epoch="0" version="1.3401" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Time-Piece-1.3401-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">16d923b15f2098b493159dd7a66f279d59486e7ddd4971c0d29a2e0f9b0dc400</sum>
        </package>
        <package name="perl-Unicode-UCD" arch="noarch" epoch="0" version="0.78" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Unicode-UCD-0.78-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e946bb7b7bea19f5129b8a8f51f60b33fb9ef11f48252c61ba0821caa8348088</sum>
        </package>
        <package name="perl-User-pwent" arch="noarch" epoch="0" version="1.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-User-pwent-1.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2e134003c8129f2b32aa4fe533959d092ec05a46c8dcca4388ba21cc680aef6e</sum>
        </package>
        <package name="perl-utils" arch="noarch" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-utils-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b57e93b65d5b1b9382282af8ae96173bc97169fa2afabb3eb3890745f973e30a</sum>
        </package>
        <package name="perl-vars" arch="noarch" epoch="0" version="1.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-vars-1.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">5a825accc7d995c71c719ec15ab84221c533a3abe6be6b061381d7606a4854b6</sum>
        </package>
        <package name="perl-vmsish" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-vmsish-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1105ceabfffbdb6623a09ef153437cf83399cf3c9e90886af08debdef5ea9efb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7494</id>
    <title>Moderate: tomcat9 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7494 (https://access.redhat.com/errata/RHSA-2025:7494), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24813" id="CVE-2025-24813" type="cve" title="CVE-2025-24813" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2351129" id="2351129" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7494" id="RLSA-2025:7494" type="self" title="RLSA-2025:7494" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7494" id="RHSA-2025:7494" type="vendor" title="Red Hat RHSA-2025:7494" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">b437e4fc937d6b74f899196746d369a6a92329101a31896fa56218c02f46d8f2</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">9d89438b2d7d2e13b6ca687b167d642ffaeaa56759ff8ae29ed4b0c6f999c116</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">da4573e35e6a878c5d8b183fca36afb47d21bd6ddf6986b5036c8fda3a50c899</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">633995220500848334199accb63d5fb50138965dc0ea0be7ba15ff6781f0bfcf</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">6998f6dff03a9fe84d0f74fe7d58d24d7e852dc4120eece360bfad99e4fd026b</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-lib-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">b4ad34cca71a8de6a211fca37ab3c96e9b9c7ea305fed7b854295b1b4b834f5c</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">18e71ac028c3f2d5029044ab9c6f2b8b1f9e7807d493ae50a4cc5ca943de0197</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-webapps-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">249400041e694a3f0a2163c207d03ea61a785931ebc8a089e7b48bfaf645da9e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7497</id>
    <title>Moderate: tomcat security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7497 (https://access.redhat.com/errata/RHSA-2025:7497), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)

* tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)

* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52316" id="CVE-2024-52316" type="cve" title="CVE-2024-52316" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54677" id="CVE-2024-54677" type="cve" title="CVE-2024-54677" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24813" id="CVE-2025-24813" type="cve" title="CVE-2025-24813" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2326972" id="2326972" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2332815" id="2332815" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2351129" id="2351129" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7497" id="RLSA-2025:7497" type="self" title="RLSA-2025:7497" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7497" id="RHSA-2025:7497" type="vendor" title="Red Hat RHSA-2025:7497" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">4cf0f9042968d70ef2898c37fac49a01de1b1cfa3c328bb07b209e3d8dbff610</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-admin-webapps-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9d6f90224fc1711fe2b7abdd716b0731eeffed54dd5cc1aa367e2b363761005f</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-docs-webapp-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6d0065b1bf9c100520228fb27d19e05a21a94c08f7afb93cccc1b8c481217c8a</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3976c9f95398f8f87e813ac6f2c3a79195a292f9e82730aa3c2eaaf89eb584c5</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e1d02f3b4da77ba27efd41c2081f47ff826e02cdb6f7178d694c7f0d690a79ff</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-lib-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ea3e898fec9e468462d24e57789c94a1715e2bee582c87c2323232f238570be5</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ef37f975774200329ec5683bb10febc6cd7f6be8d8713a6834f245f604f6cf1e</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-webapps-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">5001b035bd821674c28eca7704f915abfad1d76546fce19420e00a3452040571</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7490</id>
    <title>Important: mod_auth_openidc security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7490 (https://access.redhat.com/errata/RHSA-2025:7490), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mod_auth_openidc.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. 

Security Fix(es):

* mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31492" id="CVE-2025-31492" type="cve" title="CVE-2025-31492" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357738" id="2357738" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7490" id="RLSA-2025:7490" type="self" title="RLSA-2025:7490" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7490" id="RHSA-2025:7490" type="vendor" title="Red Hat RHSA-2025:7490" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_auth_openidc" arch="x86_64" epoch="0" version="2.4.15" release="4.el10_0.1" src="mod_auth_openidc-2.4.15-4.el10_0.1.src.rpm">
          <filename>mod_auth_openidc-2.4.15-4.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">200ee122f0118eb9f7c1c3bea634efabf91983e047d60e13a03da69d44960702</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7458</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7458 (https://access.redhat.com/errata/RHSA-2025:7458), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)

* X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)

* xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)

* xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)

* xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)

* xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)

* xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)

* xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)

* Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9632" id="CVE-2024-9632" type="cve" title="CVE-2024-9632" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26594" id="CVE-2025-26594" type="cve" title="CVE-2025-26594" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26595" id="CVE-2025-26595" type="cve" title="CVE-2025-26595" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26596" id="CVE-2025-26596" type="cve" title="CVE-2025-26596" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26597" id="CVE-2025-26597" type="cve" title="CVE-2025-26597" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26598" id="CVE-2025-26598" type="cve" title="CVE-2025-26598" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26599" id="CVE-2025-26599" type="cve" title="CVE-2025-26599" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26600" id="CVE-2025-26600" type="cve" title="CVE-2025-26600" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26601" id="CVE-2025-26601" type="cve" title="CVE-2025-26601" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2317233" id="2317233" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345248" id="2345248" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345251" id="2345251" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345252" id="2345252" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345253" id="2345253" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345254" id="2345254" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345255" id="2345255" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345256" id="2345256" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345257" id="2345257" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7458" id="RLSA-2025:7458" type="self" title="RLSA-2025:7458" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7458" id="RHSA-2025:7458" type="vendor" title="Red Hat RHSA-2025:7458" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="x86_64" epoch="0" version="24.1.5" release="3.el10_0" src="xorg-x11-server-Xwayland-24.1.5-3.el10_0.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">33bc714d090fe12fddc4f7a93cca1497332d91736d55ed279e0a275819191b22</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7462</id>
    <title>Important: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7462 (https://access.redhat.com/errata/RHSA-2025:7462), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22869" id="CVE-2025-22869" type="cve" title="CVE-2025-22869" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2348367" id="2348367" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7462" id="RLSA-2025:7462" type="self" title="RLSA-2025:7462" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7462" id="RHSA-2025:7462" type="vendor" title="Red Hat RHSA-2025:7462" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="6" version="5.4.0" release="9.el10_0" src="podman-5.4.0-9.el10_0.src.rpm">
          <filename>podman-5.4.0-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a60ad650635c9cedd8468de0c971c474907afa160071ee37315bf5f3d0aab5d2</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="9.el10_0" src="podman-5.4.0-9.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-9.el10_0.noarch.rpm</filename>
          <sum type="sha256">7ae66cfa21aa2ec6ca3c8a9071719dbd74044bbae59aa125845f0deb025a6329</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="6" version="5.4.0" release="9.el10_0" src="podman-5.4.0-9.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">cf075af04f31aec31f85746393fc679a5d5dbac880a5adde66b0d689f75d2851</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7482</id>
    <title>Moderate: git security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7482 (https://access.redhat.com/errata/RHSA-2025:7482), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for git.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

* git: The sideband payload is passed unfiltered to the terminal in git (CVE-2024-52005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52005" id="CVE-2024-52005" type="cve" title="CVE-2024-52005" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2338289" id="2338289" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7482" id="RLSA-2025:7482" type="self" title="RLSA-2025:7482" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7482" id="RHSA-2025:7482" type="vendor" title="Red Hat RHSA-2025:7482" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git" arch="x86_64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-2.47.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8341a005b5afbd3da5cf2085ac0495c40c375ece5c27c9414ab20a5c027040d1</sum>
        </package>
        <package name="git-all" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-all-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bdac5c5ba4bfafed747139711d4f1914945210296dc86facf5432c7f99084f22</sum>
        </package>
        <package name="git-core" arch="x86_64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-core-2.47.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a8cdd559dffec0d1057ece75c9faf968b98286785da2d62aa1cddb6ec2b4b0c6</sum>
        </package>
        <package name="git-core-doc" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-core-doc-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">dff88d5bf97778c8ffa84c94fba0c513a974d8a22377dacb9d0d3d144e8ac113</sum>
        </package>
        <package name="git-credential-libsecret" arch="x86_64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-credential-libsecret-2.47.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">63ff1cc5ca367d61093adf5b77d4b97a9bd562672f043b7dd5b05c73543bd79a</sum>
        </package>
        <package name="git-daemon" arch="x86_64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-daemon-2.47.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">91769656949b236f1b97ad5c846a34d7fca4aea23ef0eb69e8f6763933136040</sum>
        </package>
        <package name="git-email" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-email-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">302cbdefd3aeef9e3cb6a60171ca3ff7359992cb4a9152b7108d104ea115f6d9</sum>
        </package>
        <package name="git-gui" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-gui-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d7de5ac4a009799fac2ddf54a02931c705ee1a98dfbb9c68d7896e07dd1d639a</sum>
        </package>
        <package name="git-instaweb" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-instaweb-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a7b51b56a736417cf73bce8edb49e630148261994fafcf7452aadc661590c3f7</sum>
        </package>
        <package name="gitk" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>gitk-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b3aee409817b28b7d56de0fb83098e1cc9beb2e16a62e94090dd8cfdebab8fcc</sum>
        </package>
        <package name="git-subtree" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-subtree-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">46242bbebcd1ad2839abfd60513fb03fd03784110b4f23a33292b9b36b2767e2</sum>
        </package>
        <package name="git-svn" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-svn-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3bcd83dd028d37947088d1f3cd86a662a008b0ca693c9e3540f7e9b50b858c28</sum>
        </package>
        <package name="gitweb" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>gitweb-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">0decb63454ebe01d56cde889e20f36c21e1a53be754ff0371ace2d49352d47cd</sum>
        </package>
        <package name="perl-Git" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>perl-Git-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a71275b85f0a971d28ad5a09f367052c44662020585c0053e7ae7dda0527c0db</sum>
        </package>
        <package name="perl-Git-SVN" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>perl-Git-SVN-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">43f3df75d8bf0c722c592f13c33b87d3e1cb0939f38aa0849043d9b7a60c20b0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7478</id>
    <title>Moderate: corosync security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7478 (https://access.redhat.com/errata/RHSA-2025:7478), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for corosync.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.

Security Fix(es):

* corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30472" id="CVE-2025-30472" type="cve" title="CVE-2025-30472" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2354229" id="2354229" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7478" id="RLSA-2025:7478" type="self" title="RLSA-2025:7478" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7478" id="RHSA-2025:7478" type="vendor" title="Red Hat RHSA-2025:7478" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="corosynclib" arch="x86_64" epoch="0" version="3.1.9" release="1.el10_0.1" src="corosync-3.1.9-1.el10_0.1.src.rpm">
          <filename>corosynclib-3.1.9-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">ab55164562ae56b3a6ef10fa4c21ef2fab92e30d2c4e4a1e704c3c76dc7e1345</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7489</id>
    <title>Important: php security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7489 (https://access.redhat.com/errata/RHSA-2025:7489), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

* php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

* php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

* php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

* php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

* php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11235" id="CVE-2024-11235" type="cve" title="CVE-2024-11235" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1217" id="CVE-2025-1217" type="cve" title="CVE-2025-1217" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1219" id="CVE-2025-1219" type="cve" title="CVE-2025-1219" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1734" id="CVE-2025-1734" type="cve" title="CVE-2025-1734" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1736" id="CVE-2025-1736" type="cve" title="CVE-2025-1736" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1861" id="CVE-2025-1861" type="cve" title="CVE-2025-1861" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2355917" id="2355917" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356041" id="2356041" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356042" id="2356042" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356043" id="2356043" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356046" id="2356046" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357531" id="2357531" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7489" id="RLSA-2025:7489" type="self" title="RLSA-2025:7489" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7489" id="RHSA-2025:7489" type="vendor" title="Red Hat RHSA-2025:7489" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="php" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f8e369c37b1c94d4852411a992e20e579d7cc08e8d313db5fad599f6178bc0b3</sum>
        </package>
        <package name="php-bcmath" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-bcmath-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8ffc76244a39ad99ca2ea05d4bdc447e89061f2b35537d7f5eff23a0e487b123</sum>
        </package>
        <package name="php-cli" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-cli-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8f312184ffd2d6b1576b2affced456276dd2d8d1b76686a8f3c66cd782e6f51b</sum>
        </package>
        <package name="php-common" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-common-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">79cc5ed19a42a4971bdb63b126567d4eb69bb0dfea86f78073e229654351748b</sum>
        </package>
        <package name="php-dba" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-dba-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dc30e19bca69bd947d8fabadf606b1baa1904b08f38d54421f7cc2c94127be1a</sum>
        </package>
        <package name="php-dbg" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-dbg-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">559b9e61692aa55585f3076475379fa1f2b55a439b82d3a617527c2eea4582da</sum>
        </package>
        <package name="php-devel" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-devel-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a196b86f49e94e7f46a0dcf3424e3a09de782ae186650a9482c09e9cf8d3ec72</sum>
        </package>
        <package name="php-embedded" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-embedded-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c7e88f82cead8bd8ff92720d2658449fed821500fa1fbab37ec57e476920a215</sum>
        </package>
        <package name="php-enchant" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-enchant-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">76f78ccd85de0704cbbb6d730e0f3657504734f216df2f7a06ffdd998f31b3c7</sum>
        </package>
        <package name="php-ffi" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-ffi-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">85ad92a3fab46500bf8fd98dd997a7863bffeb9074fc9c4ef8ff8433691a35c0</sum>
        </package>
        <package name="php-fpm" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-fpm-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6b4e908b9a44007a0e55437326eb007ba5034cd0ec3f892d0aa601e248b3bbbb</sum>
        </package>
        <package name="php-gd" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-gd-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">332c477127b88ec94da412f50c03fadd0af3d715614adcf26ac8745fbf241c25</sum>
        </package>
        <package name="php-gmp" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-gmp-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5ea2b7b1c7116e2786b4c9a11755dd4b7be61bb0c9da65988271eec7a212d0af</sum>
        </package>
        <package name="php-intl" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-intl-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">82403da93300e71a3f542a14d410e9108a2ec8920b403565cf2e7339222c139c</sum>
        </package>
        <package name="php-ldap" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-ldap-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8c40ab1878378d643b2283b00e89d45e5d3d3af0d5b8013f7f06ad7a8d303e24</sum>
        </package>
        <package name="php-mbstring" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-mbstring-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7e8df612af62c3fa51fc67f3dc898b69196598196e8f01d4b0dcdf0dd137918a</sum>
        </package>
        <package name="php-mysqlnd" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-mysqlnd-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6e686debf68f89b6a9d3a4037adcdab5c9c341271ce9b590064bcacc1c27eb3f</sum>
        </package>
        <package name="php-odbc" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-odbc-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4b3ca8a4f7f26ca1bd402dc622c3d8a69938bb6b08fc95a7d2fda6e7073a7727</sum>
        </package>
        <package name="php-opcache" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-opcache-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dc8dc81f917a68bf69bdd02dd132185a44099e1aaca8fe692f72f3fa1997162b</sum>
        </package>
        <package name="php-pdo" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-pdo-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2b0a25bc1b8fac2e6318221d8e51bbff165c3a60eedaf7b9c55a6f53a547a992</sum>
        </package>
        <package name="php-pgsql" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-pgsql-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e7dcbef58d5ff4e4dc7befaf2c161eef18366a22573fc7a3baf3b4f49e0c7b40</sum>
        </package>
        <package name="php-process" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-process-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5fa288c16df4c15b4d67f304c5bd54388b567b0b2a595ef2b5e987b69c1ba6cd</sum>
        </package>
        <package name="php-snmp" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-snmp-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6684d678ac5a11d08d4cfbafac71655c778e60603546e6ae86454699cb6e62ee</sum>
        </package>
        <package name="php-soap" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-soap-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1a5877ebc41576509a1b0d47d874c02b7120e12f58c7e65d4316fdb88b06af44</sum>
        </package>
        <package name="php-xml" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-xml-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1c715bb6977badb91349ee50c7a78b23b76d0284205f1693dc50e6131eb6bbd1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7479</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7479 (https://access.redhat.com/errata/RHSA-2025:7479), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

* golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868)

* github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input (CVE-2025-29786)

* golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22868" id="CVE-2025-22868" type="cve" title="CVE-2025-22868" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29786" id="CVE-2025-29786" type="cve" title="CVE-2025-29786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30204" id="CVE-2025-30204" type="cve" title="CVE-2025-30204" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2348366" id="2348366" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2352914" id="2352914" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2354195" id="2354195" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7479" id="RLSA-2025:7479" type="self" title="RLSA-2025:7479" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7479" id="RHSA-2025:7479" type="vendor" title="Red Hat RHSA-2025:7479" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.107.0" release="9.el10_0" src="opentelemetry-collector-0.107.0-9.el10_0.src.rpm">
          <filename>opentelemetry-collector-0.107.0-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6a85dd7963eb1b9b0e6a76c5fab1ec5aeedad8c476e4001d728924c40e2863c8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7509</id>
    <title>Important: valkey security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7509 (https://access.redhat.com/errata/RHSA-2025:7509), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVE-2025-21605)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21605" id="CVE-2025-21605" type="cve" title="CVE-2025-21605" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2361883" id="2361883" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7509" id="RLSA-2025:7509" type="self" title="RLSA-2025:7509" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7509" id="RHSA-2025:7509" type="vendor" title="Red Hat RHSA-2025:7509" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.3" release="1.el10_0" src="valkey-8.0.3-1.el10_0.src.rpm">
          <filename>valkey-8.0.3-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b9baa033f01c694f8b123802069c7b1ebbdd101c1c477e316687c674aa40abc0</sum>
        </package>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.3" release="1.el10_0" src="valkey-8.0.3-1.el10_0.src.rpm">
          <filename>valkey-devel-8.0.3-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">30d4068383ee9e088c80496a42c74d0b6cb66907ae468412d5e495085f92c2ca</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7467</id>
    <title>Moderate: skopeo security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7467 (https://access.redhat.com/errata/RHSA-2025:7467), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7467" id="RLSA-2025:7467" type="self" title="RLSA-2025:7467" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7467" id="RHSA-2025:7467" type="vendor" title="Red Hat RHSA-2025:7467" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.18.1" release="1.el10_0" src="skopeo-1.18.1-1.el10_0.src.rpm">
          <filename>skopeo-1.18.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">51cbb69f69f7b361ead598157c4202f8c28ec55191b2bb82394518bdcab0a963</sum>
        </package>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.18.1" release="1.el10_0" src="skopeo-1.18.1-1.el10_0.src.rpm">
          <filename>skopeo-tests-1.18.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f602b7c4fa46a57f34a64d291f49d6a2f4dd3acea602199b3812c5384213286e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7459</id>
    <title>Moderate: buildah security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7459 (https://access.redhat.com/errata/RHSA-2025:7459), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7459" id="RLSA-2025:7459" type="self" title="RLSA-2025:7459" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7459" id="RHSA-2025:7459" type="vendor" title="Red Hat RHSA-2025:7459" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah" arch="x86_64" epoch="2" version="1.39.4" release="1.el10_0" src="buildah-1.39.4-1.el10_0.src.rpm">
          <filename>buildah-1.39.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">424860a41a3c6be30509aafd6dad1d6233609a859c207ed598a46811849a26d1</sum>
        </package>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.39.4" release="1.el10_0" src="buildah-1.39.4-1.el10_0.src.rpm">
          <filename>buildah-tests-1.39.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">04de794150732cf258bbc0fa53691ab7c901ddc05fa33e0f2e8dbfc4de4a3fbc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7457</id>
    <title>Moderate: exiv2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7457 (https://access.redhat.com/errata/RHSA-2025:7457), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for exiv2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats.

Security Fix(es):

* exiv2: Use After Free in Exiv2 (CVE-2025-26623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26623" id="CVE-2025-26623" type="cve" title="CVE-2025-26623" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2346345" id="2346345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7457" id="RLSA-2025:7457" type="self" title="RLSA-2025:7457" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7457" id="RHSA-2025:7457" type="vendor" title="Red Hat RHSA-2025:7457" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="exiv2" arch="x86_64" epoch="0" version="0.28.3" release="3.el10_0.2" src="exiv2-0.28.3-3.el10_0.2.src.rpm">
          <filename>exiv2-0.28.3-3.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">6c494c65bdd05728ba7601311720dee26fc03e84ee413c96543e1d46461c3b0e</sum>
        </package>
        <package name="exiv2-libs" arch="x86_64" epoch="0" version="0.28.3" release="3.el10_0.2" src="exiv2-0.28.3-3.el10_0.2.src.rpm">
          <filename>exiv2-libs-0.28.3-3.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">f3e64409cde39e2b739b5d23066d3dce6a76a7353dad1e1ce14705fbd9aa58a7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7592</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7592 (https://access.redhat.com/errata/RHSA-2025:7592), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336" id="CVE-2024-45336" type="cve" title="CVE-2024-45336" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3931" id="CVE-2025-3931" type="cve" title="CVE-2025-3931" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2341751" id="2341751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362345" id="2362345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7592" id="RLSA-2025:7592" type="self" title="RLSA-2025:7592" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7592" id="RHSA-2025:7592" type="vendor" title="Red Hat RHSA-2025:7592" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.5" release="3.el10_0" src="yggdrasil-0.4.5-3.el10_0.src.rpm">
          <filename>yggdrasil-0.4.5-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a2e40405821fcfb9e4fca51f0937adbff423bf3f683318f3a05d058d737b674b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7593</id>
    <title>Moderate: ghostscript security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7593 (https://access.redhat.com/errata/RHSA-2025:7593), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for ghostscript.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

* Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27832" id="CVE-2025-27832" type="cve" title="CVE-2025-27832" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2354949" id="2354949" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7593" id="RLSA-2025:7593" type="self" title="RLSA-2025:7593" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7593" id="RHSA-2025:7593" type="vendor" title="Red Hat RHSA-2025:7593" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ghostscript" arch="x86_64" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-10.02.1-16.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8f6a4f89f0bca9dc3bfcb6e1a38e955b5979ac45660fff9fae3bf53c56ee994f</sum>
        </package>
        <package name="ghostscript-doc" arch="noarch" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-doc-10.02.1-16.el10_0.noarch.rpm</filename>
          <sum type="sha256">f4914cfd80f9e897646ac8e36f35e168dff0f5d687bedd1ecc1e5136f57ddfa7</sum>
        </package>
        <package name="ghostscript-tools-fonts" arch="noarch" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-tools-fonts-10.02.1-16.el10_0.noarch.rpm</filename>
          <sum type="sha256">c86349f057a12bd7dcb6abc7f6f0724a83df500266b99fe894462a62ef242058</sum>
        </package>
        <package name="ghostscript-tools-printing" arch="noarch" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-tools-printing-10.02.1-16.el10_0.noarch.rpm</filename>
          <sum type="sha256">f20d5ba7b32a253d2c2a24a263142c8d24062116a76f8bb2d82a0ece4b9875ea</sum>
        </package>
        <package name="libgs" arch="x86_64" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>libgs-10.02.1-16.el10_0.x86_64.rpm</filename>
          <sum type="sha256">14e42def6c713f54bd548ca9760c2dd068f4255da1f09c4963b61850d11044e4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7599</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7599 (https://access.redhat.com/errata/RHSA-2025:7599), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es):

* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26646" id="CVE-2025-26646" type="cve" title="CVE-2025-26646" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2365317" id="2365317" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7599" id="RLSA-2025:7599" type="self" title="RLSA-2025:7599" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7599" id="RHSA-2025:7599" type="vendor" title="Red Hat RHSA-2025:7599" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">388c835ccd252cc0087f329e3151759bd62255988ffeeba1f43c75f29819fec4</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5eed04e6362f189503c6d2389f673ffdb96d4c7f7bf7f00161ba7915e2b72b70</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">95f95ee75f965d636a6bcd3843b60618a35aa93e18fefc53dbfb0d8e3f896675</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">485cca658dc494f97b61b371d618482fd20120138259d2b9a35b44fc5507a1cf</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">cdfecdda4a6ae5f6cf1c0b94426c51d332be54ec9e09e0907563b5bd7a5dcc6a</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">709e2143ec66a3efe307657b235a7770fefd0174084f8ddee3ce7ffce64aa3cd</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8b8e566060a08ea726e0e6e26d14cbabda5d970335db923db0042a056b96168b</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.116" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.116-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">52d6f8d1d0e667f5b4cae116f534c4da070b1cef024674428d2bf2eb095cd2ca</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.116" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.116-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8fd865e497f7b279ed97d0b4fb3b5df2f71b8d573ffa739e4f7905dfd3810672</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bcb942acc76d01a5094f992427abdbc25fce49a41d33dac94cbde6e560c7fdf9</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.116" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-templates-8.0-8.0.116-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">31962c23f79bae59a15fb08e8c48e7fe5e8976d340fe0a34e75a831120eeb198</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7601</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7601 (https://access.redhat.com/errata/RHSA-2025:7601), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es):

* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26646" id="CVE-2025-26646" type="cve" title="CVE-2025-26646" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2365317" id="2365317" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7601" id="RLSA-2025:7601" type="self" title="RLSA-2025:7601" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7601" id="RHSA-2025:7601" type="vendor" title="Red Hat RHSA-2025:7601" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">29e72f17a57d888b5a3ed9b594059afd32e1664c47ad167958b402c68e83ad5c</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e791e64d8375f5caa1e970fc51510285f30b56ee1bfeeb3b748e716a19b7c5a7</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3c1bb33824d0a4f7bdd4c611df65e5416a9de602e3909fd56ee5915cfca7f471</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8ebf077e29a7810ed204ede184bd8d862b4c45ea109004045478f2438df2e8c7</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-host-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">186319456ef83970cf81b2a846bb31d4fa84dacd27f26eb9aeacae488a3acca4</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8c4f3478f89f3ab7520d6b41d9f9de9c33aebd63f54e30e244de0bb5233acaa4</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f308f45b2324473c7f48781adf497d2b527d7e9a1975a1d25fd45497eaba55dd</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8cc16b3c42814ec7047f3896d8461dd89e708a49fcda3a5d95316eb620a5891a</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3b314a3c7894c06988dcece55d973cfd42f98bc1c286d32e14bcd6e26b0e17de</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">abdbd5c282409b15febaddba8220c4bb257dcb03c0a454705b6eca8b539c9c22</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9585d8759ea3275360a5e6315de6f97924542229f84fcda1ecae89d9db313c88</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">43a3b483221a2b52f88b9517d832dba94d8c619987aa57bdb47fc040b9774878</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-templates-9.0-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">41f83dc2d6220e62cc12b9ca062254dc5056fd36031eb29e6d465c44c4879c9f</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">271def804dc9ac7627dbf2e55833511db5597d42a9390d22d2d634d1983a77a8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7892</id>
    <title>Important: grafana security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:7892 (https://access.redhat.com/errata/RHSA-2025:7892), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4123" id="CVE-2025-4123" type="cve" title="CVE-2025-4123" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2364632" id="2364632" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7892" id="RLSA-2025:7892" type="self" title="RLSA-2025:7892" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:7892" id="RHSA-2025:7892" type="vendor" title="Red Hat RHSA-2025:7892" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="17.el10_0" src="grafana-10.2.6-17.el10_0.src.rpm">
          <filename>grafana-10.2.6-17.el10_0.x86_64.rpm</filename>
          <sum type="sha256">98f2710f0993ab1b4309dee440cca877018da3f8d780f2be74dc0296e7ac5899</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="17.el10_0" src="grafana-10.2.6-17.el10_0.src.rpm">
          <filename>grafana-selinux-10.2.6-17.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f6badba70fc34869aa6b6b792b77d264eca32195efefac9fe87bdb7e9dbc2eaa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8047</id>
    <title>Moderate: unbound security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8047 (https://access.redhat.com/errata/RHSA-2025:8047), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8508" id="CVE-2024-8508" type="cve" title="CVE-2024-8508" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2316321" id="2316321" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8047" id="RLSA-2025:8047" type="self" title="RLSA-2025:8047" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8047" id="RHSA-2025:8047" type="vendor" title="Red Hat RHSA-2025:8047" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-unbound" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>python3-unbound-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">189faad55c71c1103536f0328d17ce4b1f0b23f2e8979dad6a83f427d40b4424</sum>
        </package>
        <package name="unbound" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dd86a42294f9867ee0518a95e4e63134f958701204de2541d6ef388784c85224</sum>
        </package>
        <package name="unbound-anchor" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-anchor-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0028c3dbb07a1f7d3dd7f4004fbe2ce6ee3835fb242905e5ab4690f198553bc1</sum>
        </package>
        <package name="unbound-dracut" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-dracut-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3951aa3e66adca42cd1633fb3e4a91d62ffc50b223decd90a222d5a3ac12ff7c</sum>
        </package>
        <package name="unbound-libs" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-libs-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6ea2493c22b4b81d59b954ed77ebe1f83680298a5a803106bbf5dad90ddc09a4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8125</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8125 (https://access.redhat.com/errata/RHSA-2025:8125), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)

* firefox: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4918" id="CVE-2025-4918" type="cve" title="CVE-2025-4918" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4919" id="CVE-2025-4919" type="cve" title="CVE-2025-4919" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367016" id="2367016" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367018" id="2367018" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8125" id="RLSA-2025:8125" type="self" title="RLSA-2025:8125" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8125" id="RHSA-2025:8125" type="vendor" title="Red Hat RHSA-2025:8125" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.10.1" release="1.el10_0" src="firefox-128.10.1-1.el10_0.src.rpm">
          <filename>firefox-128.10.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b329dbb46adde07165c8d5ffcd03f060f4b87652bd06a0f9eac07b005ad69ce8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8128</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8128 (https://access.redhat.com/errata/RHSA-2025:8128), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

* libsoup: Denial of service in server when client requests a large amount of  overlapping ranges with Range header (CVE-2025-32907)

* libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)

* libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32049" id="CVE-2025-32049" type="cve" title="CVE-2025-32049" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32907" id="CVE-2025-32907" type="cve" title="CVE-2025-32907" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4035" id="CVE-2025-4035" type="cve" title="CVE-2025-4035" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4948" id="CVE-2025-4948" type="cve" title="CVE-2025-4948" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357066" id="2357066" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359342" id="2359342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362651" id="2362651" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367183" id="2367183" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8128" id="RLSA-2025:8128" type="self" title="RLSA-2025:8128" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8128" id="RHSA-2025:8128" type="vendor" title="Red Hat RHSA-2025:8128" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.6" src="libsoup3-3.6.5-3.el10_0.6.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_0.6.x86_64.rpm</filename>
          <sum type="sha256">f29e0a4b17589325465b8ef7a415ea18a97c013435838f7a6711335c9661abf5</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.6" src="libsoup3-3.6.5-3.el10_0.6.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_0.6.x86_64.rpm</filename>
          <sum type="sha256">7a1e6c299bc4add67e0c398b48cfb486c204f68abbdc4b56f14245d63c6692ef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8131</id>
    <title>Moderate: ruby security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8131 (https://access.redhat.com/errata/RHSA-2025:8131), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186)

* CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)

* uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25186" id="CVE-2025-25186" type="cve" title="CVE-2025-25186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27219" id="CVE-2025-27219" type="cve" title="CVE-2025-27219" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221" id="CVE-2025-27221" type="cve" title="CVE-2025-27221" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2344680" id="2344680" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2349699" id="2349699" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2349700" id="2349700" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8131" id="RLSA-2025:8131" type="self" title="RLSA-2025:8131" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8131" id="RHSA-2025:8131" type="vendor" title="Red Hat RHSA-2025:8131" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ruby" arch="x86_64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-3.3.8-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">70ae95a297053e87cbb2e9341cca336a7c9f8a867ef60ff7a562882f2ae618e6</sum>
        </package>
        <package name="ruby-bundled-gems" arch="x86_64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-bundled-gems-3.3.8-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">89936986d2afc2161b8071165951bee3761164715b7cd629a73311473807f9fd</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-default-gems-3.3.8-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">2904c2be6de7adbab5728cba1bf5f581345a9ec634bf41d756b327d5df6cdc1d</sum>
        </package>
        <package name="ruby-devel" arch="x86_64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-devel-3.3.8-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5a20093ead897937ce445bc3e2bee224ed290d9cc056ae02cc8d6be710dffba7</sum>
        </package>
        <package name="rubygem-bigdecimal" arch="x86_64" epoch="0" version="3.1.5" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">46079b4b796342aa70c1c5894c9b5a877b6532b84c97a2f645e086b6a99b1976</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-bundler-2.5.22-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">d7b4cd0ea6f73904a04b3406e6ae24ec8054e6d370477622248c6da2d0cbba61</sum>
        </package>
        <package name="rubygem-io-console" arch="x86_64" epoch="0" version="0.7.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-io-console-0.7.1-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">87ac52e2d9bb3ce44e48e6aa84b7e235a5313254aa4356e86d4b7fa13edb477f</sum>
        </package>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-irb-1.13.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">47789a9d47f47375f2265bbfba6a021f98d2f2840f774b8c8dcb2d64a11c79f1</sum>
        </package>
        <package name="rubygem-json" arch="x86_64" epoch="0" version="2.7.2" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-json-2.7.2-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">cccb4ffae8ed26a79e679cc86c735f13ea845a4b1a68b7b52c8408b46b65dede</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-minitest-5.20.0-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">443713643e31df383a0adb8f57a219441de801e241bcb862d3be37542d8c3d72</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-power_assert-2.0.3-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">fd83ea41220fdd4bcd8e00f692c937507141e2fac3adae231441766600ac83a9</sum>
        </package>
        <package name="rubygem-psych" arch="x86_64" epoch="0" version="5.1.2" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-psych-5.1.2-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6f543d900d338437ce57036bf04f1eb5b08e3f6d5a9e00b6c6d1778abf737c7e</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rake-13.1.0-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">18f422e254af9edb5743dd00a53c2ce7a4d0e04939a2ab9ac711a7bd264a1e84</sum>
        </package>
        <package name="rubygem-rbs" arch="x86_64" epoch="0" version="3.4.0" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rbs-3.4.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d93ff9b87c443fcab891bf9534cfc659b1fa5de3c5c0677e1cd01ad4a075bc4f</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">656cedbc171c0d9924948b15bb319b8220c71e29a74a040d6f4a4f1b3358dde0</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.3.9" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rexml-3.3.9-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">f63afbc11ae33c3c780e6b46f2f7274c2ef874656cfb4633779181a508e8cf9a</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rss-0.3.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">312bb55e83f14b500d7a0e5c911f8745d5b5d06a3fcd847fb314c943deb18d1a</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygems-3.5.22-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">bb066d3068ce2da7cefc8f9f89d01e223d2870bd4a509e0aad5ebf7432a860be</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygems-devel-3.5.22-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">d44c057b948919daf238b6b1463d7b1c47c91420a539346ccc8436b77387b527</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-test-unit-3.6.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">cde1cbfe9e860af0cd849fb742cffa0fe5128ceb80f93497b3f8571fa0752517</sum>
        </package>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-typeprof-0.21.9-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">79fec13dace5e8b27fabccda2bf8904f5279779a88b3a67a4c156db8c03003da</sum>
        </package>
        <package name="ruby-libs" arch="x86_64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-libs-3.3.8-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a811f03c640287ffd60053dbd416ee4f060b57912d567fa6e0cba899c6e551ea</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8135</id>
    <title>Important: python-tornado security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8135 (https://access.redhat.com/errata/RHSA-2025:8135), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-tornado.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47287" id="CVE-2025-47287" type="cve" title="CVE-2025-47287" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366703" id="2366703" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8135" id="RLSA-2025:8135" type="self" title="RLSA-2025:8135" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8135" id="RHSA-2025:8135" type="vendor" title="Red Hat RHSA-2025:8135" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-tornado" arch="x86_64" epoch="0" version="6.4.2" release="1.el10_0.1" src="python-tornado-6.4.2-1.el10_0.1.src.rpm">
          <filename>python3-tornado-6.4.2-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">a000958cae7270e410a7c66849cbeea85cb91c411d01364bf8bb3416a8798498</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8184</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8184 (https://access.redhat.com/errata/RHSA-2025:8184), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-bad-free.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3887" id="CVE-2025-3887" type="cve" title="CVE-2025-3887" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367919" id="2367919" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8184" id="RLSA-2025:8184" type="self" title="RLSA-2025:8184" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8184" id="RHSA-2025:8184" type="vendor" title="Red Hat RHSA-2025:8184" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-bad-free" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_0" src="gstreamer1-plugins-bad-free-1.24.11-2.el10_0.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.24.11-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e6a0104c96cb43068cf5e534fbf4a72ceafd7e5e1d8a0ba846a6506156fbbf31</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_0" src="gstreamer1-plugins-bad-free-1.24.11-2.el10_0.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.24.11-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6c4cbda231626cc4a4a0402f167ccc46f39f9cd165f3288a91dfa8dc58f6c3b9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8196</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8196 (https://access.redhat.com/errata/RHSA-2025:8196), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)

* thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)

* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)

* thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3875" id="CVE-2025-3875" type="cve" title="CVE-2025-3875" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3877" id="CVE-2025-3877" type="cve" title="CVE-2025-3877" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3909" id="CVE-2025-3909" type="cve" title="CVE-2025-3909" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3932" id="CVE-2025-3932" type="cve" title="CVE-2025-3932" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366283" id="2366283" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366287" id="2366287" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366291" id="2366291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366297" id="2366297" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8196" id="RLSA-2025:8196" type="self" title="RLSA-2025:8196" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8196" id="RHSA-2025:8196" type="vendor" title="Red Hat RHSA-2025:8196" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.10.1" release="1.el10_0" src="thunderbird-128.10.1-1.el10_0.src.rpm">
          <filename>thunderbird-128.10.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">df38eef7d3514705fcb0c7be5a0e458f87fee4b6fa7d6d7a3c1399ea002a4d96</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8341</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8341 (https://access.redhat.com/errata/RHSA-2025:8341), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)

* firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)

* firefox: thunderbird: Memory safety bugs (CVE-2025-5268)

* firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)

* firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)

* firefox: thunderbird: Memory safety bug (CVE-2025-5269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5263" id="CVE-2025-5263" type="cve" title="CVE-2025-5263" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5264" id="CVE-2025-5264" type="cve" title="CVE-2025-5264" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5266" id="CVE-2025-5266" type="cve" title="CVE-2025-5266" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5267" id="CVE-2025-5267" type="cve" title="CVE-2025-5267" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5268" id="CVE-2025-5268" type="cve" title="CVE-2025-5268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5269" id="CVE-2025-5269" type="cve" title="CVE-2025-5269" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5283" id="CVE-2025-5283" type="cve" title="CVE-2025-5283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368749" id="2368749" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368750" id="2368750" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368751" id="2368751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368752" id="2368752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368755" id="2368755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368756" id="2368756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368757" id="2368757" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8341" id="RLSA-2025:8341" type="self" title="RLSA-2025:8341" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8341" id="RHSA-2025:8341" type="vendor" title="Red Hat RHSA-2025:8341" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.11.0" release="1.el10_0" src="firefox-128.11.0-1.el10_0.src.rpm">
          <filename>firefox-128.11.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3c07a0f3bcc326c61d866fb7492809e20822bb93398d11284404c095be4a1bc8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8477</id>
    <title>Moderate: golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8477 (https://access.redhat.com/errata/RHSA-2025:8477), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8477" id="RLSA-2025:8477" type="self" title="RLSA-2025:8477" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8477" id="RHSA-2025:8477" type="vendor" title="Red Hat RHSA-2025:8477" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-tests-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3215e7950d792a9a14b68b16cc720ae61ec83fe3b50223d9fb441bcaee76e7c9</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-1.23.9-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6faa1847c883a4569a060f1f6c9c9d5e36228eaa78c9ff52e60d9a9c2ce57816</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-bin-1.23.9-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">921831308c55a262edbb2eb845c909b54a7e477f08e4c15daba9bd602295478c</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-docs-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">bdd2760b73c9324ad1b4499a8f0ac93db56f828057b077941bb8e625050d26a7</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-misc-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">69b802400d4176e7bad9d0c1f1b5d73e5b76c67b3e976c8e150d266ce45a7ced</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-src-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">431c56db3fafa2e52ebeaf24f7722efd266be7ac65dfbb6ce76ec106d22711b8</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>go-toolset-1.23.9-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a7ab5309bfb0665bcd87d7502ca18178c886850cde21d423ff84b4b2516788f5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8493</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8493 (https://access.redhat.com/errata/RHSA-2025:8493), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23165" id="CVE-2025-23165" type="cve" title="CVE-2025-23165" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23166" id="CVE-2025-23166" type="cve" title="CVE-2025-23166" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367162" id="2367162" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367163" id="2367163" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8493" id="RLSA-2025:8493" type="self" title="RLSA-2025:8493" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8493" id="RHSA-2025:8493" type="vendor" title="Red Hat RHSA-2025:8493" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs" arch="x86_64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-22.16.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e0a3bb6b73c924de382fdda4c2e31c8219df51688af75db1ac7adc756c20027c</sum>
        </package>
        <package name="nodejs-devel" arch="x86_64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-devel-22.16.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">86c85e51c743291cc691708da372f6c57b325c900c35bc4473a0d0304aed0e5c</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-docs-22.16.0-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f120d25fe9ff48ab63fa1691b7c726ce10a6aea9d36e5fd8d312b8da1618d995</sum>
        </package>
        <package name="nodejs-full-i18n" arch="x86_64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-full-i18n-22.16.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c1edee59ad58d62edc8dbfd89090e590e5cac438ecd29be812591c4999d714de</sum>
        </package>
        <package name="nodejs-libs" arch="x86_64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-libs-22.16.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">200941a2cd22cf289eab52ec40b0c5d557fd47af01d2f84a3c4f0a9aa3f3c356</sum>
        </package>
        <package name="nodejs-npm" arch="x86_64" epoch="1" version="10.9.2" release="1.22.16.0.1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-npm-10.9.2-1.22.16.0.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">87e9b446e12688563c6ab9d6db073d00cf52b91b9f7b9061b6af9cc0c8d7eb96</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8550</id>
    <title>Important: varnish security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8550 (https://access.redhat.com/errata/RHSA-2025:8550), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for varnish.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

* varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47905" id="CVE-2025-47905" type="cve" title="CVE-2025-47905" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2364235" id="2364235" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8550" id="RLSA-2025:8550" type="self" title="RLSA-2025:8550" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8550" id="RHSA-2025:8550" type="vendor" title="Red Hat RHSA-2025:8550" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="varnish" arch="x86_64" epoch="0" version="7.6.1" release="2.el10_0.1" src="varnish-7.6.1-2.el10_0.1.src.rpm">
          <filename>varnish-7.6.1-2.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">c20f035f05607334518cae9c3a647021a7f0c65029e69b632c7f535d4bccf3b2</sum>
        </package>
        <package name="varnish-docs" arch="x86_64" epoch="0" version="7.6.1" release="2.el10_0.1" src="varnish-7.6.1-2.el10_0.1.src.rpm">
          <filename>varnish-docs-7.6.1-2.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">f24c53c020983c8fe892c808c5a30718400dda1446876f02b55ed88d59a2dbd5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8608</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8608 (https://access.redhat.com/errata/RHSA-2025:8608), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)

* firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)

* firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)

* firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)

* firefox: thunderbird: Memory safety bugs (CVE-2025-5268)

* firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)

* firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)

* firefox: thunderbird: Memory safety bug (CVE-2025-5269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4918" id="CVE-2025-4918" type="cve" title="CVE-2025-4918" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4919" id="CVE-2025-4919" type="cve" title="CVE-2025-4919" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5263" id="CVE-2025-5263" type="cve" title="CVE-2025-5263" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5264" id="CVE-2025-5264" type="cve" title="CVE-2025-5264" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5266" id="CVE-2025-5266" type="cve" title="CVE-2025-5266" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5267" id="CVE-2025-5267" type="cve" title="CVE-2025-5267" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5268" id="CVE-2025-5268" type="cve" title="CVE-2025-5268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5269" id="CVE-2025-5269" type="cve" title="CVE-2025-5269" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5283" id="CVE-2025-5283" type="cve" title="CVE-2025-5283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367016" id="2367016" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367018" id="2367018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368749" id="2368749" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368750" id="2368750" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368751" id="2368751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368752" id="2368752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368755" id="2368755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368756" id="2368756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368757" id="2368757" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8608" id="RLSA-2025:8608" type="self" title="RLSA-2025:8608" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8608" id="RHSA-2025:8608" type="vendor" title="Red Hat RHSA-2025:8608" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.11.0" release="1.el10_0" src="thunderbird-128.11.0-1.el10_0.src.rpm">
          <filename>thunderbird-128.11.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f1c1dc755fe7f836cfdf0b57c7b735be55384302c33d8d3a29c1c10ea837d92c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8636</id>
    <title>Important: perl-FCGI security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8636 (https://access.redhat.com/errata/RHSA-2025:8636), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-FCGI.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FastCGI Perl bindings.

Security Fix(es):

* perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library (CVE-2025-40907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40907" id="CVE-2025-40907" type="cve" title="CVE-2025-40907" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366847" id="2366847" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8636" id="RLSA-2025:8636" type="self" title="RLSA-2025:8636" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8636" id="RHSA-2025:8636" type="vendor" title="Red Hat RHSA-2025:8636" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl-FCGI" arch="x86_64" epoch="1" version="0.82" release="13.1.el10_0" src="perl-FCGI-0.82-13.1.el10_0.src.rpm">
          <filename>perl-FCGI-0.82-13.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">22fe2f5b524dee635bbe9b23e8e0bdc3e0e9e9ae2c5fac9a8ab4b6040507c91d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8666</id>
    <title>Moderate: grafana security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8666 (https://access.redhat.com/errata/RHSA-2025:8666), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8666" id="RLSA-2025:8666" type="self" title="RLSA-2025:8666" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8666" id="RHSA-2025:8666" type="vendor" title="Red Hat RHSA-2025:8666" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="18.el10_0" src="grafana-10.2.6-18.el10_0.src.rpm">
          <filename>grafana-10.2.6-18.el10_0.x86_64.rpm</filename>
          <sum type="sha256">62723e03850e9397dd62929a702071525c3b5dab747adf56f2ce0f69b16f0ebc</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="18.el10_0" src="grafana-10.2.6-18.el10_0.src.rpm">
          <filename>grafana-selinux-10.2.6-18.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9163eb0ff2c707faa39102249b4a1dbc0be6461aec1be27b53dc25c2af805566</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8814</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8814 (https://access.redhat.com/errata/RHSA-2025:8814), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es):

* dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30399" id="CVE-2025-30399" type="cve" title="CVE-2025-30399" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369701" id="2369701" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8814" id="RLSA-2025:8814" type="self" title="RLSA-2025:8814" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8814" id="RHSA-2025:8814" type="vendor" title="Red Hat RHSA-2025:8814" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d7457edcf64104290e89bcd6e67d4888b2dd228c73c898f07eb813922525fc6c</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">81b3d47f6a07283b88335cf508da39043582841f6abf74d48e860a0b809d7437</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5ba66ceb0130590205e56adb6d115b7ac8a7d87e75b627d3b500fd529bd9be76</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">20efa2a1037ec127a623051ff884b32c9a0c8bb24caaaee5556002603ec05c4b</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c7377e1e5e2d62ef184fdfe03aef71d0687b6d67b56728475be71279a71360f4</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">64485edea771c314b7e90d1d3d1da8b69425d90c8c501f916dc6997b3b80cb31</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">de112ccd80614b9347597f4d0e66f3cc6df90ba7f42bfb5dab1f7b2b5d57ab9c</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.117" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.117-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">538191263c89b69b9170ff0d73824be46167996ab7d741c6880899e9d4a58fa7</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.117" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.117-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bd7328292046cda9b169fdff431231efd38059fc3bb9da02be930e973fefc795</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b8deca062cf0d57437e15f5d92b16022fc1e861b6fe1fb76978e8d64d1c67bd9</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.117" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-templates-8.0-8.0.117-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c35bd8d3d10e3984f953fc85da86334b2e69cae1749f0cc99cf4f8cf409d9f0a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8816</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8816 (https://access.redhat.com/errata/RHSA-2025:8816), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es):

* dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30399" id="CVE-2025-30399" type="cve" title="CVE-2025-30399" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369701" id="2369701" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8816" id="RLSA-2025:8816" type="self" title="RLSA-2025:8816" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8816" id="RHSA-2025:8816" type="vendor" title="Red Hat RHSA-2025:8816" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">705c491227203f85fe6499e8e02ad3015176324ead6195f39985c5eb01d86f52</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f052f013d30c77fc2ac9c9466a22181bd055019b93d82548dd94fd7e5c9aa3a7</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">652ea2e12d972630d963f998463286cc3704f7ade5190a394bf7fa6251c5513a</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">32619a78651556c03ed237d2909c8c846f516deb832683d3b207098c30481b02</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-host-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bf48a5f3cc792ec3540947f59fccdbfdd9124824c5ffe75939b14de6f0b2ea2d</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">016df7700bf1c5268e708a87b76369ad7c46c73759b72ad667cf02e47447c9ad</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a9034080fadfd40c5c1688fa55cb61f649852fe4441dace19a0db77a3adf107e</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0ba7bc5bd42669e0ed5b2a8c606f2419fb6a7bbe2dea3780529b1048317abfac</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a1dbb49c11eb2d61bb5208edacb66ab385ede8682d8c3a642bd661db6b36e6e7</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a0ca032b71f16e9278c4b46b350b98a851b7866ee782d660da4975c9ea2aae5c</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">deb362101e4b64949568e6ecf0b17870eeeeb67490aab4e38a1e3c571d0a529d</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0e123835604160ac584d89fbc0bcd7870d31dedd3b91a49f64d2ec4acf843544</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-templates-9.0-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">49adfb4f8c2a633e811b2ab82c20851aea023c299973f1796e56c66104ddb068</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bf590a6382cb40226366e696d9dcef5665ade53de545d21198ea8b16bb1777ce</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8915</id>
    <title>Moderate: grafana-pcp security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:8915 (https://access.redhat.com/errata/RHSA-2025:8915), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8915" id="RLSA-2025:8915" type="self" title="RLSA-2025:8915" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:8915" id="RHSA-2025:8915" type="vendor" title="Red Hat RHSA-2025:8915" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-pcp" arch="x86_64" epoch="0" version="5.2.2" release="3.el10_0" src="grafana-pcp-5.2.2-3.el10_0.src.rpm">
          <filename>grafana-pcp-5.2.2-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">cd3df4b2432f3a954d7188e94c7652e52c30bb1a4bfccfae21d9cec5c528af78</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9063</id>
    <title>Moderate: git-lfs security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9063 (https://access.redhat.com/errata/RHSA-2025:9063), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9063" id="RLSA-2025:9063" type="self" title="RLSA-2025:9063" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9063" id="RHSA-2025:9063" type="vendor" title="Red Hat RHSA-2025:9063" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git-lfs" arch="x86_64" epoch="0" version="3.6.1" release="2.el10_0" src="git-lfs-3.6.1-2.el10_0.src.rpm">
          <filename>git-lfs-3.6.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1c545e395f9feb53671d3ce7cfcba7a39e8b398c89c03a50dfd19584be853037</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9120</id>
    <title>Important: libvpx security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9120 (https://access.redhat.com/errata/RHSA-2025:9120), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libvpx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

* libvpx: Double-free in libvpx encoder (CVE-2025-5283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5283" id="CVE-2025-5283" type="cve" title="CVE-2025-5283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368749" id="2368749" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9120" id="RLSA-2025:9120" type="self" title="RLSA-2025:9120" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9120" id="RHSA-2025:9120" type="vendor" title="Red Hat RHSA-2025:9120" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libvpx" arch="x86_64" epoch="0" version="1.14.1" release="3.el10_0" src="libvpx-1.14.1-3.el10_0.src.rpm">
          <filename>libvpx-1.14.1-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f1c002b0172b5ffe79cdceac98fb2d2d793ce38280bf84b40704a7f4330d6da0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9121</id>
    <title>Moderate: wireshark security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9121 (https://access.redhat.com/errata/RHSA-2025:9121), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Uncontrolled Recursion in Wireshark (CVE-2025-1492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1492" id="CVE-2025-1492" type="cve" title="CVE-2025-1492" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2346737" id="2346737" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9121" id="RLSA-2025:9121" type="self" title="RLSA-2025:9121" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9121" id="RHSA-2025:9121" type="vendor" title="Red Hat RHSA-2025:9121" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="wireshark" arch="x86_64" epoch="1" version="4.4.2" release="3.el10_0" src="wireshark-4.4.2-3.el10_0.src.rpm">
          <filename>wireshark-4.4.2-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c6f11b228aea2c3e711af4b8938367d80ef51d2652de6e52fa18dbb8a16d7bf6</sum>
        </package>
        <package name="wireshark-cli" arch="x86_64" epoch="1" version="4.4.2" release="3.el10_0" src="wireshark-4.4.2-3.el10_0.src.rpm">
          <filename>wireshark-cli-4.4.2-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">aeb95e2aeb9a2276ef09580609cb934ede3119b27832303d651492fa572d6176</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9148</id>
    <title>Moderate: buildah security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9148 (https://access.redhat.com/errata/RHSA-2025:9148), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9148" id="RLSA-2025:9148" type="self" title="RLSA-2025:9148" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9148" id="RHSA-2025:9148" type="vendor" title="Red Hat RHSA-2025:9148" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah" arch="x86_64" epoch="2" version="1.39.4" release="2.el10_0" src="buildah-1.39.4-2.el10_0.src.rpm">
          <filename>buildah-1.39.4-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dd92f9af51c1f497e10caa6e8d25ab1bcd044e9c784b31e592a9d474f5d13a54</sum>
        </package>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.39.4" release="2.el10_0" src="buildah-1.39.4-2.el10_0.src.rpm">
          <filename>buildah-tests-1.39.4-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5d6ab8d2b67d54722aa9929e4cc13b1a31221d2004fb4ec158212231e18c33f1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9146</id>
    <title>Moderate: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9146 (https://access.redhat.com/errata/RHSA-2025:9146), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9146" id="RLSA-2025:9146" type="self" title="RLSA-2025:9146" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9146" id="RHSA-2025:9146" type="vendor" title="Red Hat RHSA-2025:9146" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="6" version="5.4.0" release="10.el10_0" src="podman-5.4.0-10.el10_0.src.rpm">
          <filename>podman-5.4.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ac6b808b6d96e1432e7c69cbaf4d400959c8c0336bc934e5d832b88be6c7d5e4</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="10.el10_0" src="podman-5.4.0-10.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">72ee4b59f086d755726270ee648923634a2c7363eaecb7668975444143214d9f</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="6" version="5.4.0" release="10.el10_0" src="podman-5.4.0-10.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ab29ed6dbed2382d192acd0ba0218c1432b7a0dc16f659ae9829acf0cd6648b1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9149</id>
    <title>Moderate: skopeo security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9149 (https://access.redhat.com/errata/RHSA-2025:9149), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9149" id="RLSA-2025:9149" type="self" title="RLSA-2025:9149" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9149" id="RHSA-2025:9149" type="vendor" title="Red Hat RHSA-2025:9149" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.18.1" release="2.el10_0" src="skopeo-1.18.1-2.el10_0.src.rpm">
          <filename>skopeo-1.18.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c7c0b6bdc3637038ea43981f6f352e50901b153409a6481ae24d3742922d806a</sum>
        </package>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.18.1" release="2.el10_0" src="skopeo-1.18.1-2.el10_0.src.rpm">
          <filename>skopeo-tests-1.18.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">46087c9efe78988ed397604f87cf55f004867f2372a9bcfe25612cee8e2c2806</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9151</id>
    <title>Moderate: gvisor-tap-vsock security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9151 (https://access.redhat.com/errata/RHSA-2025:9151), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gvisor-tap-vsock.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9151" id="RLSA-2025:9151" type="self" title="RLSA-2025:9151" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9151" id="RHSA-2025:9151" type="vendor" title="Red Hat RHSA-2025:9151" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gvisor-tap-vsock" arch="x86_64" epoch="6" version="0.8.5" release="2.el10_0" src="gvisor-tap-vsock-0.8.5-2.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-0.8.5-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d8da08df95c7101b812fc44286073a5bd8105e4aa182a10fcc844aafa5612aa4</sum>
        </package>
        <package name="gvisor-tap-vsock-gvforwarder" arch="x86_64" epoch="6" version="0.8.5" release="2.el10_0" src="gvisor-tap-vsock-0.8.5-2.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-gvforwarder-0.8.5-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">615e3023b9c853f240e62e60cd3fc850c3d95af1a155e2c09b8e8ff83fc55c37</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9156</id>
    <title>Moderate: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9156 (https://access.redhat.com/errata/RHSA-2025:9156), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9156" id="RLSA-2025:9156" type="self" title="RLSA-2025:9156" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9156" id="RHSA-2025:9156" type="vendor" title="Red Hat RHSA-2025:9156" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="3.el10_0" src="golang-github-openprinting-ipp-usb-0.9.27-3.el10_0.src.rpm">
          <filename>ipp-usb-0.9.27-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0c2430bb72e5d3121209085be5a704cde4ab75affd241d021da44da388313ad6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9190</id>
    <title>Important: ipa security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9190 (https://access.redhat.com/errata/RHSA-2025:9190), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ipa.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4404" id="CVE-2025-4404" type="cve" title="CVE-2025-4404" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2364606" id="2364606" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9190" id="RLSA-2025:9190" type="self" title="RLSA-2025:9190" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9190" id="RHSA-2025:9190" type="vendor" title="Red Hat RHSA-2025:9190" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipa-client" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">db6e504bd578f3415fa12d81edb0f9e2a91fb85775aa9310e0b6bdb72b55b70e</sum>
        </package>
        <package name="ipa-client-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-common-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">6c1ae01a5131f824bf97c644496f68706f567b22085c430ca56bc03afb053207</sum>
        </package>
        <package name="ipa-client-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-encrypted-dns-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">d6a65274cbeeb61ac418a710f7681dafd11ac44cb5af1e36c3a087fb683bbf84</sum>
        </package>
        <package name="ipa-client-epn" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-epn-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">bd0c5c3276c9d3b414594cabc0b8a85559da55fcfff3bfc347d0e64ee9485a00</sum>
        </package>
        <package name="ipa-client-samba" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-samba-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">1b2db2f76203e45beaa4dd209eb334b82d7ba40ad12d54f4b78c1e4c3f64ad32</sum>
        </package>
        <package name="ipa-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-common-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">bd4658263915b86e0754a48dfef208eb3a06aeacef66b87e1e3e413c2c0d9423</sum>
        </package>
        <package name="ipa-selinux" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-selinux-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">9392af39d79b05f3d3584c5e2f8defe0aa763b7c26df19606b6ae69882e9d7f4</sum>
        </package>
        <package name="ipa-selinux-luna" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-selinux-luna-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">862cf3612971baf244e116d8f0860b18b99683e48e3a976f62be514c9e5ebe81</sum>
        </package>
        <package name="ipa-selinux-nfast" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-selinux-nfast-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">da232069356f6a7fed12c9b12c17d4e08adda805fbe718e9ffe83ce286498881</sum>
        </package>
        <package name="ipa-server" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">8bb7773a3a1e38ecfd6f53f344bb266d5ff6ad1bcd55d1745de95ecb8faa7502</sum>
        </package>
        <package name="ipa-server-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-common-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">89236fce67fe052cb19173070c2f50c2b514b865567328686e46a6f845ab302c</sum>
        </package>
        <package name="ipa-server-dns" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-dns-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">7303e5d8311880f7cae2058f4ed51096749cd5afa1d58e4303823207aefcfce4</sum>
        </package>
        <package name="ipa-server-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-encrypted-dns-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">00fe2c1ef71caa6780b937e2d5df5c59aaf3e616c7184b9a77d765411b8fc63c</sum>
        </package>
        <package name="ipa-server-trust-ad" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-trust-ad-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">ea76d4074cccf30c0a4847af1c0e4109adc09cf47f4ec062dfce5f6385bb0b01</sum>
        </package>
        <package name="python3-ipaclient" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>python3-ipaclient-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">3acf20126fa2ebd03bd719db4b3fdee63e40f34cfc4a805cca9042354485004c</sum>
        </package>
        <package name="python3-ipalib" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>python3-ipalib-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">8296ccacd4fbd8cea4f94f0f3442e6dac1ef32e62d3c197cdfe69cdb6876b69b</sum>
        </package>
        <package name="python3-ipaserver" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>python3-ipaserver-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">9c5d1580ae5902f184e00a231e6482c31dcb76da4b9d3d4feaea0d772ff7bbd7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9304</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9304 (https://access.redhat.com/errata/RHSA-2025:9304), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49175" id="CVE-2025-49175" type="cve" title="CVE-2025-49175" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49176" id="CVE-2025-49176" type="cve" title="CVE-2025-49176" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49177" id="CVE-2025-49177" type="cve" title="CVE-2025-49177" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49178" id="CVE-2025-49178" type="cve" title="CVE-2025-49178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49179" id="CVE-2025-49179" type="cve" title="CVE-2025-49179" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49180" id="CVE-2025-49180" type="cve" title="CVE-2025-49180" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369947" id="2369947" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369954" id="2369954" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369955" id="2369955" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369977" id="2369977" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369978" id="2369978" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369981" id="2369981" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9304" id="RLSA-2025:9304" type="self" title="RLSA-2025:9304" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9304" id="RHSA-2025:9304" type="vendor" title="Red Hat RHSA-2025:9304" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="x86_64" epoch="0" version="24.1.5" release="4.el10_0" src="xorg-x11-server-Xwayland-24.1.5-4.el10_0.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6de43e3d252b64ddb0345445ad0d3fb4f995b2b9bace0d4aa8aa2d1010dd46a7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9317</id>
    <title>Moderate: delve security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9317 (https://access.redhat.com/errata/RHSA-2025:9317), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9317" id="RLSA-2025:9317" type="self" title="RLSA-2025:9317" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9317" id="RHSA-2025:9317" type="vendor" title="Red Hat RHSA-2025:9317" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.24.1" release="2.el10_0" src="delve-1.24.1-2.el10_0.src.rpm">
          <filename>delve-1.24.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7efb8b95af246a461f1bfa2211d04b463f8c62b92a5ad8870f0887e0dabdc0ef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9307</id>
    <title>Moderate: freerdp security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9307 (https://access.redhat.com/errata/RHSA-2025:9307), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* gnome-remote-desktop: freerdp: Unauthenticated RDP Packet Causes Segfault in FreeRDP Leading to Denial of Service (CVE-2025-4478)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4478" id="CVE-2025-4478" type="cve" title="CVE-2025-4478" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2365232" id="2365232" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9307" id="RLSA-2025:9307" type="self" title="RLSA-2025:9307" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9307" id="RHSA-2025:9307" type="vendor" title="Red Hat RHSA-2025:9307" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="3.el10_0" src="freerdp-3.10.3-3.el10_0.src.rpm">
          <filename>freerdp-3.10.3-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">63ea45b480edbf4d06bd0c1cb4d383718aa3e8a032927e7602bc342507878523</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="3.el10_0" src="freerdp-3.10.3-3.el10_0.src.rpm">
          <filename>freerdp-libs-3.10.3-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">afd55ffed579ade915ed95ef2773ee4f41e1171fb76301199d01796bd1f1cbb9</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="3.el10_0" src="freerdp-3.10.3-3.el10_0.src.rpm">
          <filename>libwinpr-3.10.3-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">aa25ad4ab52995d2eb921fdea33f90ec4be3bd3533ba05d63e26ee4e75dfe18c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9328</id>
    <title>Important: libblockdev security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9328 (https://access.redhat.com/errata/RHSA-2025:9328), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libblockdev.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID.

Security Fix(es):

* libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6019" id="CVE-2025-6019" type="cve" title="CVE-2025-6019" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2370051" id="2370051" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9328" id="RLSA-2025:9328" type="self" title="RLSA-2025:9328" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9328" id="RHSA-2025:9328" type="vendor" title="Red Hat RHSA-2025:9328" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libblockdev" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d3a7f854798a5c6f6bb4621a08f0ec8e3771d7a29b0b61b4cc58dd365a92f7c8</sum>
        </package>
        <package name="libblockdev-crypto" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-crypto-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ce607a7814a0258101428f48a3ba09e03d68537dab4b54f55c8888e6a34a3681</sum>
        </package>
        <package name="libblockdev-dm" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-dm-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d14ce2625bea643ce8992ac7fb0a1c204d072a3f9484e667b3f7b9f229f56e4b</sum>
        </package>
        <package name="libblockdev-fs" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-fs-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e87b6e47a75db6a58bf782e1985a1dd4a33ea1afd0427e0aa48c9eb7c8b48878</sum>
        </package>
        <package name="libblockdev-loop" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-loop-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4543b21854976b9630426528012417f68c24532d1520b10c1ef0cfe1981174cc</sum>
        </package>
        <package name="libblockdev-lvm" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-lvm-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3a92cd5fcede975c771f81d08a5beb23be6a3b8e05c9f0ec190921e87638103d</sum>
        </package>
        <package name="libblockdev-lvm-dbus" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-lvm-dbus-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0508435a8b5a3552306013b4b6b733369b5c1693958ab4f6c2541b2795b54fe3</sum>
        </package>
        <package name="libblockdev-mdraid" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-mdraid-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">be9c8c67a1ca81bc6fc6364a928920b4abd1d633039986949453f02287baad27</sum>
        </package>
        <package name="libblockdev-mpath" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-mpath-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0c843a1d371bd2d338f6faeb6ebd6e8e19c8a58b6ebe3f631f399670af3979f4</sum>
        </package>
        <package name="libblockdev-nvdimm" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-nvdimm-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">53a4f5b0e2a3f64d460b9598bb9c5c3723947691dd46f1ffe1c58d1e29dcba88</sum>
        </package>
        <package name="libblockdev-nvme" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-nvme-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7fd761c59339de103b02bfafe12aeee0f5760217712f74a866268fd59dfbf3ea</sum>
        </package>
        <package name="libblockdev-part" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-part-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">46c08fbd4a93e47f6e7448ea31117e66cb457ab7509d6938f445a9736452abbd</sum>
        </package>
        <package name="libblockdev-plugins-all" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-plugins-all-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">227a181b251a28d6c4bb8d9d9c6deb9aedfdf14fe18f8cd87c9bfd8989b32d75</sum>
        </package>
        <package name="libblockdev-smart" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-smart-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8b698c8a0be374d0f622cb06b9ef608718b17aa47c5b22b826b6b9be60fe037a</sum>
        </package>
        <package name="libblockdev-smartmontools" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-smartmontools-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8586c0fa291f9ccdcfdebce9b9399d0e78d4fd7b3e16229dc637b19316400ff6</sum>
        </package>
        <package name="libblockdev-swap" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-swap-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">845e717de94c76b1e951d8447136ba27dc8f623c2fa47c67477745d136213f08</sum>
        </package>
        <package name="libblockdev-tools" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-tools-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6601c86706b4cf638ae995220a1d9a696dbb09370864a2a7c1e162c5eae3f920</sum>
        </package>
        <package name="libblockdev-utils" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-utils-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">11f89b9359ba8e7da8d59181e516c84dab609393f7fad876f82f7f557f677717</sum>
        </package>
        <package name="python3-blockdev" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>python3-blockdev-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">07060a3647bd8c164f6c16346c786c8868ee935777f9dac156e75967096a199f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9466</id>
    <title>Moderate: mod_proxy_cluster security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9466 (https://access.redhat.com/errata/RHSA-2025:9466), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_proxy_cluster.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.

Security Fix(es):

* mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10306" id="CVE-2024-10306" type="cve" title="CVE-2024-10306" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2321302" id="2321302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9466" id="RLSA-2025:9466" type="self" title="RLSA-2025:9466" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9466" id="RHSA-2025:9466" type="vendor" title="Red Hat RHSA-2025:9466" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_proxy_cluster" arch="x86_64" epoch="0" version="1.3.22" release="1.el10_0.2" src="mod_proxy_cluster-1.3.22-1.el10_0.2.src.rpm">
          <filename>mod_proxy_cluster-1.3.22-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">2e606a51f4c524fa2d00d86a382c16db1e47539ff5edb32c6868bd5ed54a76c1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9486</id>
    <title>Moderate: qt6-qtbase security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:9486 (https://access.redhat.com/errata/RHSA-2025:9486), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qt6-qtbase.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Qt is a software toolkit for developing applications.  This package contains base tools, like string, xml, and network handling.

Security Fix(es):

* qt5: qt6: QtCore Assertion Failure Denial of Service (CVE-2025-5455)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5455" id="CVE-2025-5455" type="cve" title="CVE-2025-5455" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369722" id="2369722" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9486" id="RLSA-2025:9486" type="self" title="RLSA-2025:9486" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:9486" id="RHSA-2025:9486" type="vendor" title="Red Hat RHSA-2025:9486" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtbase" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2de3a60b2ccf066a9ae487a6abf862f85574ad6c89e0a110ce2153ebbdf623c8</sum>
        </package>
        <package name="qt6-qtbase-common" arch="noarch" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-common-6.8.1-9.el10_0.noarch.rpm</filename>
          <sum type="sha256">1cb71dc28df65692eeb4c2716a3648f044980fa7291152664beaccd2b7f5185e</sum>
        </package>
        <package name="qt6-qtbase-devel" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-devel-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6710f0b133f7348dfab7e7673e7061c516b01d1ce553b1aa979cc5bccb14ecf4</sum>
        </package>
        <package name="qt6-qtbase-gui" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-gui-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1e68bcf33a86231f5644a251e479bea888dae70562911fb3e9aedad40cdd7e2e</sum>
        </package>
        <package name="qt6-qtbase-mysql" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-mysql-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4bb179ef2aa0405528af0b57977da96245a7b898ce0c1366f0c3a386e77b626e</sum>
        </package>
        <package name="qt6-qtbase-odbc" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-odbc-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5669abff6d8d77e5bd31c7c68aa16dc0577e9826ed2e2a40b35094dcd60d11c2</sum>
        </package>
        <package name="qt6-qtbase-postgresql" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-postgresql-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">91a8f6417b7e9e8235a0d367e8470f52f7856aa607c4b8b26de038285c394a93</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10073</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:10073 (https://access.redhat.com/errata/RHSA-2025:10073), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430)

* firefox: Use-after-free in FontFaceSet (CVE-2025-6424)

* firefox: Incorrect parsing of URLs could have allowed embedding of youtube.com (CVE-2025-6429)

* firefox: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVE-2025-6425)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6424" id="CVE-2025-6424" type="cve" title="CVE-2025-6424" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6425" id="CVE-2025-6425" type="cve" title="CVE-2025-6425" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6429" id="CVE-2025-6429" type="cve" title="CVE-2025-6429" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6430" id="CVE-2025-6430" type="cve" title="CVE-2025-6430" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374555" id="2374555" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374559" id="2374559" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374561" id="2374561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374562" id="2374562" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10073" id="RLSA-2025:10073" type="self" title="RLSA-2025:10073" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:10073" id="RHSA-2025:10073" type="vendor" title="Red Hat RHSA-2025:10073" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.12.0" release="1.el10_0" src="firefox-128.12.0-1.el10_0.src.rpm">
          <filename>firefox-128.12.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">caf622e42b0973dd60f92c487b4c3fcbf93d4117974a26e80143eea23fd77114</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10195</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:10195 (https://access.redhat.com/errata/RHSA-2025:10195), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-5986)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5986" id="CVE-2025-5986" type="cve" title="CVE-2025-5986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6424" id="CVE-2025-6424" type="cve" title="CVE-2025-6424" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6425" id="CVE-2025-6425" type="cve" title="CVE-2025-6425" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6429" id="CVE-2025-6429" type="cve" title="CVE-2025-6429" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6430" id="CVE-2025-6430" type="cve" title="CVE-2025-6430" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2372281" id="2372281" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374555" id="2374555" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374559" id="2374559" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374561" id="2374561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374562" id="2374562" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10195" id="RLSA-2025:10195" type="self" title="RLSA-2025:10195" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:10195" id="RHSA-2025:10195" type="vendor" title="Red Hat RHSA-2025:10195" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.12.0" release="1.el10_0" src="thunderbird-128.12.0-1.el10_0.src.rpm">
          <filename>thunderbird-128.12.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1a548cb962b29751d4c1496a61f2aeab52c776c11d5da114481e3c686ef04bc9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10549</id>
    <title>Important: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:10549 (https://access.redhat.com/errata/RHSA-2025:10549), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: podman missing TLS verification (CVE-2025-6032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6032" id="CVE-2025-6032" type="cve" title="CVE-2025-6032" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2372501" id="2372501" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10549" id="RLSA-2025:10549" type="self" title="RLSA-2025:10549" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:10549" id="RHSA-2025:10549" type="vendor" title="Red Hat RHSA-2025:10549" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="6" version="5.4.0" release="12.el10_0" src="podman-5.4.0-12.el10_0.src.rpm">
          <filename>podman-5.4.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f55513d20fbf5bd077f99edc0b5a0d087f8b5a39d83755436d1b023f1223fec9</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="12.el10_0" src="podman-5.4.0-12.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-12.el10_0.noarch.rpm</filename>
          <sum type="sha256">50e57d06c0b4b9b5f81adc49cece6f8a36edbae57426c6f6b3b6cf9939b0ab15</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="6" version="5.4.0" release="12.el10_0" src="podman-5.4.0-12.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">50e674970307310bd884f2512522086fcc066269629714f3f69cc7cc30f44369</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10635</id>
    <title>Moderate: gnome-remote-desktop security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:10635 (https://access.redhat.com/errata/RHSA-2025:10635), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gnome-remote-desktop.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.

Security Fix(es):

* gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs (CVE-2025-5024)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5024" id="CVE-2025-5024" type="cve" title="CVE-2025-5024" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367717" id="2367717" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10635" id="RLSA-2025:10635" type="self" title="RLSA-2025:10635" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:10635" id="RHSA-2025:10635" type="vendor" title="Red Hat RHSA-2025:10635" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gnome-remote-desktop" arch="x86_64" epoch="0" version="47.3" release="2.el10_0" src="gnome-remote-desktop-47.3-2.el10_0.src.rpm">
          <filename>gnome-remote-desktop-47.3-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d640623005dd3b46759cf12b050d0243b828edde9a7c656d7c334cd5e2625775</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10677</id>
    <title>Moderate: golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:10677 (https://access.redhat.com/errata/RHSA-2025:10677), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4673" id="CVE-2025-4673" type="cve" title="CVE-2025-4673" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373305" id="2373305" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10677" id="RLSA-2025:10677" type="self" title="RLSA-2025:10677" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:10677" id="RHSA-2025:10677" type="vendor" title="Red Hat RHSA-2025:10677" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang" arch="x86_64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-1.24.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">47bcbc253bddea0ab4e17a0e7df155ef958cbeb647df179475b38109434c58ed</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-bin-1.24.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">725364e1f2a3f34187adb648235ef1637638a0dd1d27bf4deb40391005e2e578</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-docs-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f55ec9fb24d751ffe3187f8ca6c2726708bdf26cc2e04ed86d7500edf65a2eb9</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-misc-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c34922495aa0d17cd7ea49e63ba69169799423420eaf62cebd336663b16ba28a</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-race-1.24.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d398fefc9e578487f12aeba645b25156f05264fff13cd852d033b3df2ede8dd3</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-src-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f49a704a94a6fae26328780398d8a6f588082da9aa5dafa3d777cf1a0eb27434</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-tests-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e2ce7eb27332c70ecc199fc129838f7f8b37a285a616b50b04779e5e62e0c77f</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>go-toolset-1.24.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d8822654a0f59980f51d80b83aea1db0a28173f3de5f5da28a748c1750186ed0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10873</id>
    <title>Important: java-21-openjdk security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:10873 (https://access.redhat.com/errata/RHSA-2025:10873), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for java-21-openjdk.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

* JDK: Better Glyph drawing (CVE-2025-30749)
* JDK: Enhance TLS protocol support (CVE-2025-30754)
* JDK: Improve HTTP client header handling (CVE-2025-50059)
* JDK: Better Glyph drawing redux (CVE-2025-50106)

Bug Fix(es):

* In Rocky Linux 9 and Rocky Linux 10 systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (Rocky Linux-102683, Rocky Linux-102684, Rocky Linux-102685)
* On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (Rocky Linux-90307, Rocky Linux-90308, Rocky Linux-90311)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30749" id="CVE-2025-30749" type="cve" title="CVE-2025-30749" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30754" id="CVE-2025-30754" type="cve" title="CVE-2025-30754" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50059" id="CVE-2025-50059" type="cve" title="CVE-2025-50059" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50106" id="CVE-2025-50106" type="cve" title="CVE-2025-50106" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376783" id="2376783" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376784" id="2376784" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376785" id="2376785" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379031" id="2379031" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10873" id="RLSA-2025:10873" type="self" title="RLSA-2025:10873" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:10873" id="RHSA-2025:10873" type="vendor" title="Red Hat RHSA-2025:10873" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="java-21-openjdk" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">414b7b019f3d764f5085a9391a9da59c4217d3d5fbaa0f6eb528d82d30501c3f</sum>
        </package>
        <package name="java-21-openjdk-demo" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-demo-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">51cdacc5c442cfcc0a19b02c6631bc03a410700a02b9dcfb4984c2722d41ac7d</sum>
        </package>
        <package name="java-21-openjdk-devel" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-devel-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">75103cb2346fd169dbdf0ebc0f3c505f5028484edaab82597189d240b1cb60ec</sum>
        </package>
        <package name="java-21-openjdk-headless" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-headless-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">61e05b22711cd5ac0605a11d66198c1bb013f556e25ee2b1af0b9f343a262eae</sum>
        </package>
        <package name="java-21-openjdk-javadoc" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-javadoc-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">f31686b03b8f9653d851f7a888884dc250cc187b6ee3c515db17308b23eb0937</sum>
        </package>
        <package name="java-21-openjdk-javadoc-zip" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-javadoc-zip-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">20b79b5308c23166b48408ba4eeb67734a4b4d20838f472d9d8f6c2e345876e8</sum>
        </package>
        <package name="java-21-openjdk-jmods" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-jmods-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">55f8d134798e069b709c2c46ce4d30ddbb8cbcf7a952b032daccc8017806cf90</sum>
        </package>
        <package name="java-21-openjdk-src" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-src-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">927695c96d9cd38503339ef6e3d4fff73a528093e984b5f1dcf0b33a7edbc032</sum>
        </package>
        <package name="java-21-openjdk-static-libs" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-static-libs-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">cd93b8ff3d5244e9933e22c1aa8df2e92cb892e1dd69aa4d9a45765db013e3b1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:11332</id>
    <title>Important: tomcat9 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:11332 (https://access.redhat.com/errata/RHSA-2025:11332), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337)

* tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56337" id="CVE-2024-56337" type="cve" title="CVE-2024-56337" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31650" id="CVE-2025-31650" type="cve" title="CVE-2025-31650" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2333521" id="2333521" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362783" id="2362783" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:11332" id="RLSA-2025:11332" type="self" title="RLSA-2025:11332" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:11332" id="RHSA-2025:11332" type="vendor" title="Red Hat RHSA-2025:11332" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">7c11353e58e4822db9739e90e1b99462f3be11ed491be1beb1be7807545181bd</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">3d6851aa27bf852945314cbad8a11ba59df3e3cbe7ed6ac0e5a5f29c58225d40</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">a9f4d0eeabb6df8ffa9e7a332446f5a161ada29c77a0d38fb801fc826504e033</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">38b76b62dec96d2400b4a5030c61a93d6865897a63fd032a2b9f1076eafe9c2d</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">cf01a3d83ada8424330926b49aaa536c4dfb24576f057cc989a0b3a14c441883</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-lib-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">29e509374ef0700c32eb589736d9d80bddbe255b252cd9f927e1e3f21bf5ec3e</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">0ca600cd745cbb59544aafe2278a75381d4da269d7ac01aaeb9b61eba69210df</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-webapps-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">f5b988b6558b3992d98428ec7af5cf620fc24157d925e3ab1cb9fa27488fa459</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:11401</id>
    <title>Important: valkey security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:11401 (https://access.redhat.com/errata/RHSA-2025:11401), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Redis Stack Buffer Overflow (CVE-2025-27151)

* redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)

* redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27151" id="CVE-2025-27151" type="cve" title="CVE-2025-27151" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32023" id="CVE-2025-32023" type="cve" title="CVE-2025-32023" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48367" id="CVE-2025-48367" type="cve" title="CVE-2025-48367" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369153" id="2369153" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376857" id="2376857" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376858" id="2376858" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:11401" id="RLSA-2025:11401" type="self" title="RLSA-2025:11401" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:11401" id="RHSA-2025:11401" type="vendor" title="Red Hat RHSA-2025:11401" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.4" release="1.el10_0" src="valkey-8.0.4-1.el10_0.src.rpm">
          <filename>valkey-8.0.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2d12afb4fcd325b1488ccdac49769189bf63f6b732c1a24badd090cb0a7372bb</sum>
        </package>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.4" release="1.el10_0" src="valkey-8.0.4-1.el10_0.src.rpm">
          <filename>valkey-devel-8.0.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">23141aafa373e629b37c23cbe6e950f1d2c56d437b8c335ea2863ded3c76a87b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:11797</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:11797 (https://access.redhat.com/errata/RHSA-2025:11797), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

* firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

* firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

* firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

* firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

* firefox: Memory safety bugs (CVE-2025-8034)

* firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

* firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

* firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8027" id="CVE-2025-8027" type="cve" title="CVE-2025-8027" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8028" id="CVE-2025-8028" type="cve" title="CVE-2025-8028" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8029" id="CVE-2025-8029" type="cve" title="CVE-2025-8029" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8030" id="CVE-2025-8030" type="cve" title="CVE-2025-8030" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8031" id="CVE-2025-8031" type="cve" title="CVE-2025-8031" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8032" id="CVE-2025-8032" type="cve" title="CVE-2025-8032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8033" id="CVE-2025-8033" type="cve" title="CVE-2025-8033" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8034" id="CVE-2025-8034" type="cve" title="CVE-2025-8034" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8035" id="CVE-2025-8035" type="cve" title="CVE-2025-8035" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382701" id="2382701" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382703" id="2382703" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382704" id="2382704" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382707" id="2382707" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382710" id="2382710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382711" id="2382711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382717" id="2382717" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382718" id="2382718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382720" id="2382720" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:11797" id="RLSA-2025:11797" type="self" title="RLSA-2025:11797" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:11797" id="RHSA-2025:11797" type="vendor" title="Red Hat RHSA-2025:11797" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.13.0" release="1.el10_0" src="firefox-128.13.0-1.el10_0.src.rpm">
          <filename>firefox-128.13.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ba59deecd32c170f47287be1d7a4f4096af6a9e8232c940727bac9af3aeec264</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12056</id>
    <title>Moderate: perl security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:12056 (https://access.redhat.com/errata/RHSA-2025:12056), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for perl.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

* perl: Perl threads have a working directory race condition where file operations may target unintended paths (CVE-2025-40909)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40909" id="CVE-2025-40909" type="cve" title="CVE-2025-40909" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369407" id="2369407" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12056" id="RLSA-2025:12056" type="self" title="RLSA-2025:12056" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:12056" id="RHSA-2025:12056" type="vendor" title="Red Hat RHSA-2025:12056" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl" arch="x86_64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b265994fcf986e3a92ee5a3969a0afb7989c9fa336f4c24305b867e4169d09b7</sum>
        </package>
        <package name="perl-Attribute-Handlers" arch="noarch" epoch="0" version="1.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Attribute-Handlers-1.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a50a47c9c8189cf7eec48d586f8816aa6273e5a84e24c8b38c98b3396378e0d7</sum>
        </package>
        <package name="perl-AutoLoader" arch="noarch" epoch="0" version="5.74" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-AutoLoader-5.74-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d11dee873d7d98224cb8b63b805b266025ff6e7a7c0bbddea102a1aef6b4c1ef</sum>
        </package>
        <package name="perl-AutoSplit" arch="noarch" epoch="0" version="5.74" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-AutoSplit-5.74-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">fc83da5b9f60869db73ea9335d11b087da8977bab44b669d2fc21d5ce7eedbdf</sum>
        </package>
        <package name="perl-autouse" arch="noarch" epoch="0" version="1.11" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-autouse-1.11-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">022a86f3a5975a041799ad17b807e59e335f57a29b3fcd9e7624ae13d9fc343f</sum>
        </package>
        <package name="perl-B" arch="x86_64" epoch="0" version="1.89" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-B-1.89-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d588891d25ed85721f393261d4ce734628f224ef96f7e63fdfbe148473bde45b</sum>
        </package>
        <package name="perl-base" arch="noarch" epoch="0" version="2.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-base-2.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">23294c4ee06f04f99e734a520e7118b3f69b4e973afdcfa435e7fdffacb6cb30</sum>
        </package>
        <package name="perl-Benchmark" arch="noarch" epoch="0" version="1.25" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Benchmark-1.25-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7f17cc9401a6998858fbfc634fd8cacb305dd95c5557fa60dd1efc7f9e40dd6c</sum>
        </package>
        <package name="perl-blib" arch="noarch" epoch="0" version="1.07" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-blib-1.07-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">26f1caf1fa8a54fea467f5e126a8b9d295cc763ee5e84029137ee6dd9ad12668</sum>
        </package>
        <package name="perl-Class-Struct" arch="noarch" epoch="0" version="0.68" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Class-Struct-0.68-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">142b33b254ad949b08e59aa746019c53c09a6f9b1e8f16612c23a2222c7890bd</sum>
        </package>
        <package name="perl-Config-Extensions" arch="noarch" epoch="0" version="0.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Config-Extensions-0.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">088dd306bf83eb27d4800a7dc8a74248a7655b27025f6a1096a32664ad3f7e71</sum>
        </package>
        <package name="perl-DBM_Filter" arch="noarch" epoch="0" version="0.06" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-DBM_Filter-0.06-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">594a8f1acb1be8bea0d80d76529e16e209ab76632573ec320a3a255c1d93030d</sum>
        </package>
        <package name="perl-debugger" arch="noarch" epoch="0" version="1.60" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-debugger-1.60-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">116632d66aecb227ec01b561039c998967e38b11605a08c26c6975f100d3f363</sum>
        </package>
        <package name="perl-deprecate" arch="noarch" epoch="0" version="0.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-deprecate-0.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">f9b6c6d93abe972e0898aed2bd517c9dd7492b589cc43f0f542ef879705eaa16</sum>
        </package>
        <package name="perl-devel" arch="x86_64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-devel-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">66ed028cae6824ce85994b61f7ca214e8c41d875e3f608dc8c4e86b46110bb25</sum>
        </package>
        <package name="perl-Devel-Peek" arch="x86_64" epoch="0" version="1.34" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Devel-Peek-1.34-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6896ad09a4e892ffa003e93c2c5b5b4b68dfb06fcfb64bd0b87faae9b8387001</sum>
        </package>
        <package name="perl-Devel-SelfStubber" arch="noarch" epoch="0" version="1.06" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Devel-SelfStubber-1.06-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3333f3ddba623e1659029a71773b6fdd8b06009f52f630c617f5f06869d193ab</sum>
        </package>
        <package name="perl-diagnostics" arch="noarch" epoch="0" version="1.40" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-diagnostics-1.40-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">391498cf663012d9ec9bd910b4bf53cf4234304cea25b142debbb91bda3c79ba</sum>
        </package>
        <package name="perl-DirHandle" arch="noarch" epoch="0" version="1.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-DirHandle-1.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3b7143910af7251015a7a91b80280ebe2390424ccb7e1ce5172d6fe3a2b579a7</sum>
        </package>
        <package name="perl-doc" arch="noarch" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-doc-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">1f2e5dc38f4e1c91f43dac6269bb11d7c025b27eb55e7f4eb6461ea0220704ac</sum>
        </package>
        <package name="perl-Dumpvalue" arch="noarch" epoch="0" version="2.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Dumpvalue-2.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4e035ced3d3eae3c988ec32be73475af7f253d99e8fe456d829cbca7887fd3e6</sum>
        </package>
        <package name="perl-DynaLoader" arch="x86_64" epoch="0" version="1.56" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-DynaLoader-1.56-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7b230f3a36461975bb796bf60f0dcbca697e0e522b00747f781a01e971680d4f</sum>
        </package>
        <package name="perl-encoding-warnings" arch="noarch" epoch="0" version="0.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-encoding-warnings-0.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e0901d24894adcac12d89343604cf3e8775024483b6a83d3d5913153c41faf8a</sum>
        </package>
        <package name="perl-English" arch="noarch" epoch="0" version="1.11" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-English-1.11-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">cace3f6ec93d1dddf2a3880e90a746967df8ad4b18c65e3fab3d6d2837962a59</sum>
        </package>
        <package name="perl-Errno" arch="x86_64" epoch="0" version="1.38" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Errno-1.38-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5e32d206bff50b0b9f19b624dad1024ff14f5cda9d41ba6cfb6b6d7dc8aa537f</sum>
        </package>
        <package name="perl-ExtUtils-Constant" arch="noarch" epoch="0" version="0.25" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ExtUtils-Constant-0.25-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a5254c20224062ab3e006e8a816d71f6a6f7c392afebeaf67c08189a04820674</sum>
        </package>
        <package name="perl-ExtUtils-Embed" arch="noarch" epoch="0" version="1.35" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ExtUtils-Embed-1.35-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a3a81991583e28184db2748eb512c1a95788568a6da7aafaa5ec0fc4a39b594d</sum>
        </package>
        <package name="perl-ExtUtils-Miniperl" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ExtUtils-Miniperl-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bff285dd9b50eac452554962e9533a81440ab5b293a5f8a131ed217e159b4abd</sum>
        </package>
        <package name="perl-Fcntl" arch="x86_64" epoch="0" version="1.18" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Fcntl-1.18-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">23a9127922cf33f954b1e78053e60c9186f72add5090ccb1b7b90b9b23147673</sum>
        </package>
        <package name="perl-fields" arch="noarch" epoch="0" version="2.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-fields-2.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a5185e8c106dd42e6900b9594a894c8640301c4454d6e9130996d1d2c6619743</sum>
        </package>
        <package name="perl-File-Basename" arch="noarch" epoch="0" version="2.86" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Basename-2.86-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">0e52e24b6fe11614f52f85fac01887550aca5af48322b7297add18f8bae07af8</sum>
        </package>
        <package name="perl-FileCache" arch="noarch" epoch="0" version="1.10" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-FileCache-1.10-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">ddcec09ad7b7e78312d597efb775fd0795aca5064ba933ac3ba53de6ffb70ed3</sum>
        </package>
        <package name="perl-File-Compare" arch="noarch" epoch="0" version="1.100.800" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Compare-1.100.800-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">36d9a304d4513dd8ab9b8e98d02cc609541bdbba22be1ea88b247e37ca61671f</sum>
        </package>
        <package name="perl-File-Copy" arch="noarch" epoch="0" version="2.41" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Copy-2.41-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">eed099e78ffcf4332ed8a29bfb6ea948717fc3b61b312e205a8a3bb3783abcb0</sum>
        </package>
        <package name="perl-File-DosGlob" arch="x86_64" epoch="0" version="1.12" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-DosGlob-1.12-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5923b9d3b2d251fba23daf25c33a885f065789741fc319819cc7af803b848ea2</sum>
        </package>
        <package name="perl-File-Find" arch="noarch" epoch="0" version="1.44" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Find-1.44-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">1d72ea44720cc2edbea27771dd5708935c2b1f1165c12b7bd8053a281e31bff8</sum>
        </package>
        <package name="perl-FileHandle" arch="noarch" epoch="0" version="2.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-FileHandle-2.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">da293f041854918ba2ed671bc86e0fa2495c7c6bb6bb4ae6c1d1555aa0543ccf</sum>
        </package>
        <package name="perl-File-stat" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-stat-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e68ec3b54e4a04236a01260f76f52453974a71e4ba14a85a92357e611f8f0307</sum>
        </package>
        <package name="perl-filetest" arch="noarch" epoch="0" version="1.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-filetest-1.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d722cf0a055e441a8e7f804a6cb287f292ea823b01ffa0fd6aa6b9232d28a82b</sum>
        </package>
        <package name="perl-FindBin" arch="noarch" epoch="0" version="1.54" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-FindBin-1.54-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">309befe99d17047346772695df54eb58575c000cd4da46652dfc56edc7da597f</sum>
        </package>
        <package name="perl-GDBM_File" arch="x86_64" epoch="1" version="1.24" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-GDBM_File-1.24-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9dcacfb69263607b53dbe91ba37f0b7127434cb55644e860c653f2c5a55abc3f</sum>
        </package>
        <package name="perl-Getopt-Std" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Getopt-Std-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4c704ab2ee391d717797366dd5ed6e0b4972c6915dbaf0ed0079f4cb23dd2fb3</sum>
        </package>
        <package name="perl-if" arch="noarch" epoch="0" version="0.61.000" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-if-0.61.000-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">5f355e52e71146d71223f34451b5ff1c11bc471ae8eeb0a1a84258d15c32594f</sum>
        </package>
        <package name="perl-Hash-Util" arch="x86_64" epoch="0" version="0.32" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Hash-Util-0.32-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4617726e95f16d7227a56b906129576a3f6ca18ff3e2474e7bdfb25e6bb9a0c4</sum>
        </package>
        <package name="perl-Hash-Util-FieldHash" arch="x86_64" epoch="0" version="1.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Hash-Util-FieldHash-1.27-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2448474e9a9e2c5c6a95c30af5ea461e5b4230ada3b56b2d348ffa388d8f81f6</sum>
        </package>
        <package name="perl-I18N-Collate" arch="noarch" epoch="0" version="1.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-I18N-Collate-1.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bcba8afa4f930466ff0b74cd168d0223e120524176ce70249b765a1b1b7dd280</sum>
        </package>
        <package name="perl-I18N-Langinfo" arch="x86_64" epoch="0" version="0.24" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-I18N-Langinfo-0.24-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">fecbf0ab5d50f8e0f2b71a5afc68cf2ed17e3fb874c1c9fd8d3542c681ed60b8</sum>
        </package>
        <package name="perl-I18N-LangTags" arch="noarch" epoch="0" version="0.45" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-I18N-LangTags-0.45-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">76f6d8df29b37d36d869d540fe00fab661009cb9985b188caf23892bad7b52a8</sum>
        </package>
        <package name="perl-interpreter" arch="x86_64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-interpreter-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c7f42478109294d799ccbeea3d312babe50e1ec9a5aeb2680e710354474a1e4c</sum>
        </package>
        <package name="perl-IO" arch="x86_64" epoch="0" version="1.55" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-IO-1.55-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c1ff25c73bf4655f6cf840bc9ad42efd17c9e00bde426bc60a4f6f117025c319</sum>
        </package>
        <package name="perl-IPC-Open3" arch="noarch" epoch="0" version="1.22" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-IPC-Open3-1.22-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">86b148a2756784bdcbdaff5cff28c5393ac52f4bf0216907756b57a5ba5ca92b</sum>
        </package>
        <package name="perl-less" arch="noarch" epoch="0" version="0.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-less-0.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b5e848124b09387112c1d4231c76c8def385bc0538c73b2c6ec9aa685fa9200d</sum>
        </package>
        <package name="perl-lib" arch="x86_64" epoch="0" version="0.65" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-lib-0.65-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e1474e01430a36940d9ce1740d9a4053e50bf6e7990b53983384d96306161067</sum>
        </package>
        <package name="perl-libnetcfg" arch="noarch" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-libnetcfg-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7efe3f4939bc66049dfb3820be0b55a361dfc104ba96d7878399dee3e3d68a5d</sum>
        </package>
        <package name="perl-libs" arch="x86_64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-libs-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2f79c95832a0ea14dca174af34a3537933ec7d06e8bcf81ca9006af5fa9f2c96</sum>
        </package>
        <package name="perl-locale" arch="noarch" epoch="0" version="1.12" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-locale-1.12-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a9a3b66e223867d6208946406f5b1edf6726034cdb86c60594d1d1df8381fa18</sum>
        </package>
        <package name="perl-Locale-Maketext-Simple" arch="noarch" epoch="1" version="0.21" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Locale-Maketext-Simple-0.21-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">39e29184aa99c21e97a57e97dc02717f90d377f12a3202b0e93b71ce1ff113c6</sum>
        </package>
        <package name="perl-macros" arch="noarch" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-macros-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">c338c5d3a9bd8a1c1235f1c8da239f29b9d62bf58788f9983355db0106722eaf</sum>
        </package>
        <package name="perl-Math-Complex" arch="noarch" epoch="0" version="1.62" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Math-Complex-1.62-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">6be88deaf0001307cb42142a066d5bbb8355ca3c066f287cc1dfb6c70135de31</sum>
        </package>
        <package name="perl-Memoize" arch="noarch" epoch="0" version="1.16" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Memoize-1.16-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a8b43a7f26e0da134f559117be6ec1246f4403594c78bd2c028b93ee08086207</sum>
        </package>
        <package name="perl-meta-notation" arch="noarch" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-meta-notation-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e1de3da0d11590cde4c2f31ea22160f937639c4cb14852569b46be28b046c8ee</sum>
        </package>
        <package name="perl-Module-Loaded" arch="noarch" epoch="1" version="0.08" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Module-Loaded-0.08-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3639e9e7b65277a67c7409fe4f020b3913c7ef6b948bf577ed1ae9aa34f71efc</sum>
        </package>
        <package name="perl-mro" arch="x86_64" epoch="0" version="1.29" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-mro-1.29-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">97f250b301202873e08a3f63fb0e06c12863dff43dc267e2d0ebedd4f8241467</sum>
        </package>
        <package name="perl-NDBM_File" arch="x86_64" epoch="0" version="1.17" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-NDBM_File-1.17-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">87a01482c3942b0b1b0ae90f3bb263afb2b2971ec1be2382f43bac9ce83403fc</sum>
        </package>
        <package name="perl-Net" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Net-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">589d4504637d13e2435420455917884df8727581aa80fae5b51020650ac8169f</sum>
        </package>
        <package name="perl-NEXT" arch="noarch" epoch="0" version="0.69" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-NEXT-0.69-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">6cf667a4e215805092c31399b07088b9b53ac30571429737c26ff5633c93f107</sum>
        </package>
        <package name="perl-ODBM_File" arch="x86_64" epoch="0" version="1.18" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ODBM_File-1.18-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5fb3da69617cfaaa0b7e0ef657628c0bfdecf784cc3d47dd4037b77cd0696234</sum>
        </package>
        <package name="perl-Opcode" arch="x86_64" epoch="0" version="1.65" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Opcode-1.65-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">107e99a01aa17849e6803029c1c31ebe52d5c9cbc99d8cdb79a1e3b524b9efbd</sum>
        </package>
        <package name="perl-open" arch="noarch" epoch="0" version="1.13" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-open-1.13-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e6faf552b3ef8663aa5c008bb0170bd1937c21b052e19b38338b17af0140a2fa</sum>
        </package>
        <package name="perl-overload" arch="noarch" epoch="0" version="1.37" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-overload-1.37-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">ef05e1e0a8d4186fd2b5fc8e9726345b0d14a30e4a7eb7a66943aa51c6032a4f</sum>
        </package>
        <package name="perl-overloading" arch="noarch" epoch="0" version="0.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-overloading-0.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">418913e1c6335e9aa8f039fa6903dbba59d713bc902191272692c655b2d8f63b</sum>
        </package>
        <package name="perl-ph" arch="x86_64" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ph-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e490da935a82dbbf49a8562d6e249e4a09a4afa8d599c33187bce006e3b97ee7</sum>
        </package>
        <package name="perl-Pod-Functions" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Pod-Functions-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">9544e913bae26609c973b6fac8ef231fa230e79b79966696f27dc6169b0cce16</sum>
        </package>
        <package name="perl-Pod-Html" arch="noarch" epoch="0" version="1.35" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Pod-Html-1.35-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">56640ad227c8fb21e7f72fde247757f01d905d585bea3ede000adc8db4072b87</sum>
        </package>
        <package name="perl-POSIX" arch="x86_64" epoch="0" version="2.20" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-POSIX-2.20-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7efa2d4b9ceaf5b2ebc83e68a5257bb49e2de587204fe878202d3e9d248297e8</sum>
        </package>
        <package name="perl-Safe" arch="noarch" epoch="0" version="2.46" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Safe-2.46-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d8b10fade999abb3271355112bd700b47920bc3556996606e99cc4ac445e682d</sum>
        </package>
        <package name="perl-Search-Dict" arch="noarch" epoch="0" version="1.07" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Search-Dict-1.07-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7a93698979506fa211d4570b90132e5368cc45829985baec494f877a38ec0061</sum>
        </package>
        <package name="perl-SelectSaver" arch="noarch" epoch="0" version="1.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-SelectSaver-1.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4971816006a6fd214274853c95c74c1e4af34acb2fa145d7c36d3533f115969d</sum>
        </package>
        <package name="perl-SelfLoader" arch="noarch" epoch="0" version="1.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-SelfLoader-1.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">15a01d37dcd6c51415b3d2eb973d5e64ffe93455587282661129f31e39a37164</sum>
        </package>
        <package name="perl-sigtrap" arch="noarch" epoch="0" version="1.10" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-sigtrap-1.10-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d322121627446cea0a0ce9a162ac1e5cbc3c21fed5454a614f9f3231bcd6e819</sum>
        </package>
        <package name="perl-sort" arch="noarch" epoch="0" version="2.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-sort-2.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">9a656d27009bec4a4203f84e041407805e48189799413db9637a51d307666867</sum>
        </package>
        <package name="perl-subs" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-subs-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">6f51e398f25184efd9fa656c36b32f4a66b84db33473a0084c09d2564b1fa173</sum>
        </package>
        <package name="perl-Symbol" arch="noarch" epoch="0" version="1.09" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Symbol-1.09-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e44ddbdba11f7108309e1e8268ded90b30b45d4559d329b7598c194491e65cb7</sum>
        </package>
        <package name="perl-Sys-Hostname" arch="x86_64" epoch="0" version="1.25" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Sys-Hostname-1.25-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c80b6bc8643d134daf7dffbbdabe21e8083c5bdd95009d04015d8410f84c4ca9</sum>
        </package>
        <package name="perl-Term-Complete" arch="noarch" epoch="0" version="1.403" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Term-Complete-1.403-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bca25218698dc5bec307ab2833f95c80979801a3a50bde8578e87f5b0a9e9c6e</sum>
        </package>
        <package name="perl-Term-ReadLine" arch="noarch" epoch="0" version="1.17" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Term-ReadLine-1.17-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">eacdcb68a50137a0b436f0c843963dd397f6a08953c66383e62b6cc416203cf0</sum>
        </package>
        <package name="perl-Test" arch="noarch" epoch="0" version="1.31" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Test-1.31-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7e9be4015583373451563d4ec380e02dd4acceb46311be07128844cee2bd3c99</sum>
        </package>
        <package name="perl-Text-Abbrev" arch="noarch" epoch="0" version="1.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Text-Abbrev-1.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">25b62a751bb2a0357cfcf9b4a9e159bbacbefd6cfe0748265e62219dc9683586</sum>
        </package>
        <package name="perl-Thread" arch="noarch" epoch="0" version="3.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Thread-3.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">491d0f80e3d887e45c217e46256d581c90fb3cb07830cc546e2a6f5691b629f6</sum>
        </package>
        <package name="perl-Thread-Semaphore" arch="noarch" epoch="0" version="2.13" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Thread-Semaphore-2.13-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">638204720d76bfff46b4232b6bac608876be8f587b9c7f3d1009e3dedf806dcb</sum>
        </package>
        <package name="perl-Tie" arch="noarch" epoch="0" version="4.6" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Tie-4.6-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">5c0753c9b84119f97ee29a79a6f85d2b9b8e7b43e7ccceff30076e592529fb4e</sum>
        </package>
        <package name="perl-Tie-File" arch="noarch" epoch="0" version="1.09" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Tie-File-1.09-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">979470cf5a306f3c4dea61028b98b449ca8befcfe02987ef6e147c7321f6d3fa</sum>
        </package>
        <package name="perl-Tie-Memoize" arch="noarch" epoch="0" version="1.1" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Tie-Memoize-1.1-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">caab07ab606928b27eff25c56d245649147171e90b94c8f4ebc6168c2c04d1a6</sum>
        </package>
        <package name="perl-Time" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Time-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">9f0208c626290f1e4e435ec425e901cb8c2db44c8e1caa64fc244a9172006d4f</sum>
        </package>
        <package name="perl-Time-Piece" arch="x86_64" epoch="0" version="1.3401" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Time-Piece-1.3401-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9eff6fada2e6a517941b7527afbe3cb5532c66b8a87396a9a2d42f929e404de9</sum>
        </package>
        <package name="perl-Unicode-UCD" arch="noarch" epoch="0" version="0.78" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Unicode-UCD-0.78-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">8127dfa5d5006949b78316bea4cd438b83f616dbb2c9160dee0d3c88dd354d8e</sum>
        </package>
        <package name="perl-User-pwent" arch="noarch" epoch="0" version="1.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-User-pwent-1.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">61be0c87a8ef400af759697ab882a54dc62018958aa86f3a3f6a2bac93666b68</sum>
        </package>
        <package name="perl-utils" arch="noarch" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-utils-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">c89e6e8052e14ed8e1c2d3c9c09ef67d1f90be7705d624293c916ee926fd4ae8</sum>
        </package>
        <package name="perl-vars" arch="noarch" epoch="0" version="1.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-vars-1.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">877c2bdd38a85c3510e06a9a271b5badc4b80c917109f39f65f3ca4796eca380</sum>
        </package>
        <package name="perl-vmsish" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-vmsish-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b2e68ff6ffa4970afdeff6e1d9988decbf7cabe45d08dabee3d6b41284f869d7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12064</id>
    <title>Important: unbound security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:12064 (https://access.redhat.com/errata/RHSA-2025:12064), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: Unbound Cache poisoning (CVE-2025-5994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5994" id="CVE-2025-5994" type="cve" title="CVE-2025-5994" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380949" id="2380949" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12064" id="RLSA-2025:12064" type="self" title="RLSA-2025:12064" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:12064" id="RHSA-2025:12064" type="vendor" title="Red Hat RHSA-2025:12064" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-unbound" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>python3-unbound-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3f1d7b1511a92a60cbbf5fb6bdc27feb1b86ec07d133c5c7ee971a9d2e2fc502</sum>
        </package>
        <package name="unbound" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8b6bfb2ad1af3f2986123b4f930110abff31d56c3cacd7923d4dbc59f754bd8e</sum>
        </package>
        <package name="unbound-anchor" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-anchor-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bef18b9a20c9eaa3dafc398b2824fbc51fdb104fdd8dfa29846326fd90e7072e</sum>
        </package>
        <package name="unbound-dracut" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-dracut-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">447203d5e534856a98c91d8d2c9f72e69ae17ecc0b3202fa1dcd4fb63c3743d2</sum>
        </package>
        <package name="unbound-libs" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-libs-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">fa5d9ac0e91388efaf14e083a357d85380e23bd4d75fdb678876ec11263019bf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12188</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:12188 (https://access.redhat.com/errata/RHSA-2025:12188), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

* firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

* firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

* firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

* firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

* firefox: Memory safety bugs (CVE-2025-8034)

* firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

* firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

* firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8027" id="CVE-2025-8027" type="cve" title="CVE-2025-8027" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8028" id="CVE-2025-8028" type="cve" title="CVE-2025-8028" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8029" id="CVE-2025-8029" type="cve" title="CVE-2025-8029" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8030" id="CVE-2025-8030" type="cve" title="CVE-2025-8030" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8031" id="CVE-2025-8031" type="cve" title="CVE-2025-8031" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8032" id="CVE-2025-8032" type="cve" title="CVE-2025-8032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8033" id="CVE-2025-8033" type="cve" title="CVE-2025-8033" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8034" id="CVE-2025-8034" type="cve" title="CVE-2025-8034" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8035" id="CVE-2025-8035" type="cve" title="CVE-2025-8035" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382701" id="2382701" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382703" id="2382703" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382704" id="2382704" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382707" id="2382707" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382710" id="2382710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382711" id="2382711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382717" id="2382717" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382718" id="2382718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382720" id="2382720" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12188" id="RLSA-2025:12188" type="self" title="RLSA-2025:12188" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:12188" id="RHSA-2025:12188" type="vendor" title="Red Hat RHSA-2025:12188" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.13.0" release="3.el10_0" src="thunderbird-128.13.0-3.el10_0.src.rpm">
          <filename>thunderbird-128.13.0-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">30a11093106c28a6ca4020c2bfdfca6cc81a2a7145fe070a6a25240adb93b1a5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12850</id>
    <title>Moderate: opentelemetry-collector security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:12850 (https://access.redhat.com/errata/RHSA-2025:12850), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12850" id="RLSA-2025:12850" type="self" title="RLSA-2025:12850" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:12850" id="RHSA-2025:12850" type="vendor" title="Red Hat RHSA-2025:12850" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.127.0" release="1.el10_0" src="opentelemetry-collector-0.127.0-1.el10_0.src.rpm">
          <filename>opentelemetry-collector-0.127.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2940b974c271bfea1804c3c4dbdbcb0d527235f3ad13b392c9309a310d01c8a3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12862</id>
    <title>Moderate: gdk-pixbuf2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:12862 (https://access.redhat.com/errata/RHSA-2025:12862), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gdk-pixbuf2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.

Security Fix(es):

* gdk?pixbuf: Heap?buffer?overflow in gdk?pixbuf (CVE-2025-7345)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7345" id="CVE-2025-7345" type="cve" title="CVE-2025-7345" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2377063" id="2377063" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12862" id="RLSA-2025:12862" type="self" title="RLSA-2025:12862" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:12862" id="RHSA-2025:12862" type="vendor" title="Red Hat RHSA-2025:12862" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gdk-pixbuf2" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_0" src="gdk-pixbuf2-2.42.12-4.el10_0.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">66f9a4dc144d229ffa2350e27492e26ed49a41df8b0f54fea62831b9b1ecd2ad</sum>
        </package>
        <package name="gdk-pixbuf2-devel" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_0" src="gdk-pixbuf2-2.42.12-4.el10_0.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d28d66b9305cb75791d81479126e06fcd9cef8dccdb21030df0da970051d7655</sum>
        </package>
        <package name="gdk-pixbuf2-modules" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_0" src="gdk-pixbuf2-2.42.12-4.el10_0.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">954d41c9ee099e28b99b2c821bf03882acd2f44fca29125a20cef2b3700f387e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:13674</id>
    <title>Important: toolbox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:13674 (https://access.redhat.com/errata/RHSA-2025:13674), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for toolbox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

* nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit (CVE-2025-23266)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23266" id="CVE-2025-23266" type="cve" title="CVE-2025-23266" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2381794" id="2381794" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:13674" id="RLSA-2025:13674" type="self" title="RLSA-2025:13674" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:13674" id="RHSA-2025:13674" type="vendor" title="Red Hat RHSA-2025:13674" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="toolbox" arch="x86_64" epoch="0" version="0.2" release="1.el10_0" src="toolbox-0.2-1.el10_0.src.rpm">
          <filename>toolbox-0.2-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8c91f2f041be1a66ed8e4ef273f2b475d7f19c5e2c3310a4d57e6ecfe4341920</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:13941</id>
    <title>Important: golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:13941 (https://access.redhat.com/errata/RHSA-2025:13941), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4674" id="CVE-2025-4674" type="cve" title="CVE-2025-4674" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2384329" id="2384329" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:13941" id="RLSA-2025:13941" type="self" title="RLSA-2025:13941" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:13941" id="RHSA-2025:13941" type="vendor" title="Red Hat RHSA-2025:13941" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang" arch="x86_64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-1.24.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4773689eb73f17d4dfc979a97cf6f866e9c421587e9e450718119c21d368ea7d</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-bin-1.24.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0755f0d4bf4c83bea230a5236c327a42d1fa55261b14c0ace6a6c68d6e85b75a</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-docs-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c8015b335c5881328c5e1ea21aab8e9487e278ded209f83b111b0a870925aea1</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-misc-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9d833125417d6f49f9dc2a9c19bf9454ea27c78b6d319168faff5c6491b640b7</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-race-1.24.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">21d2f7850eb3272690e57cd6e3675fbe62973228227ec905c3e03a8060f3385e</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-src-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">aace02df66e63925e08917bd1704188ea6726490a414e5f5f1f5b9b0ff6051c9</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-tests-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e7152f56606fe5f068a38d2d2e40d491f9670cc56cb216e7c1d8fc558ffd4491</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>go-toolset-1.24.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a9c32946212048fb0933b6f4b254ba7021fdc56804b34aa806b13da9df58f2f3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:13944</id>
    <title>Important: openjpeg2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:13944 (https://access.redhat.com/errata/RHSA-2025:13944), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openjpeg2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.

Security Fix(es):

* openjpeg: OpenJPEG OOB heap memory write (CVE-2025-54874)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54874" id="CVE-2025-54874" type="cve" title="CVE-2025-54874" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2386543" id="2386543" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:13944" id="RLSA-2025:13944" type="self" title="RLSA-2025:13944" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:13944" id="RHSA-2025:13944" type="vendor" title="Red Hat RHSA-2025:13944" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="openjpeg2" arch="x86_64" epoch="0" version="2.5.2" release="4.el10_0.1" src="openjpeg2-2.5.2-4.el10_0.1.src.rpm">
          <filename>openjpeg2-2.5.2-4.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">661a071484cf048ff8d3fd27790cf566fc417093f8820e61124a3cf8eb638260</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14178</id>
    <title>Important: tomcat9 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:14178 (https://access.redhat.com/errata/RHSA-2025:14178), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

* tomcat: Apache Tomcat denial of service (CVE-2025-52520)

* tomcat: Apache Tomcat denial of service (CVE-2025-52434)

* tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48976" id="CVE-2025-48976" type="cve" title="CVE-2025-48976" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48988" id="CVE-2025-48988" type="cve" title="CVE-2025-48988" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989" id="CVE-2025-48989" type="cve" title="CVE-2025-48989" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49125" id="CVE-2025-49125" type="cve" title="CVE-2025-49125" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52434" id="CVE-2025-52434" type="cve" title="CVE-2025-52434" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52520" id="CVE-2025-52520" type="cve" title="CVE-2025-52520" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506" id="CVE-2025-53506" type="cve" title="CVE-2025-53506" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373015" id="2373015" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373018" id="2373018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373020" id="2373020" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373309" id="2373309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379374" id="2379374" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379382" id="2379382" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379386" id="2379386" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14178" id="RLSA-2025:14178" type="self" title="RLSA-2025:14178" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:14178" id="RHSA-2025:14178" type="vendor" title="Red Hat RHSA-2025:14178" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">74e2a6fbef93fe6dada5062baa99ea2ae81539c66150c379e326ceff3d5f00ae</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">d5991ed5ea05046e1b9ded1ee71728137bf6cd5265e7a85fd43cc234b4a63cf1</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">27e9f00f4b4db5a618c88766816ea04e334e413b81d6df87309f92e797f2af01</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">661c5eb96bedd37e4dd1988be1912a09dfb4246df01619be0a95decb6a739a0a</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">d564b100d3af37696d23407cbec19f38dc10d5f263bc6463526307f297f9e751</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-lib-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">56221df788f2fd94b729cbc24645ef14577c2a60e21394c4ccebbe3c466e437a</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">197343759673b4df77e1cd4b653ff18640c1145a111abcf65f293bdf2cd640b3</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-webapps-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">a92fb0bc741de5bed29ded39ffc1090c13d44d8e4663ed876455b9ec62dc79f0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14179</id>
    <title>Important: tomcat security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:14179 (https://access.redhat.com/errata/RHSA-2025:14179), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

* tomcat: Apache Tomcat denial of service (CVE-2025-52520)

* tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48976" id="CVE-2025-48976" type="cve" title="CVE-2025-48976" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48988" id="CVE-2025-48988" type="cve" title="CVE-2025-48988" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989" id="CVE-2025-48989" type="cve" title="CVE-2025-48989" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49125" id="CVE-2025-49125" type="cve" title="CVE-2025-49125" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52520" id="CVE-2025-52520" type="cve" title="CVE-2025-52520" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506" id="CVE-2025-53506" type="cve" title="CVE-2025-53506" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373015" id="2373015" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373018" id="2373018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373020" id="2373020" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373309" id="2373309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379374" id="2379374" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379386" id="2379386" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14179" id="RLSA-2025:14179" type="self" title="RLSA-2025:14179" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:14179" id="RHSA-2025:14179" type="vendor" title="Red Hat RHSA-2025:14179" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">ecb917e318806b30780490e980d3321c09c3a9d0a55191e03a6e6aa155bb2f9b</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-admin-webapps-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">a170a83d4db067f3716cc75b312457ae573a69b8abc08e35bf067456dd8d6556</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-docs-webapp-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">afc999a8b23e6e5bcd6fa3cb5dd0cec0c53b7092bdb3c8f5763ba7523102d44c</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">d74a96e6451c0457caf006ecf5cb3f9c05a335f5155526ff7e43ea76d96de5ec</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">40f0d2b7943d8439b32a461f3b324e8add8d7a2eb2989ca4c685b0a4ff0806bd</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-lib-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">ae430958b25c1ff702c75b963827c5cd5c79c9d0e1b7cc97c10a86e80c3e2625</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">eafac0514a1c171b579247cb0bd32de6b9e6446344213797e664d21eb1f5ee3f</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-webapps-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">b7378649e8898b6bbbbaaf8633261fdfb57139d41c243d6269728b2a2ecaf834</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14417</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:14417 (https://access.redhat.com/errata/RHSA-2025:14417), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182)

* thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179)

* thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180)

* thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9179" id="CVE-2025-9179" type="cve" title="CVE-2025-9179" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9180" id="CVE-2025-9180" type="cve" title="CVE-2025-9180" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9181" id="CVE-2025-9181" type="cve" title="CVE-2025-9181" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9182" id="CVE-2025-9182" type="cve" title="CVE-2025-9182" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9185" id="CVE-2025-9185" type="cve" title="CVE-2025-9185" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389575" id="2389575" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389580" id="2389580" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389581" id="2389581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389583" id="2389583" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389584" id="2389584" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14417" id="RLSA-2025:14417" type="self" title="RLSA-2025:14417" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:14417" id="RHSA-2025:14417" type="vendor" title="Red Hat RHSA-2025:14417" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.14.0" release="2.el10_0" src="firefox-128.14.0-2.el10_0.src.rpm">
          <filename>firefox-128.14.0-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b97a2317f96b8feef7e492b4cb4ffbbb9782cce5c616b012d86aa3e66abf498e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14592</id>
    <title>Important: aide security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:14592 (https://access.redhat.com/errata/RHSA-2025:14592), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for aide.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the system, and then uses that database to ensure file integrity and detect system intrusions.

Security Fix(es):

* aide: improper output neutralization enables bypassing (CVE-2025-54389)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54389" id="CVE-2025-54389" type="cve" title="CVE-2025-54389" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388019" id="2388019" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14592" id="RLSA-2025:14592" type="self" title="RLSA-2025:14592" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:14592" id="RHSA-2025:14592" type="vendor" title="Red Hat RHSA-2025:14592" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aide" arch="x86_64" epoch="0" version="0.18.6" release="8.el10_0.2" src="aide-0.18.6-8.el10_0.2.src.rpm">
          <filename>aide-0.18.6-8.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">300101ceefc672071558b57905fdb3c5a96576f3cbe095bf288ced153e54045d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14625</id>
    <title>Moderate: mod_http2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:14625 (https://access.redhat.com/errata/RHSA-2025:14625), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_http2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module (CVE-2025-49630)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49630" id="CVE-2025-49630" type="cve" title="CVE-2025-49630" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374578" id="2374578" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14625" id="RLSA-2025:14625" type="self" title="RLSA-2025:14625" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:14625" id="RHSA-2025:14625" type="vendor" title="Red Hat RHSA-2025:14625" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_http2" arch="x86_64" epoch="0" version="2.0.29" release="2.el10_0.1" src="mod_http2-2.0.29-2.el10_0.1.src.rpm">
          <filename>mod_http2-2.0.29-2.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">d1884648d02e52f78744980b0854319fdb9cc81785ecc0adc9539a034921e3ee</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14826</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:14826 (https://access.redhat.com/errata/RHSA-2025:14826), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715)

* postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8714" id="CVE-2025-8714" type="cve" title="CVE-2025-8714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8715" id="CVE-2025-8715" type="cve" title="CVE-2025-8715" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388551" id="2388551" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388553" id="2388553" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14826" id="RLSA-2025:14826" type="self" title="RLSA-2025:14826" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:14826" id="RHSA-2025:14826" type="vendor" title="Red Hat RHSA-2025:14826" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postgresql" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8cd80777b34c819cc7e4bc10b19d6d9ffbaed6ccdc1432f57acc67aa7b8dd396</sum>
        </package>
        <package name="postgresql-contrib" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-contrib-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">38364941fbc18245b63ddf2b13994fa782ba5024bace018f14f078f99d9d635e</sum>
        </package>
        <package name="postgresql-docs" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-docs-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9719920fa164c4907a97074fb5ac02709e7a8d619bc3af175882d865eafd5f25</sum>
        </package>
        <package name="postgresql-plperl" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-plperl-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0afb3c1c78b173ed3e796c79329c5274154b2a89078baf31ce09a2cda93f2e22</sum>
        </package>
        <package name="postgresql-plpython3" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-plpython3-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0960eb82e13777663b28b7d70cf3c723774829f888a095081d9442b8519f38f4</sum>
        </package>
        <package name="postgresql-pltcl" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-pltcl-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0396a671dbcec458076cae4d8a8a9cfb7b0d0ce3ed754376962614520cd65303</sum>
        </package>
        <package name="postgresql-private-devel" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-private-devel-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2f7b20cc8990ad2ccac0a23796109cdd66728729a79d650d5ec7aac5330b50d2</sum>
        </package>
        <package name="postgresql-private-libs" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-private-libs-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a4ceb637a258938880c10f69443db1ff9f15fef0444f2ef5158bc4d4a0218e8d</sum>
        </package>
        <package name="postgresql-server" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-server-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3228acafccd043fa04f2b22bb2c6a61db6f1b76e43f461f1798abf3f92ee06e2</sum>
        </package>
        <package name="postgresql-server-devel" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-server-devel-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7d84eb6ea1f6f578bfa5dbd1c42f3fc1447664b4896607bc3ca31d735ebc9363</sum>
        </package>
        <package name="postgresql-static" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-static-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1ac5a23e23a31d13be65a39f326d09fde91054f5554d5542575b49cbff5ee1f0</sum>
        </package>
        <package name="postgresql-test" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-test-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">606e819a9f03a218208da7ff34fe8a153c44eeedd1232465ff93e7fcdb717708</sum>
        </package>
        <package name="postgresql-upgrade" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-upgrade-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0b64a4ea83374fe2b3503613d0542c450a2f1d2a2524ab7b638aa5ac45a81734</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-upgrade-devel-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">669a11b5116fdef6d3304ed23e66b88ab1750688ec45c0b9e81b9493c147f37d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14844</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:14844 (https://access.redhat.com/errata/RHSA-2025:14844), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182)

* thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179)

* thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180)

* thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9179" id="CVE-2025-9179" type="cve" title="CVE-2025-9179" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9180" id="CVE-2025-9180" type="cve" title="CVE-2025-9180" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9181" id="CVE-2025-9181" type="cve" title="CVE-2025-9181" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9182" id="CVE-2025-9182" type="cve" title="CVE-2025-9182" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9185" id="CVE-2025-9185" type="cve" title="CVE-2025-9185" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389575" id="2389575" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389580" id="2389580" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389581" id="2389581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389583" id="2389583" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389584" id="2389584" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14844" id="RLSA-2025:14844" type="self" title="RLSA-2025:14844" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:14844" id="RHSA-2025:14844" type="vendor" title="Red Hat RHSA-2025:14844" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.14.0" release="3.el10_0" src="thunderbird-128.14.0-3.el10_0.src.rpm">
          <filename>thunderbird-128.14.0-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">134e70204196593438adfcb520cc121b4d9e16e69f6b6cb936e7c06f51bf0b33</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15020</id>
    <title>Important: udisks2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:15020 (https://access.redhat.com/errata/RHSA-2025:15020), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for udisks2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.

Security Fix(es):

* udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8067" id="CVE-2025-8067" type="cve" title="CVE-2025-8067" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388623" id="2388623" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15020" id="RLSA-2025:15020" type="self" title="RLSA-2025:15020" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:15020" id="RHSA-2025:15020" type="vendor" title="Red Hat RHSA-2025:15020" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libudisks2" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>libudisks2-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">40eb9968d41395f4ab6a90b3c9eda76224286c55746be2c0e062a35bc76a8555</sum>
        </package>
        <package name="udisks2" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">80ff25c3775358e4d7c4e56c5c53110bac64a7b5ecd378e5c20dbb3b36358a12</sum>
        </package>
        <package name="udisks2-iscsi" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-iscsi-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">cc8c2a8d5c5accfa7602c900d3c24a54a1cdbc2b13e9f5d3f7db736c111655df</sum>
        </package>
        <package name="udisks2-lsm" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-lsm-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">579dd9b6478a9fda3ed9634977576798c0417a7c5240cf5dd74da8b4ac3f6133</sum>
        </package>
        <package name="udisks2-lvm2" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-lvm2-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">42b05cc7cbde4ffb55c2e385dda6f6c0ac99711aa89c753da90123d80a83e339</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15095</id>
    <title>Moderate: httpd security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:15095 (https://access.redhat.com/errata/RHSA-2025:15095), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252)

* httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption (CVE-2025-23048)

* httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47252" id="CVE-2024-47252" type="cve" title="CVE-2024-47252" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23048" id="CVE-2025-23048" type="cve" title="CVE-2025-23048" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49812" id="CVE-2025-49812" type="cve" title="CVE-2025-49812" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374571" id="2374571" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374576" id="2374576" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374580" id="2374580" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15095" id="RLSA-2025:15095" type="self" title="RLSA-2025:15095" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:15095" id="RHSA-2025:15095" type="vendor" title="Red Hat RHSA-2025:15095" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="httpd" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">39ca4a5d5c294d34d01c023a4b910afc40c33021d06da156f0caa6550ce3b110</sum>
        </package>
        <package name="httpd-core" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-core-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">d7d9671ab8d83e12f24f6dc0a4f56359b97b7f41f13bc27ce4ee3fa6a7e76658</sum>
        </package>
        <package name="httpd-devel" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-devel-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">ecc7fb15fb30551214e2903835b6cf18082d7b513634f35bf0b6b4405b881578</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-filesystem-2.4.63-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">5be7b3a8027ace91358c2f798e53f4dcc46b2e434314f8c1cca16d3d37b96673</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-manual-2.4.63-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">f55510c6628918f1cb42924ddff3203f84c000b1cd1e4db33205dc9ed5d67887</sum>
        </package>
        <package name="httpd-tools" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-tools-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">554e7a94a09e954d418849aa0e45d8df9321a0290415f981838c7a1ebd0989bc</sum>
        </package>
        <package name="mod_ldap" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_ldap-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">34034827fab21af66821cda08bb43f1e4ea58f89d4c831c2506cbc612705ed5d</sum>
        </package>
        <package name="mod_lua" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_lua-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">1b98d4a377dd657733e01534beda2d6c3a5e8eacdf86c79753dd72e9bf787d3a</sum>
        </package>
        <package name="mod_proxy_html" arch="x86_64" epoch="1" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_proxy_html-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">51df5b13d065599821869e580bfa170a9ff8ea6bbeee015bf5079d9c4694cec3</sum>
        </package>
        <package name="mod_session" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_session-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">27967d4859b4993756634ff9cbb356d525f3730ef8cde12008a69689c6e7dbe4</sum>
        </package>
        <package name="mod_ssl" arch="x86_64" epoch="1" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_ssl-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">ca37c31b3af38af84a1f1f770d592bbf09713d197046738b794b13c8d136eea8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15699</id>
    <title>Moderate: mysql-selinux and mysql8.4 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:15699 (https://access.redhat.com/errata/RHSA-2025:15699), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4, mysql-selinux.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)

* mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)

* mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)

* mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)

* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)

* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)

* mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)

* mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)

* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)

* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)

* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)

* mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)

* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)

* mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)

* curl: libcurl: WebSocket endless loop (CVE-2025-5399)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)

* mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)

* mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)

* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)

* mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)

* mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)

* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)

* mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)

* mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100)

* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094)

* mysql: Optimizer  unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13176" id="CVE-2024-13176" type="cve" title="CVE-2024-13176" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21574" id="CVE-2025-21574" type="cve" title="CVE-2025-21574" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21575" id="CVE-2025-21575" type="cve" title="CVE-2025-21575" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21577" id="CVE-2025-21577" type="cve" title="CVE-2025-21577" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21579" id="CVE-2025-21579" type="cve" title="CVE-2025-21579" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21580" id="CVE-2025-21580" type="cve" title="CVE-2025-21580" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21581" id="CVE-2025-21581" type="cve" title="CVE-2025-21581" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21584" id="CVE-2025-21584" type="cve" title="CVE-2025-21584" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21585" id="CVE-2025-21585" type="cve" title="CVE-2025-21585" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21588" id="CVE-2025-21588" type="cve" title="CVE-2025-21588" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30681" id="CVE-2025-30681" type="cve" title="CVE-2025-30681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30682" id="CVE-2025-30682" type="cve" title="CVE-2025-30682" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30683" id="CVE-2025-30683" type="cve" title="CVE-2025-30683" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30684" id="CVE-2025-30684" type="cve" title="CVE-2025-30684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30685" id="CVE-2025-30685" type="cve" title="CVE-2025-30685" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30687" id="CVE-2025-30687" type="cve" title="CVE-2025-30687" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30688" id="CVE-2025-30688" type="cve" title="CVE-2025-30688" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30689" id="CVE-2025-30689" type="cve" title="CVE-2025-30689" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693" id="CVE-2025-30693" type="cve" title="CVE-2025-30693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30695" id="CVE-2025-30695" type="cve" title="CVE-2025-30695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30696" id="CVE-2025-30696" type="cve" title="CVE-2025-30696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30699" id="CVE-2025-30699" type="cve" title="CVE-2025-30699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30703" id="CVE-2025-30703" type="cve" title="CVE-2025-30703" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30704" id="CVE-2025-30704" type="cve" title="CVE-2025-30704" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30705" id="CVE-2025-30705" type="cve" title="CVE-2025-30705" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30715" id="CVE-2025-30715" type="cve" title="CVE-2025-30715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30721" id="CVE-2025-30721" type="cve" title="CVE-2025-30721" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722" id="CVE-2025-30722" type="cve" title="CVE-2025-30722" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50077" id="CVE-2025-50077" type="cve" title="CVE-2025-50077" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50078" id="CVE-2025-50078" type="cve" title="CVE-2025-50078" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50079" id="CVE-2025-50079" type="cve" title="CVE-2025-50079" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50080" id="CVE-2025-50080" type="cve" title="CVE-2025-50080" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50081" id="CVE-2025-50081" type="cve" title="CVE-2025-50081" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50082" id="CVE-2025-50082" type="cve" title="CVE-2025-50082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50083" id="CVE-2025-50083" type="cve" title="CVE-2025-50083" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50084" id="CVE-2025-50084" type="cve" title="CVE-2025-50084" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50085" id="CVE-2025-50085" type="cve" title="CVE-2025-50085" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50086" id="CVE-2025-50086" type="cve" title="CVE-2025-50086" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50087" id="CVE-2025-50087" type="cve" title="CVE-2025-50087" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50088" id="CVE-2025-50088" type="cve" title="CVE-2025-50088" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50091" id="CVE-2025-50091" type="cve" title="CVE-2025-50091" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50092" id="CVE-2025-50092" type="cve" title="CVE-2025-50092" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50093" id="CVE-2025-50093" type="cve" title="CVE-2025-50093" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50094" id="CVE-2025-50094" type="cve" title="CVE-2025-50094" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50096" id="CVE-2025-50096" type="cve" title="CVE-2025-50096" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50097" id="CVE-2025-50097" type="cve" title="CVE-2025-50097" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50098" id="CVE-2025-50098" type="cve" title="CVE-2025-50098" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50099" id="CVE-2025-50099" type="cve" title="CVE-2025-50099" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50100" id="CVE-2025-50100" type="cve" title="CVE-2025-50100" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50101" id="CVE-2025-50101" type="cve" title="CVE-2025-50101" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50102" id="CVE-2025-50102" type="cve" title="CVE-2025-50102" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50104" id="CVE-2025-50104" type="cve" title="CVE-2025-50104" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5399" id="CVE-2025-5399" type="cve" title="CVE-2025-5399" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2338999" id="2338999" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359885" id="2359885" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359888" id="2359888" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359892" id="2359892" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359894" id="2359894" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359895" id="2359895" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359899" id="2359899" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359900" id="2359900" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359902" id="2359902" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359903" id="2359903" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359911" id="2359911" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359918" id="2359918" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359920" id="2359920" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359924" id="2359924" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359928" id="2359928" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359930" id="2359930" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359932" id="2359932" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359934" id="2359934" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359938" id="2359938" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359940" id="2359940" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359943" id="2359943" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359944" id="2359944" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359945" id="2359945" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359947" id="2359947" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359950" id="2359950" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359963" id="2359963" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359964" id="2359964" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359972" id="2359972" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2370920" id="2370920" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380264" id="2380264" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380273" id="2380273" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380274" id="2380274" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380278" id="2380278" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380280" id="2380280" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380283" id="2380283" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380284" id="2380284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380290" id="2380290" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380291" id="2380291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380295" id="2380295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380298" id="2380298" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380306" id="2380306" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380308" id="2380308" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380309" id="2380309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380310" id="2380310" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380312" id="2380312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380313" id="2380313" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380320" id="2380320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380321" id="2380321" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380322" id="2380322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380326" id="2380326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380327" id="2380327" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380334" id="2380334" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380335" id="2380335" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15699" id="RLSA-2025:15699" type="self" title="RLSA-2025:15699" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:15699" id="RHSA-2025:15699" type="vendor" title="Red Hat RHSA-2025:15699" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mysql8.4" arch="x86_64" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-8.4.6-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9ab4f1b27cce2084ed507afd86531225d9894f5fa19471f3bc107d9f8720f303</sum>
        </package>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-common-8.4.6-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b00f64905687fb131a234fa7eb8cfbf01c82d55158e117d99ce6b0f8dfff877c</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-errmsg-8.4.6-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4e4119b62c7395860583065fc1a0792e5cf336b0e3820babc0b39cc7de6528f0</sum>
        </package>
        <package name="mysql8.4-libs" arch="x86_64" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-libs-8.4.6-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2e49268285cb97841baf89326dddb5842839c1ceef2f0a8acb4d28b934d2540a</sum>
        </package>
        <package name="mysql8.4-server" arch="x86_64" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-server-8.4.6-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2c4d73fc062ba4634dbf7d31a073d67ce222416ec72d114fc747c7e371e611b7</sum>
        </package>
        <package name="mysql-selinux" arch="noarch" epoch="0" version="1.0.14" release="1.el10_0" src="mysql-selinux-1.0.14-1.el10_0.src.rpm">
          <filename>mysql-selinux-1.0.14-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6e96fc73b86d1fcb2205efe0362501f06665351449502bf0ca4bd11e15c17025</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15901</id>
    <title>Important: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:15901 (https://access.redhat.com/errata/RHSA-2025:15901), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: Podman kube play command may overwrite host files (CVE-2025-9566)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9566" id="CVE-2025-9566" type="cve" title="CVE-2025-9566" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393152" id="2393152" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15901" id="RLSA-2025:15901" type="self" title="RLSA-2025:15901" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:15901" id="RHSA-2025:15901" type="vendor" title="Red Hat RHSA-2025:15901" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="6" version="5.4.0" release="13.el10_0" src="podman-5.4.0-13.el10_0.src.rpm">
          <filename>podman-5.4.0-13.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7d23f0629fb06750e84793a2525875cbd4af6d291d14b0de9558e2faac04e91b</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="13.el10_0" src="podman-5.4.0-13.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-13.el10_0.noarch.rpm</filename>
          <sum type="sha256">d244c5274a4dcfb729f6b4dbaa6d690299fe89c525f5c66f69555dfca5fe9963</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="6" version="5.4.0" release="13.el10_0" src="podman-5.4.0-13.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-13.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0ea8eb676c816bc60039e71c10f4f8bd94c93161cdca61b52d21c52254b74c2e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16109</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:16109 (https://access.redhat.com/errata/RHSA-2025:16109), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527)

* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532)

* firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528)

* firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537)

* firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536)

* firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10527" id="CVE-2025-10527" type="cve" title="CVE-2025-10527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10528" id="CVE-2025-10528" type="cve" title="CVE-2025-10528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10529" id="CVE-2025-10529" type="cve" title="CVE-2025-10529" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10532" id="CVE-2025-10532" type="cve" title="CVE-2025-10532" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10533" id="CVE-2025-10533" type="cve" title="CVE-2025-10533" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10536" id="CVE-2025-10536" type="cve" title="CVE-2025-10536" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10537" id="CVE-2025-10537" type="cve" title="CVE-2025-10537" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395745" id="2395745" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395754" id="2395754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395755" id="2395755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395756" id="2395756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395759" id="2395759" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395764" id="2395764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395766" id="2395766" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16109" id="RLSA-2025:16109" type="self" title="RLSA-2025:16109" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:16109" id="RHSA-2025:16109" type="vendor" title="Red Hat RHSA-2025:16109" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.3.0" release="1.el10_0" src="firefox-140.3.0-1.el10_0.src.rpm">
          <filename>firefox-140.3.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2345152d5d4165f4c5e39aea5b178b188c25f7ba240a8a485df5a0d0143448f5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16157</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:16157 (https://access.redhat.com/errata/RHSA-2025:16157), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527)

* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532)

* firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528)

* firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537)

* firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536)

* firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10527" id="CVE-2025-10527" type="cve" title="CVE-2025-10527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10528" id="CVE-2025-10528" type="cve" title="CVE-2025-10528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10529" id="CVE-2025-10529" type="cve" title="CVE-2025-10529" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10532" id="CVE-2025-10532" type="cve" title="CVE-2025-10532" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10533" id="CVE-2025-10533" type="cve" title="CVE-2025-10533" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10536" id="CVE-2025-10536" type="cve" title="CVE-2025-10536" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10537" id="CVE-2025-10537" type="cve" title="CVE-2025-10537" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395745" id="2395745" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395754" id="2395754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395755" id="2395755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395756" id="2395756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395759" id="2395759" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395764" id="2395764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395766" id="2395766" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16157" id="RLSA-2025:16157" type="self" title="RLSA-2025:16157" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:16157" id="RHSA-2025:16157" type="vendor" title="Red Hat RHSA-2025:16157" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.3.0" release="1.el10_0" src="thunderbird-140.3.0-1.el10_0.src.rpm">
          <filename>thunderbird-140.3.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a2f2ebef365786d8c0e92016e86ef41ec86f473eda609b9e7301be160c661282</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16432</id>
    <title>Moderate: opentelemetry-collector security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:16432 (https://access.redhat.com/errata/RHSA-2025:16432), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4673" id="CVE-2025-4673" type="cve" title="CVE-2025-4673" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373305" id="2373305" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16432" id="RLSA-2025:16432" type="self" title="RLSA-2025:16432" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:16432" id="RHSA-2025:16432" type="vendor" title="Red Hat RHSA-2025:16432" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.127.0" release="3.el10_0" src="opentelemetry-collector-0.127.0-3.el10_0.src.rpm">
          <filename>opentelemetry-collector-0.127.0-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0fa9ee24ea481ad6ad221feb3d4898453ec90b7f5c4cb474738130a9eee8d061</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16428</id>
    <title>Moderate: libtpms security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:16428 (https://access.redhat.com/errata/RHSA-2025:16428), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libtpms.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.

Security Fix(es):

* libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49133" id="CVE-2025-49133" type="cve" title="CVE-2025-49133" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2371585" id="2371585" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16428" id="RLSA-2025:16428" type="self" title="RLSA-2025:16428" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:16428" id="RHSA-2025:16428" type="vendor" title="Red Hat RHSA-2025:16428" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libtpms" arch="x86_64" epoch="0" version="0.9.6" release="11.el10_0" src="libtpms-0.9.6-11.el10_0.src.rpm">
          <filename>libtpms-0.9.6-11.el10_0.x86_64.rpm</filename>
          <sum type="sha256">12dd8cdfc9050211f18b483635b05acddb0e961ed09c239b7fb360177b474f04</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:17085</id>
    <title>Important: ipa security update</title>
    <issued date="2025-10-07 17:25:42" />
    <updated date="2025-10-21 08:10:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:17085 (https://access.redhat.com/errata/RHSA-2025:17085), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ipa.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7493" id="CVE-2025-7493" type="cve" title="CVE-2025-7493" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389448" id="2389448" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:17085" id="RLSA-2025:17085" type="self" title="RLSA-2025:17085" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:17085" id="RHSA-2025:17085" type="vendor" title="Red Hat RHSA-2025:17085" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipa-client" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">49ee0017fcf48ad4b4b979bd88dc102ff50abaa85745cdbb5b8e5f2a37314337</sum>
        </package>
        <package name="ipa-client-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-common-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">bf2ffd4b0910fc72cae5d3600870555b49c6996b5ffe3867900c2b05488185ab</sum>
        </package>
        <package name="ipa-client-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-encrypted-dns-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">7a882a3de30a47d94647cae3da069d3374604f3420605b5635042416997d791b</sum>
        </package>
        <package name="ipa-client-epn" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-epn-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">b159c4d993240f45185788c72de0db8e9f191e0d14574c0f16cc475fef1afd53</sum>
        </package>
        <package name="ipa-client-samba" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-samba-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">e3422ada3e8c03c971a39a068d691789067e37937753e9472a519661bbeac610</sum>
        </package>
        <package name="ipa-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-common-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">b669a87218c94c65720ded545b0be47d09d53823ffde3e44b2c800a7e960c40f</sum>
        </package>
        <package name="ipa-selinux" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-selinux-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">9fcc498fdbeb59c1f3666a1fb65744fd3309ea356e2daa95b5f488134c90fc85</sum>
        </package>
        <package name="ipa-selinux-luna" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-selinux-luna-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">027300560ce6195962457cfbd64af0060014a378f1c90bcfe1dac67ec716839e</sum>
        </package>
        <package name="ipa-selinux-nfast" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-selinux-nfast-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">b0ce410d8e96f7ac938714aedf2a6088ffc94cb80fd7d3f6e5dc92863e80eaa1</sum>
        </package>
        <package name="ipa-server" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">f358a5398743c5d1bfe17b88689ec50d9520654a9b2bf15de7b9b566334ee712</sum>
        </package>
        <package name="ipa-server-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-common-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">2d4629a5a13c49f35fa9ca50e3257dfec870ea8d687bf18bd9f9ec7b53fcf2d5</sum>
        </package>
        <package name="ipa-server-dns" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-dns-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">13cb1b4a2b64c0636a2902942e932bba7691219c1c0b1b6105ad6d4db00c6ba5</sum>
        </package>
        <package name="ipa-server-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-encrypted-dns-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">b1cf56d62f6c06b79c0ce5acf5ef946621280ca685b1dc2ff913ffb25e644e17</sum>
        </package>
        <package name="ipa-server-trust-ad" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-trust-ad-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">27fe5c87266f967780897c6b89d5589694297e266f97434ed25fcefcf572a23b</sum>
        </package>
        <package name="python3-ipaclient" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>python3-ipaclient-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">71d58a186df583d49049166b6469053fdca1b8f222122ce67b52f7da9a81e0ab</sum>
        </package>
        <package name="python3-ipalib" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>python3-ipalib-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">ed44dd38a1d5d1918c30602fbb7e80d254231254f0d053b82b347d34c0246e98</sum>
        </package>
        <package name="python3-ipaserver" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>python3-ipaserver-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">24f51609ea8226d2f14c8873ec839e2e8bcaa6c00297792a1f09bc4e1d53b650</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:17429</id>
    <title>Important: open-vm-tools security update</title>
    <issued date="2025-10-08 17:10:30" />
    <updated date="2025-10-22 08:11:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:17429 (https://access.redhat.com/errata/RHSA-2025:17429), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for open-vm-tools.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

* open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-41244" id="CVE-2025-41244" type="cve" title="CVE-2025-41244" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2397752" id="2397752" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:17429" id="RLSA-2025:17429" type="self" title="RLSA-2025:17429" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:17429" id="RHSA-2025:17429" type="vendor" title="Red Hat RHSA-2025:17429" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="open-vm-tools" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">5c5f72135c11113cab83ea67a2a34907abcdd69041994109446c400edc5554a7</sum>
        </package>
        <package name="open-vm-tools-desktop" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-desktop-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">f01f15633d0f3ddfa95e93d0354ddfecb81e1e774713a5071216789efbcb5b5d</sum>
        </package>
        <package name="open-vm-tools-salt-minion" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-salt-minion-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">016f1e9c9fc7f13accb0d34050e2c5334c4cea61a5ba70390ccfd161857671cf</sum>
        </package>
        <package name="open-vm-tools-sdmp" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-sdmp-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">2dcf190bf62602af9115e7416e6e53e9504cb5552b77df79a910026f9f219735</sum>
        </package>
        <package name="open-vm-tools-test" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-test-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">3323ea1e381ad7d2fdf9bf9465a15a956275ecb68be155700757e230d816f403</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18154</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:18154 (https://access.redhat.com/errata/RHSA-2025:18154), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* thunderbird: firefox: Memory safety bugs (CVE-2025-11714)

* thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709)

* thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710)

* thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708)

* thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715)

* thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11708" id="CVE-2025-11708" type="cve" title="CVE-2025-11708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11709" id="CVE-2025-11709" type="cve" title="CVE-2025-11709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11710" id="CVE-2025-11710" type="cve" title="CVE-2025-11710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11711" id="CVE-2025-11711" type="cve" title="CVE-2025-11711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11712" id="CVE-2025-11712" type="cve" title="CVE-2025-11712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11714" id="CVE-2025-11714" type="cve" title="CVE-2025-11714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11715" id="CVE-2025-11715" type="cve" title="CVE-2025-11715" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403763" id="2403763" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403765" id="2403765" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403768" id="2403768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403769" id="2403769" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403770" id="2403770" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403774" id="2403774" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403776" id="2403776" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18154" id="RLSA-2025:18154" type="self" title="RLSA-2025:18154" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:18154" id="RHSA-2025:18154" type="vendor" title="Red Hat RHSA-2025:18154" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.4.0" release="3.el10_0" src="firefox-140.4.0-3.el10_0.src.rpm">
          <filename>firefox-140.4.0-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d7f67161e82d8e9edc4bab53ba002435e4465cb2a7d65f9548e1efe6486a61c3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18152</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:18152 (https://access.redhat.com/errata/RHSA-2025:18152), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

* dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

* dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55247" id="CVE-2025-55247" type="cve" title="CVE-2025-55247" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55248" id="CVE-2025-55248" type="cve" title="CVE-2025-55248" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55315" id="CVE-2025-55315" type="cve" title="CVE-2025-55315" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403083" id="2403083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403085" id="2403085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403086" id="2403086" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18152" id="RLSA-2025:18152" type="self" title="RLSA-2025:18152" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:18152" id="RHSA-2025:18152" type="vendor" title="Red Hat RHSA-2025:18152" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2e82f54bfbdd0e374ca39625d9f0387ed3dd3f09a441918ffb05ae675e18cadc</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">69adaa9b4624ac5fa8bb9693b5321dceb8ad75048f207e05fe108443e0bbf07c</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">69c74d48b2183beddf9c9878e607f2b225237a0ac59467cde5d24fea2de000e2</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9f695335927966b53f765b11f613a0e938fc7533188793ce43a07f6fab9bf464</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">be3916302893eefe3721106b25b04e964bb984d7608d5385debba5231b55ff90</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5746efb1491a159a41fd8d17c1aacf06cf0440be1b10c5e0cea95f2f1fcc2543</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a3ac2b62b598c37c5a1f51fbd49b260dffad2b66389e03f8c81606fc29013810</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.121" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.121-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">72788d59dfac373b17648f9109934bea2ff1aee7cb7fd505eb32dd36d23ac88a</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.121" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.121-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f5be18d47c1c632079cc4de99d2823d47f0407cd95824e169747106fbf015884</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bd993cf686e92507546afa07fd10357dc86ba3ce62750926c867c3528346fdf1</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.121" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-templates-8.0-8.0.121-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">18024c7dd162f8b0dfff7bc8d2cedcba7472a290d93b2ea04cc2b977df3a7eb6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18153</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:18153 (https://access.redhat.com/errata/RHSA-2025:18153), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

* dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

* dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55247" id="CVE-2025-55247" type="cve" title="CVE-2025-55247" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55248" id="CVE-2025-55248" type="cve" title="CVE-2025-55248" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55315" id="CVE-2025-55315" type="cve" title="CVE-2025-55315" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403083" id="2403083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403085" id="2403085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403086" id="2403086" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18153" id="RLSA-2025:18153" type="self" title="RLSA-2025:18153" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:18153" id="RHSA-2025:18153" type="vendor" title="Red Hat RHSA-2025:18153" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ab807b363b42205f8c51a088b89e8f74b994c2bdc4aa4aec946fca95467c0e0c</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9493bfd217e561475b9811f6534f0cfb71f3a25039f9d3f98036b9af8715a666</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">eaeac8371d79bc8882c9e8fc4aa1eca32eb6a18cd015e626b1a34372d3b56534</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9560a19b5883491926bd48f082ad520357c14079e057bfafbcf49a92488c9054</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-host-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4bb72308bf7619934a1e1ea66edb7470b5c7f5843c0f2c35b1d9d4acc509f514</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">64cb647c7dbf5893cba5a963e8e2d9e666a8359a268a51d4bbcfa6e275d76712</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a20cad53d859ec9cda4208b8ad633dd0e9045652eb0c0bb577b2c08406652573</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f2ea5b6f8e54bde3d3c2bf77618d16677b12e1cd566f2f4c652997d03a5899ec</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a79b1e6681a45ad76310c2f96b73567bb81db035ef757ee44f873f93993822c6</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ce21cd3310ba29b77adafe6abd963e2ca961f6c157ab3b613d93914187f02145</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">10ca1eadcc761b9ad0b3c1a98e9b9f3d1a0046caa304c1b4e2960ecee6535dfe</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0132d02382947e042057929af2a4382f7fcf3d96b87ff49021143a978a079dc3</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-templates-9.0-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6b61d05e63dd665c7fc60b4f210f9ffdee5f48a5cf9c515929bbb2eb50955825</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">297b0880fd2dc98f17e49b4c76ac77571209b1b1615733dd58855dbb8da5c12f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18183</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:18183 (https://access.redhat.com/errata/RHSA-2025:18183), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11021" id="CVE-2025-11021" type="cve" title="CVE-2025-11021" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2399627" id="2399627" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18183" id="RLSA-2025:18183" type="self" title="RLSA-2025:18183" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:18183" id="RHSA-2025:18183" type="vendor" title="Red Hat RHSA-2025:18183" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.7" src="libsoup3-3.6.5-3.el10_0.7.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_0.7.x86_64.rpm</filename>
          <sum type="sha256">29426c9c87ea4e2708c33516a4c288239185bae22b2876c971a2a7bfac46e281</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.7" src="libsoup3-3.6.5-3.el10_0.7.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_0.7.x86_64.rpm</filename>
          <sum type="sha256">c2597dea8846c2114b810f78565fad3b4692262fc79788f7b8cfa998f9dcd787</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18320</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-26 08:08:08" />
    <updated date="2025-11-07 09:09:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:18320 (https://access.redhat.com/errata/RHSA-2025:18320), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: firefox: Memory safety bugs (CVE-2025-11714)

* thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709)

* thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710)

* thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708)

* thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715)

* thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11708" id="CVE-2025-11708" type="cve" title="CVE-2025-11708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11709" id="CVE-2025-11709" type="cve" title="CVE-2025-11709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11710" id="CVE-2025-11710" type="cve" title="CVE-2025-11710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11711" id="CVE-2025-11711" type="cve" title="CVE-2025-11711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11712" id="CVE-2025-11712" type="cve" title="CVE-2025-11712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11714" id="CVE-2025-11714" type="cve" title="CVE-2025-11714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11715" id="CVE-2025-11715" type="cve" title="CVE-2025-11715" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403763" id="2403763" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403765" id="2403765" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403768" id="2403768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403769" id="2403769" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403770" id="2403770" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403774" id="2403774" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403776" id="2403776" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18320" id="RLSA-2025:18320" type="self" title="RLSA-2025:18320" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:18320" id="RHSA-2025:18320" type="vendor" title="Red Hat RHSA-2025:18320" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.4.0" release="2.el10_0" src="thunderbird-140.4.0-2.el10_0.src.rpm">
          <filename>thunderbird-140.4.0-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7dfc5a0028b725d666103bdb33e5a5f6fcb3d26b07f1fc0c3ed8fa9662659ee1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19156</id>
    <title>Important: libtiff security update</title>
    <issued date="2025-11-02 09:08:07" />
    <updated date="2025-11-16 09:10:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:19156 (https://access.redhat.com/errata/RHSA-2025:19156), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: Libtiff Write-What-Where (CVE-2025-9900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9900" id="CVE-2025-9900" type="cve" title="CVE-2025-9900" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2392784" id="2392784" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19156" id="RLSA-2025:19156" type="self" title="RLSA-2025:19156" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:19156" id="RHSA-2025:19156" type="vendor" title="Red Hat RHSA-2025:19156" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libtiff" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_0.1" src="libtiff-4.6.0-6.el10_0.1.src.rpm">
          <filename>libtiff-4.6.0-6.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">b6502126ea37fbfdcd217370b2138adc1904d30961844e7d2420883a94cf52f1</sum>
        </package>
        <package name="libtiff-devel" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_0.1" src="libtiff-4.6.0-6.el10_0.1.src.rpm">
          <filename>libtiff-devel-4.6.0-6.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">defd29f8fb6923c842a94c9792338b4e1b7b6ec2e9807c5123f659eeeed69a73</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19435</id>
    <title>Moderate: xorg-x11-server-Xwayland security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:19435 (https://access.redhat.com/errata/RHSA-2025:19435), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

* xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

* xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62229" id="CVE-2025-62229" type="cve" title="CVE-2025-62229" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62230" id="CVE-2025-62230" type="cve" title="CVE-2025-62230" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62231" id="CVE-2025-62231" type="cve" title="CVE-2025-62231" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2402649" id="2402649" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2402653" id="2402653" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2402660" id="2402660" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19435" id="RLSA-2025:19435" type="self" title="RLSA-2025:19435" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:19435" id="RHSA-2025:19435" type="vendor" title="Red Hat RHSA-2025:19435" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="x86_64" epoch="0" version="24.1.5" release="5.el10_0" src="xorg-x11-server-Xwayland-24.1.5-5.el10_0.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-5.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f3d857dd337c37bb26ebe4de4632cd7cae2f4a22717d1237c684dadda1c64305</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19675</id>
    <title>Important: valkey security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:19675 (https://access.redhat.com/errata/RHSA-2025:19675), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

* Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

* Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

* Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46817" id="CVE-2025-46817" type="cve" title="CVE-2025-46817" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46818" id="CVE-2025-46818" type="cve" title="CVE-2025-46818" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46819" id="CVE-2025-46819" type="cve" title="CVE-2025-46819" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49844" id="CVE-2025-49844" type="cve" title="CVE-2025-49844" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401258" id="2401258" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401292" id="2401292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401322" id="2401322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401324" id="2401324" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19675" id="RLSA-2025:19675" type="self" title="RLSA-2025:19675" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:19675" id="RHSA-2025:19675" type="vendor" title="Red Hat RHSA-2025:19675" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.6" release="1.el10_0" src="valkey-8.0.6-1.el10_0.src.rpm">
          <filename>valkey-8.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">87317dbdd09dc9157f670ad5d99301daf796deecb4246d13c4b83b1781b78a0d</sum>
        </package>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.6" release="1.el10_0" src="valkey-8.0.6-1.el10_0.src.rpm">
          <filename>valkey-devel-8.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6757d283ae173a1293bfc7bc95cb5054c5cba4c975b7e1f1b0e77bc63e969e5e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19720</id>
    <title>Low: libsoup3 security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:19720 (https://access.redhat.com/errata/RHSA-2025:19720), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4945" id="CVE-2025-4945" type="cve" title="CVE-2025-4945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367175" id="2367175" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19720" id="RLSA-2025:19720" type="self" title="RLSA-2025:19720" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:19720" id="RHSA-2025:19720" type="vendor" title="Red Hat RHSA-2025:19720" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.9" src="libsoup3-3.6.5-3.el10_0.9.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_0.9.x86_64.rpm</filename>
          <sum type="sha256">0b48c29e6396e5c1920d4e760c541258ea0fd75bdb751a0afa2cdc49e2081258</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.9" src="libsoup3-3.6.5-3.el10_0.9.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_0.9.x86_64.rpm</filename>
          <sum type="sha256">ed1539e481b13dea848976c73fc22774eb43c40c493c2131414bae2e0987e7ef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19772</id>
    <title>Important: qt6-qtsvg security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:19772 (https://access.redhat.com/errata/RHSA-2025:19772), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for qt6-qtsvg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

Security Fix(es):

* qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10729" id="CVE-2025-10729" type="cve" title="CVE-2025-10729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401241" id="2401241" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19772" id="RLSA-2025:19772" type="self" title="RLSA-2025:19772" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:19772" id="RHSA-2025:19772" type="vendor" title="Red Hat RHSA-2025:19772" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtsvg" arch="x86_64" epoch="0" version="6.8.1" release="1.el10_0.1" src="qt6-qtsvg-6.8.1-1.el10_0.1.src.rpm">
          <filename>qt6-qtsvg-6.8.1-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">8d3d25ffd7e7d0f318ba0a15a2308185ff33e0c1ee997214474f9d7a9e0c921f</sum>
        </package>
        <package name="qt6-qtsvg-devel" arch="x86_64" epoch="0" version="6.8.1" release="1.el10_0.1" src="qt6-qtsvg-6.8.1-1.el10_0.1.src.rpm">
          <filename>qt6-qtsvg-devel-6.8.1-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">9f824c3fd4a44263d403ebbaf6a0b8e0088dd89259d1912950c5df0090482ecf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:20478</id>
    <title>Moderate: zziplib security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:20478 (https://access.redhat.com/errata/RHSA-2025:20478), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for zziplib.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The zziplib is a lightweight library to easily extract data from zip files.

Security Fix(es):

* zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17828" id="CVE-2018-17828" type="cve" title="CVE-2018-17828" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1635888" id="1635888" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:20478" id="RLSA-2025:20478" type="self" title="RLSA-2025:20478" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:20478" id="RHSA-2025:20478" type="vendor" title="Red Hat RHSA-2025:20478" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="zziplib" arch="x86_64" epoch="0" version="0.13.78" release="2.el10" src="zziplib-0.13.78-2.el10.src.rpm">
          <filename>zziplib-0.13.78-2.el10.x86_64.rpm</filename>
          <sum type="sha256">79fa105b4ddcd385d8ce3af8fd2a762ec250e580b618783bb50e562dd5dc22a1</sum>
        </package>
        <package name="zziplib-utils" arch="x86_64" epoch="0" version="0.13.78" release="2.el10" src="zziplib-0.13.78-2.el10.src.rpm">
          <filename>zziplib-utils-0.13.78-2.el10.x86_64.rpm</filename>
          <sum type="sha256">e328dfc41afc9624191cf1b8c97535face15fd83ea8b9e191bb07fe9a0a85c29</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21002</id>
    <title>Important: squid security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21002 (https://access.redhat.com/errata/RHSA-2025:21002), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for squid.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

* squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling (CVE-2025-62168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62168" id="CVE-2025-62168" type="cve" title="CVE-2025-62168" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404736" id="2404736" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21002" id="RLSA-2025:21002" type="self" title="RLSA-2025:21002" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21002" id="RHSA-2025:21002" type="vendor" title="Red Hat RHSA-2025:21002" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="squid" arch="x86_64" epoch="7" version="6.10" release="6.el10_1.1" src="squid-6.10-6.el10_1.1.src.rpm">
          <filename>squid-6.10-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">5d58fde7365c0f27102c2da8951388dfad404bbe57565937b463354005d79ad3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:20994</id>
    <title>Important: ipa security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:20994 (https://access.redhat.com/errata/RHSA-2025:20994), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ipa.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7493" id="CVE-2025-7493" type="cve" title="CVE-2025-7493" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389448" id="2389448" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:20994" id="RLSA-2025:20994" type="self" title="RLSA-2025:20994" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:20994" id="RHSA-2025:20994" type="vendor" title="Red Hat RHSA-2025:20994" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipa-client" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">4df4c9d900d84bc20229cdeb7e6cacbda2bc48501f5aaaffbb9c2841a69feb63</sum>
        </package>
        <package name="ipa-client-common" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-common-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">1ed48f9ea27e3d51c6938f8e04aa918e384c4163a7cfb53d1b4afa22cf261bd1</sum>
        </package>
        <package name="ipa-client-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-encrypted-dns-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">b63a3e8fc7adaa5c5ccad6fb972bb1d4d7c980ad202c736dd5c56b2252c3442c</sum>
        </package>
        <package name="ipa-client-epn" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-epn-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">50922b9b91c3609452a312144f5c26e0f55d6ba2967b8a90b75d55cbe363fe4f</sum>
        </package>
        <package name="ipa-client-samba" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-samba-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">8923d269f8998e1503d4ac3a9982c3941c8d5a6477bf82fe218d2d08e7ee759e</sum>
        </package>
        <package name="ipa-common" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-common-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">c1b9d1f2220bf3eb358abd8e95f7790745255ec3f3b399abaf7aad2953c0e5eb</sum>
        </package>
        <package name="ipa-selinux" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-selinux-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">75744bb5b01ef62b6915e55785bd42a945b325ddb7f123f0a11777702a42f904</sum>
        </package>
        <package name="ipa-selinux-luna" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-selinux-luna-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">5093abf0e161cee519dc8d2a71d8ede28a212cab1c0cba7f4681439fe58bbc1a</sum>
        </package>
        <package name="ipa-selinux-nfast" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-selinux-nfast-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">47ba228ca00a37cc15ccf6a9c4652a6fca96634201e65eb95a4cb354e38eb33c</sum>
        </package>
        <package name="ipa-server" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">884ee33548a6a4f2b4782897be7e94d299efcc945b4bfa4e9dfa20eda3e2d59d</sum>
        </package>
        <package name="ipa-server-common" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-common-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">d51abb9a704469c8fcfc1b2a1b4ddb7c26c16a2435b35a61d62cefb5aeebd594</sum>
        </package>
        <package name="ipa-server-dns" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-dns-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">1c1d5b78f31b2f73883906d472f58a8ea5e8a54a3a1bbc3cfc84b44f3f514b8c</sum>
        </package>
        <package name="ipa-server-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-encrypted-dns-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">ab5b7a3fe55136d99f377f672c90cbcf867043e80546a0dd207550bf11383843</sum>
        </package>
        <package name="ipa-server-trust-ad" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-trust-ad-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">2f3eb3f475d63c146f00fcfb685c3683bfb44d7a89882512cf92cef09c432214</sum>
        </package>
        <package name="python3-ipaclient" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>python3-ipaclient-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">fb3029b088891bad80443ccc23f16928d47e9ed109d7081e2bcb4ef7f6bee08d</sum>
        </package>
        <package name="python3-ipalib" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>python3-ipalib-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">d0443950c78b0bd4142c09462e1f2bcacabd02835e3afb176e71bd02b62ad86b</sum>
        </package>
        <package name="python3-ipaserver" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>python3-ipaserver-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">0bd398d681243e4de7c442df874a15304a0cf695e5736b5040399a851b644bf4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21032</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21032 (https://access.redhat.com/errata/RHSA-2025:21032), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)

* libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11021" id="CVE-2025-11021" type="cve" title="CVE-2025-11021" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4945" id="CVE-2025-4945" type="cve" title="CVE-2025-4945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367175" id="2367175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2399627" id="2399627" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21032" id="RLSA-2025:21032" type="self" title="RLSA-2025:21032" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21032" id="RHSA-2025:21032" type="vendor" title="Red Hat RHSA-2025:21032" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.6" src="libsoup3-3.6.5-3.el10_1.6.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">9c45387d49258f8098c567ac2587405764f8246fd3ffbb382c9b67d722965795</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.6" src="libsoup3-3.6.5-3.el10_1.6.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">8eee3b5a4e945cef76f63de2cd7f41eebe8e16216b492e0a616abf7bf332a8f3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21037</id>
    <title>Important: qt6-qtsvg security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21037 (https://access.redhat.com/errata/RHSA-2025:21037), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for qt6-qtsvg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

Security Fix(es):

* qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10729" id="CVE-2025-10729" type="cve" title="CVE-2025-10729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401241" id="2401241" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21037" id="RLSA-2025:21037" type="self" title="RLSA-2025:21037" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21037" id="RHSA-2025:21037" type="vendor" title="Red Hat RHSA-2025:21037" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtsvg" arch="x86_64" epoch="0" version="6.9.1" release="2.el10_1.1" src="qt6-qtsvg-6.9.1-2.el10_1.1.src.rpm">
          <filename>qt6-qtsvg-6.9.1-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">e10889240f77e91991a6eaba599dacb050ccd9a3de4f0cb2215baeaf8d344a00</sum>
        </package>
        <package name="qt6-qtsvg-devel" arch="x86_64" epoch="0" version="6.9.1" release="2.el10_1.1" src="qt6-qtsvg-6.9.1-2.el10_1.1.src.rpm">
          <filename>qt6-qtsvg-devel-6.9.1-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">08645db2f57ba12b2cdeff0780db0fb6946cf6078246357366fa29760f883bfb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21034</id>
    <title>Important: bind security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21034 (https://access.redhat.com/errata/RHSA-2025:21034), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for bind.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778)

* bind: Cache poisoning due to weak PRNG (CVE-2025-40780)

* bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40778" id="CVE-2025-40778" type="cve" title="CVE-2025-40778" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40780" id="CVE-2025-40780" type="cve" title="CVE-2025-40780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8677" id="CVE-2025-8677" type="cve" title="CVE-2025-8677" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405827" id="2405827" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405829" id="2405829" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405830" id="2405830" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21034" id="RLSA-2025:21034" type="self" title="RLSA-2025:21034" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21034" id="RHSA-2025:21034" type="vendor" title="Red Hat RHSA-2025:21034" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="bind" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">80cd62e71c915db9f358a0a0a1738dba34f502e66cf5dc4e751c32d25d02f383</sum>
        </package>
        <package name="bind-chroot" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-chroot-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">e45d5e7c370405a143aaf6b527247132eec86501976603327a52cfbabce0277c</sum>
        </package>
        <package name="bind-dnssec-utils" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">b204e08f20804c5db18e13e2847575ea171eaaa3e4377a42c611108a8edb3149</sum>
        </package>
        <package name="bind-libs" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-libs-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">05907e050ac0fb48a01b75ad8245f185cdf339de1385e1178efbfac4719327e3</sum>
        </package>
        <package name="bind-license" arch="noarch" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-license-9.18.33-10.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">2c9c63219d146ae32dc4bc03c04bf15a22ceef7fa40fdd33bd8865eac1c33a16</sum>
        </package>
        <package name="bind-utils" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-utils-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">08234432b4469be6a4144afff4fdeae136bb9cf7cb15fdc1e42a0eab54283926</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21142</id>
    <title>Important: python-kdcproxy security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21142 (https://access.redhat.com/errata/RHSA-2025:21142), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-kdcproxy.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

* python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59088" id="CVE-2025-59088" type="cve" title="CVE-2025-59088" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59089" id="CVE-2025-59089" type="cve" title="CVE-2025-59089" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393955" id="2393955" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393958" id="2393958" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21142" id="RLSA-2025:21142" type="self" title="RLSA-2025:21142" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21142" id="RHSA-2025:21142" type="vendor" title="Red Hat RHSA-2025:21142" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-kdcproxy" arch="noarch" epoch="0" version="1.0.0" release="19.el10_1" src="python-kdcproxy-1.0.0-19.el10_1.src.rpm">
          <filename>python3-kdcproxy-1.0.0-19.el10_1.noarch.rpm</filename>
          <sum type="sha256">92ae0a11b605fc8a2757c1ea35a49218ca517b019c9804e8a23375aa7aec3b5f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21220</id>
    <title>Important: podman security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21220 (https://access.redhat.com/errata/RHSA-2025:21220), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881" id="CVE-2025-52881" type="cve" title="CVE-2025-52881" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404715" id="2404715" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21220" id="RLSA-2025:21220" type="self" title="RLSA-2025:21220" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21220" id="RHSA-2025:21220" type="vendor" title="Red Hat RHSA-2025:21220" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="7" version="5.6.0" release="6.el10_1" src="podman-5.6.0-6.el10_1.src.rpm">
          <filename>podman-5.6.0-6.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d8c7e66b25c9dd4b11a21c53de29b67528ce39d489e1cd97d146d6aafd49c15c</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="6.el10_1" src="podman-5.6.0-6.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-6.el10_1.noarch.rpm</filename>
          <sum type="sha256">6db94e38c5be0caccf548d216622fd7c72e5d8298bdcadd0ce06fcb54934dcdf</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.6.0" release="6.el10_1" src="podman-5.6.0-6.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-6.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ab4b7b0766040b375bea3cbd63c5f3e204d0aefe1a9f8ec330837769d8beff83</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21281</id>
    <title>Important: firefox security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21281 (https://access.redhat.com/errata/RHSA-2025:21281), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

* firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

* firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

* firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

* firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

* firefox: Race condition in the Graphics component (CVE-2025-13012)

* firefox: Spoofing issue in Firefox (CVE-2025-13015)

* firefox: Mitigation bypass in the DOM: Core &amp; HTML component (CVE-2025-13013)

* firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13012" id="CVE-2025-13012" type="cve" title="CVE-2025-13012" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13013" id="CVE-2025-13013" type="cve" title="CVE-2025-13013" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13014" id="CVE-2025-13014" type="cve" title="CVE-2025-13014" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13015" id="CVE-2025-13015" type="cve" title="CVE-2025-13015" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13016" id="CVE-2025-13016" type="cve" title="CVE-2025-13016" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13017" id="CVE-2025-13017" type="cve" title="CVE-2025-13017" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13018" id="CVE-2025-13018" type="cve" title="CVE-2025-13018" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13019" id="CVE-2025-13019" type="cve" title="CVE-2025-13019" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13020" id="CVE-2025-13020" type="cve" title="CVE-2025-13020" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414079" id="2414079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414080" id="2414080" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414083" id="2414083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414084" id="2414084" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414085" id="2414085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414086" id="2414086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414090" id="2414090" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414091" id="2414091" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414092" id="2414092" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21281" id="RLSA-2025:21281" type="self" title="RLSA-2025:21281" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21281" id="RHSA-2025:21281" type="vendor" title="Red Hat RHSA-2025:21281" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.5.0" release="2.el10_1" src="firefox-140.5.0-2.el10_1.src.rpm">
          <filename>firefox-140.5.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">dc7f29a72c34b77600be5be5ec8e6c7a5c2a920e4b31f31bcc4f4786da98b92d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21843</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21843 (https://access.redhat.com/errata/RHSA-2025:21843), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

* firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

* firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

* firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

* firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

* firefox: Race condition in the Graphics component (CVE-2025-13012)

* firefox: Spoofing issue in Firefox (CVE-2025-13015)

* firefox: Mitigation bypass in the DOM: Core &amp; HTML component (CVE-2025-13013)

* firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13012" id="CVE-2025-13012" type="cve" title="CVE-2025-13012" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13013" id="CVE-2025-13013" type="cve" title="CVE-2025-13013" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13014" id="CVE-2025-13014" type="cve" title="CVE-2025-13014" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13015" id="CVE-2025-13015" type="cve" title="CVE-2025-13015" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13016" id="CVE-2025-13016" type="cve" title="CVE-2025-13016" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13017" id="CVE-2025-13017" type="cve" title="CVE-2025-13017" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13018" id="CVE-2025-13018" type="cve" title="CVE-2025-13018" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13019" id="CVE-2025-13019" type="cve" title="CVE-2025-13019" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13020" id="CVE-2025-13020" type="cve" title="CVE-2025-13020" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414079" id="2414079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414080" id="2414080" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414083" id="2414083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414084" id="2414084" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414085" id="2414085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414086" id="2414086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414090" id="2414090" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414091" id="2414091" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414092" id="2414092" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21843" id="RLSA-2025:21843" type="self" title="RLSA-2025:21843" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21843" id="RHSA-2025:21843" type="vendor" title="Red Hat RHSA-2025:21843" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.5.0" release="2.el10_1" src="thunderbird-140.5.0-2.el10_1.src.rpm">
          <filename>thunderbird-140.5.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5f19ee39d0ed99c592928848823868d617a10a4de259a495033a51df65290ca1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21485</id>
    <title>Moderate: java-25-openjdk security update</title>
    <issued date="2025-11-25 09:18:33" />
    <updated date="2025-12-09 09:07:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21485 (https://access.redhat.com/errata/RHSA-2025:21485), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for java-25-openjdk.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

* JDK: Enhance Path Factories (CVE-2025-53066)

* JDK: Enhance Certificate Handling (CVE-2025-53057)

* JDK: Enhance String Handling (CVE-2025-61748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that the OpenJDK 25 package does not yet include FIPS support. This is expected to be reinstated in a future update.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53057" id="CVE-2025-53057" type="cve" title="CVE-2025-53057" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53066" id="CVE-2025-53066" type="cve" title="CVE-2025-53066" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61748" id="CVE-2025-61748" type="cve" title="CVE-2025-61748" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403063" id="2403063" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403064" id="2403064" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403082" id="2403082" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21485" id="RLSA-2025:21485" type="self" title="RLSA-2025:21485" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21485" id="RHSA-2025:21485" type="vendor" title="Red Hat RHSA-2025:21485" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="java-25-openjdk" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">fef7787b64d8a6ba1e4c1350ae3b3dc8696d98643973c21a9eac3f3bbbfcebd1</sum>
        </package>
        <package name="java-25-openjdk-demo" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-demo-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">271726b9605410756a9d1ae00e239e242c3d26750e753c3484498795ee96aadc</sum>
        </package>
        <package name="java-25-openjdk-devel" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-devel-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">01399503bb50925104ca69a35f8c6f29ea51a77c8b26f29433a6edb7671012d5</sum>
        </package>
        <package name="java-25-openjdk-headless" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-headless-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">f60d95ada35c8a61460ded1e6d518f3218642d210b91641c45e08b46fa671503</sum>
        </package>
        <package name="java-25-openjdk-javadoc" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-javadoc-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">702419de9f24f2f3dc47a52b5e09b787d6d5643740a88828ce930f49c12aebf4</sum>
        </package>
        <package name="java-25-openjdk-javadoc-zip" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-javadoc-zip-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">c3bf0890884961f24c78bae0b96bcca7513cf227f04709ca65db4340dac0cca4</sum>
        </package>
        <package name="java-25-openjdk-jmods" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-jmods-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">aad3009b25a93ee555c5406a4da1c1c6e9eeb9c4a4346b7bcedbdd889c4e4f1f</sum>
        </package>
        <package name="java-25-openjdk-src" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-src-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">95193e537e949096651efdc5961e5af769d280e54aebc56fcb337a7e4da12fa3</sum>
        </package>
        <package name="java-25-openjdk-static-libs" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-static-libs-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">0039eba06a5877218fd6de3509d1ea7d86b82181bf79be5898f7857dd713b782</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21691</id>
    <title>Important: haproxy security update</title>
    <issued date="2025-11-25 09:18:33" />
    <updated date="2025-12-09 09:07:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21691 (https://access.redhat.com/errata/RHSA-2025:21691), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for haproxy.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11230" id="CVE-2025-11230" type="cve" title="CVE-2025-11230" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2413003" id="2413003" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21691" id="RLSA-2025:21691" type="self" title="RLSA-2025:21691" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21691" id="RHSA-2025:21691" type="vendor" title="Red Hat RHSA-2025:21691" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="haproxy" arch="x86_64" epoch="0" version="3.0.5" release="4.el10_1.1" src="haproxy-3.0.5-4.el10_1.1.src.rpm">
          <filename>haproxy-3.0.5-4.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">e77f47567771730ba24a53c27de871b50c4b423cf63af96275f7f75db2431d84</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21936</id>
    <title>Important: valkey security update</title>
    <issued date="2025-11-25 09:18:33" />
    <updated date="2025-12-09 09:07:19" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21936 (https://access.redhat.com/errata/RHSA-2025:21936), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

* Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

* Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

* Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46817" id="CVE-2025-46817" type="cve" title="CVE-2025-46817" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46818" id="CVE-2025-46818" type="cve" title="CVE-2025-46818" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46819" id="CVE-2025-46819" type="cve" title="CVE-2025-46819" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49844" id="CVE-2025-49844" type="cve" title="CVE-2025-49844" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401258" id="2401258" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401292" id="2401292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401322" id="2401322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401324" id="2401324" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21936" id="RLSA-2025:21936" type="self" title="RLSA-2025:21936" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21936" id="RHSA-2025:21936" type="vendor" title="Red Hat RHSA-2025:21936" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.6" release="2.el10_1" src="valkey-8.0.6-2.el10_1.src.rpm">
          <filename>valkey-8.0.6-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0b4c2ee2c4a3996c703dee42eea75839b25f0954978dc50361b55790abd4b44f</sum>
        </package>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.6" release="2.el10_1" src="valkey-8.0.6-2.el10_1.src.rpm">
          <filename>valkey-devel-8.0.6-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b996ef8149abb585a9fbe571ffeb839d2ba578484fc1dd1d330ad4ae8ccb133f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21816</id>
    <title>Moderate: delve and golang security update</title>
    <issued date="2025-11-27 09:11:22" />
    <updated date="2025-12-11 09:10:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:21816 (https://access.redhat.com/errata/RHSA-2025:21816), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang, delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Go Programming Language.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21816" id="RLSA-2025:21816" type="self" title="RLSA-2025:21816" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:21816" id="RHSA-2025:21816" type="vendor" title="Red Hat RHSA-2025:21816" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.25.2" release="1.el10_1" src="delve-1.25.2-1.el10_1.src.rpm">
          <filename>delve-1.25.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">28162c2aa0f6da1137aafe28c551256f6753577d5e0ba1fceb3f4661b1a76ac4</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-1.25.3-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2f3f7cdbc35a6b0bb8c5074813284459bb7021f2d25780c0ba020494d2bf9e08</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.3-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a779a6f243a8ce0e072e0212ae2dd7d85782e4d84136556eb203b80636dd3d68</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">9e7dbd3039937982d0083ea4030a03960311db7aeb1ae99d25a440a2991a2fa8</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e6fb8d50f403ed9b6bc1c92db1313138fe48b005ee3b4e36a7572176e99ced2a</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-race-1.25.3-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ac0aa2ca77237424a1c2832ce6891b0d440c4a7e4ec0006c77fe9e4569ffa7c4</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-src-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">fcab9736bf045d0b8c60b64b37f6a5b541dc262e34b835d0d69e0d519e1c7f3f</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">ba530d6269e26f0abab9df12cb744896239302378e95e398f111e917ace9c370</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.3-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b1a4d56304d8fb4a138ebbdcd64dcdf974d460ad9473b43a273888b35d13bcf8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:22012</id>
    <title>Important: buildah security update</title>
    <issued date="2025-11-28 09:17:04" />
    <updated date="2025-12-12 09:09:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:22012 (https://access.redhat.com/errata/RHSA-2025:22012), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881" id="CVE-2025-52881" type="cve" title="CVE-2025-52881" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404715" id="2404715" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:22012" id="RLSA-2025:22012" type="self" title="RLSA-2025:22012" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:22012" id="RHSA-2025:22012" type="vendor" title="Red Hat RHSA-2025:22012" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah" arch="x86_64" epoch="2" version="1.41.6" release="1.el10_1" src="buildah-1.41.6-1.el10_1.src.rpm">
          <filename>buildah-1.41.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cd22c546fd03c6654f10a42e1da58c66f0c620f31617877994b07cad9f74721a</sum>
        </package>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.41.6" release="1.el10_1" src="buildah-1.41.6-1.el10_1.src.rpm">
          <filename>buildah-tests-1.41.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3f4093fb7fb252c85bad980a316851934215f267cb07ff592de5ce12c44c6a29</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:22361</id>
    <title>Moderate: qt6-qtquick3d security update</title>
    <issued date="2025-12-02 09:07:01" />
    <updated date="2025-12-15 09:09:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:22361 (https://access.redhat.com/errata/RHSA-2025:22361), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qt6-qtquick3d.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Qt 6 Quick3D library.

Security Fix(es):

* assimp: Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow (CVE-2025-11277)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11277" id="CVE-2025-11277" type="cve" title="CVE-2025-11277" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401622" id="2401622" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:22361" id="RLSA-2025:22361" type="self" title="RLSA-2025:22361" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:22361" id="RHSA-2025:22361" type="vendor" title="Red Hat RHSA-2025:22361" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtquick3d" arch="x86_64" epoch="0" version="6.9.1" release="1.el10_1.1" src="qt6-qtquick3d-6.9.1-1.el10_1.1.src.rpm">
          <filename>qt6-qtquick3d-6.9.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">12810e225837e2d0addc77e67ca8af12ef3b250a1e7396267e0283a01442a54f</sum>
        </package>
        <package name="qt6-qtquick3d-devel" arch="x86_64" epoch="0" version="6.9.1" release="1.el10_1.1" src="qt6-qtquick3d-6.9.1-1.el10_1.1.src.rpm">
          <filename>qt6-qtquick3d-devel-6.9.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">8ecffe46def4f410d905ae8f67e3df64539391bfcf265ac0ecfed896cc10c822</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:22394</id>
    <title>Moderate: qt6-qtsvg security update</title>
    <issued date="2025-12-02 09:07:01" />
    <updated date="2025-12-15 09:09:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:22394 (https://access.redhat.com/errata/RHSA-2025:22394), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qt6-qtsvg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

Security Fix(es):

* qtsvg: Uncontrolled recursion in Qt SVG module (CVE-2025-10728)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10728" id="CVE-2025-10728" type="cve" title="CVE-2025-10728" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401244" id="2401244" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:22394" id="RLSA-2025:22394" type="self" title="RLSA-2025:22394" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:22394" id="RHSA-2025:22394" type="vendor" title="Red Hat RHSA-2025:22394" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtsvg" arch="x86_64" epoch="0" version="6.9.1" release="2.el10_1.2" src="qt6-qtsvg-6.9.1-2.el10_1.2.src.rpm">
          <filename>qt6-qtsvg-6.9.1-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">0b200eee637e182761b11b2bb426bc572ed83f4a46b74636dfe6542c94129aca</sum>
        </package>
        <package name="qt6-qtsvg-devel" arch="x86_64" epoch="0" version="6.9.1" release="2.el10_1.2" src="qt6-qtsvg-6.9.1-2.el10_1.2.src.rpm">
          <filename>qt6-qtsvg-devel-6.9.1-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">fd21ffd63b1a6183397a2a5f9af7da63b91a48704104256a8884e2fd9c37a876</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23035</id>
    <title>Important: firefox security update</title>
    <issued date="2025-12-11 09:09:11" />
    <updated date="2025-12-25 09:09:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23035 (https://access.redhat.com/errata/RHSA-2025:23035), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333)

* firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

* firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

* firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14321" id="CVE-2025-14321" type="cve" title="CVE-2025-14321" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14322" id="CVE-2025-14322" type="cve" title="CVE-2025-14322" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14323" id="CVE-2025-14323" type="cve" title="CVE-2025-14323" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14324" id="CVE-2025-14324" type="cve" title="CVE-2025-14324" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14325" id="CVE-2025-14325" type="cve" title="CVE-2025-14325" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14328" id="CVE-2025-14328" type="cve" title="CVE-2025-14328" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14329" id="CVE-2025-14329" type="cve" title="CVE-2025-14329" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14330" id="CVE-2025-14330" type="cve" title="CVE-2025-14330" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14331" id="CVE-2025-14331" type="cve" title="CVE-2025-14331" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14333" id="CVE-2025-14333" type="cve" title="CVE-2025-14333" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420502" id="2420502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420503" id="2420503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420504" id="2420504" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420506" id="2420506" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420508" id="2420508" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420509" id="2420509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420512" id="2420512" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420513" id="2420513" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420516" id="2420516" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420517" id="2420517" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23035" id="RLSA-2025:23035" type="self" title="RLSA-2025:23035" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23035" id="RHSA-2025:23035" type="vendor" title="Red Hat RHSA-2025:23035" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.6.0" release="1.el10_1" src="firefox-140.6.0-1.el10_1.src.rpm">
          <filename>firefox-140.6.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5b2a51725f98ba4bdd4dff03091e78ac648cba13f69442e0d23b63a9f9ea5ea0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23008</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23008 (https://access.redhat.com/errata/RHSA-2025:23008), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045)

* mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040)

* mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069)

* mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53040" id="CVE-2025-53040" type="cve" title="CVE-2025-53040" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53042" id="CVE-2025-53042" type="cve" title="CVE-2025-53042" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53044" id="CVE-2025-53044" type="cve" title="CVE-2025-53044" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53045" id="CVE-2025-53045" type="cve" title="CVE-2025-53045" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53053" id="CVE-2025-53053" type="cve" title="CVE-2025-53053" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53054" id="CVE-2025-53054" type="cve" title="CVE-2025-53054" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53062" id="CVE-2025-53062" type="cve" title="CVE-2025-53062" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53069" id="CVE-2025-53069" type="cve" title="CVE-2025-53069" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405486" id="2405486" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405491" id="2405491" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405511" id="2405511" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405514" id="2405514" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405523" id="2405523" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405534" id="2405534" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405541" id="2405541" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405544" id="2405544" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23008" id="RLSA-2025:23008" type="self" title="RLSA-2025:23008" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23008" id="RHSA-2025:23008" type="vendor" title="Red Hat RHSA-2025:23008" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mysql8.4" arch="x86_64" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-8.4.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">fd3f8f0c8050d0408416d2b14abfe20163e9d399e6db7426c88d73138e956504</sum>
        </package>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-common-8.4.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e8ec68c244bd06db9f32dc93d71f733d7643bcdba0969553fd2968abcde61056</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">c956ef5c3dc121f79a41086b473d6c274856a3d4b5532134099b9fd082f6997b</sum>
        </package>
        <package name="mysql8.4-libs" arch="x86_64" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-libs-8.4.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b66af012b341f91dd02db0d0cd91ad63b20cbf91442b754b4338a480a42b2665</sum>
        </package>
        <package name="mysql8.4-server" arch="x86_64" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-server-8.4.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e18eb3608ff374bb7cd1a2f284cb83577ec5b0ba6c0f372d2194224883c28600</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23052</id>
    <title>Important: tomcat9 security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23052 (https://access.redhat.com/errata/RHSA-2025:23052), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651" id="CVE-2025-31651" type="cve" title="CVE-2025-31651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752" id="CVE-2025-55752" type="cve" title="CVE-2025-55752" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362782" id="2362782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406591" id="2406591" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23052" id="RLSA-2025:23052" type="self" title="RLSA-2025:23052" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23052" id="RHSA-2025:23052" type="vendor" title="Red Hat RHSA-2025:23052" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">7cb5590482ebdaddcbbcc94193841985acbc24a97dd733ad433d4aae10f049e3</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">8f02b67c2c971db9acd8c1abcf7755fbcc5d5bbfe13a3c751ac4cca4f1fb8749</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">1450c24d9c1bbc753470d72e048496c4a53440d72dfeb83263d072167543b2d3</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">aeb97317e8764d3e5a34e98b3497e42423342cdd3528389f6d16d3d2882ffce2</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">fb073920aa88369e9357f674e08aad249f602afd88abf632b4e247288b7f3b17</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-lib-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">36627b3f5df782484dd4f166526c3a53f9bc85759b4c47e5fa65ec326dc097eb</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">f69f116d2eb2b097c73b3a29fa5ab70b64be7918b5c595083f4fe1a6bcd6baef</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-webapps-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">e69a9ba31bebb341d955e267012dce698882592c2bf0ea0e8b1681bc64e1e3ea</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23050</id>
    <title>Important: tomcat security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23050 (https://access.redhat.com/errata/RHSA-2025:23050), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service (CVE-2025-61795)

* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651" id="CVE-2025-31651" type="cve" title="CVE-2025-31651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752" id="CVE-2025-55752" type="cve" title="CVE-2025-55752" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61795" id="CVE-2025-61795" type="cve" title="CVE-2025-61795" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362782" id="2362782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406588" id="2406588" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406591" id="2406591" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23050" id="RLSA-2025:23050" type="self" title="RLSA-2025:23050" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23050" id="RHSA-2025:23050" type="vendor" title="Red Hat RHSA-2025:23050" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">f9de65559b1d36fada76879998ed02b85338697dc97a36ee317fc5aaef8c0493</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">ba2127f13424b7ef9c46ee3c1932be1eadc142a4e9f5df6bb0161659490f84e6</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">90e83c4283a81b358bb0d7f9c4330bc05d54607bfe5a892233eb3ce26ed60437</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">8bd07c2f0f6d3cae1d10aa2209a16e867c26eb73aa2c824dad456eb18b164478</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">778970678c930f76cb71d2673800d653f77eeec1c7bcede1d5b6cf20d8e1266e</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-lib-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">adb09daaaca930ba42e0d3bfef2ca2b98550a98cf188b51abd82c8cea6446fee</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">e5a3d01edd1133ac65bd6a72d417223e420eb0139cb886e74336827bb2b2e38b</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-webapps-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">91eec5407c25a1837a75508aee6b24c3ed68bc49ed361e4b4d093dcf20104e8f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23083</id>
    <title>Important: wireshark security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23083 (https://access.redhat.com/errata/RHSA-2025:23083), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Access of Uninitialized Pointer in Wireshark (CVE-2025-13499)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13499" id="CVE-2025-13499" type="cve" title="CVE-2025-13499" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2416293" id="2416293" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23083" id="RLSA-2025:23083" type="self" title="RLSA-2025:23083" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23083" id="RHSA-2025:23083" type="vendor" title="Red Hat RHSA-2025:23083" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="wireshark" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.1" src="wireshark-4.4.2-4.el10_1.1.src.rpm">
          <filename>wireshark-4.4.2-4.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">52bb7f180be77b78bf1f21b9b2257b3cfb29ed2e9b464d4efc9460a6464c6bba</sum>
        </package>
        <package name="wireshark-cli" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.1" src="wireshark-4.4.2-4.el10_1.1.src.rpm">
          <filename>wireshark-cli-4.4.2-4.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">dfac4cd05aef44787b4cc616a96e106367fe5576949ec4386b052590e0a370a1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23088</id>
    <title>Moderate: grafana security update</title>
    <issued date="2025-12-13 09:11:15" />
    <updated date="2025-12-27 09:10:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23088 (https://access.redhat.com/errata/RHSA-2025:23088), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23088" id="RLSA-2025:23088" type="self" title="RLSA-2025:23088" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23088" id="RHSA-2025:23088" type="vendor" title="Red Hat RHSA-2025:23088" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="21.el10_1" src="grafana-10.2.6-21.el10_1.src.rpm">
          <filename>grafana-10.2.6-21.el10_1.x86_64.rpm</filename>
          <sum type="sha256">675f4370bebd8fc46f9cb968f319f0f1192b70f89981e7e43f858e578c5b0dd8</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="21.el10_1" src="grafana-10.2.6-21.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-21.el10_1.x86_64.rpm</filename>
          <sum type="sha256">24c9e904c7840a737b5083024c2f6655ac2898fdd371770f2d16f3b130758386</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23139</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2025-12-13 09:11:15" />
    <updated date="2025-12-27 09:10:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23139 (https://access.redhat.com/errata/RHSA-2025:23139), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Heap Use-After-Free in libsoup message queue handling during HTTP/2 read completion (CVE-2025-12105)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12105" id="CVE-2025-12105" type="cve" title="CVE-2025-12105" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405992" id="2405992" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23139" id="RLSA-2025:23139" type="self" title="RLSA-2025:23139" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23139" id="RHSA-2025:23139" type="vendor" title="Red Hat RHSA-2025:23139" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.7" src="libsoup3-3.6.5-3.el10_1.7.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.7.x86_64.rpm</filename>
          <sum type="sha256">54e8c5789def874a750db4ed66408c80686950f83fb27ff701f50488e602f1b6</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.7" src="libsoup3-3.6.5-3.el10_1.7.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.7.x86_64.rpm</filename>
          <sum type="sha256">f2fcd058af40123c8908e5eeffc8292ef376f2c3f7b453dbf416c1bb57acd47a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23201</id>
    <title>Important: keylime security update</title>
    <issued date="2025-12-18 09:09:42" />
    <updated date="2026-01-01 09:09:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23201 (https://access.redhat.com/errata/RHSA-2025:23201), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for keylime.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

* keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13609" id="CVE-2025-13609" type="cve" title="CVE-2025-13609" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2416761" id="2416761" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23201" id="RLSA-2025:23201" type="self" title="RLSA-2025:23201" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23201" id="RHSA-2025:23201" type="vendor" title="Red Hat RHSA-2025:23201" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="keylime-tools" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-tools-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">6e11be837d9191ddc42538510419f5595e0fc99a45b99db2d02a14884d24c03e</sum>
        </package>
        <package name="keylime-verifier" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-verifier-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">d964296d42c80966a0e0f559d6025eaca23f8b3384fce128087ad4126f6bdb7d</sum>
        </package>
        <package name="python3-keylime" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>python3-keylime-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">b6501f588ccf5f97808aa144743e097af55963fb7bc08bf1c2953b7954baf7db</sum>
        </package>
        <package name="keylime" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">87f7cc1f45bf3e8903fb8c185935a84393f621b0fe133fa66f4c26518d6a1fd8</sum>
        </package>
        <package name="keylime-base" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-base-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">3e5aa077f4a06bf38a2a392931d3e9a8bd2d0b6907e82a5f3407c595e453ff05</sum>
        </package>
        <package name="keylime-registrar" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-registrar-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">033ecaa9912e3e28f94d9a9ecead8fafa63b1c6e5c4acf3285774f6597126eb2</sum>
        </package>
        <package name="keylime-selinux" arch="noarch" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-selinux-7.12.1-11.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">b47e065a613fca8753074843dc80b00630a87bea49c40544a70f1d245bf2d914</sum>
        </package>
        <package name="keylime-tenant" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-tenant-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">169fe9d87d9510bbc01633eb94b481b263b7a94d8a3421a9db9d43306f9ee164</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23294</id>
    <title>Moderate: skopeo security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23294 (https://access.redhat.com/errata/RHSA-2025:23294), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23294" id="RLSA-2025:23294" type="self" title="RLSA-2025:23294" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23294" id="RHSA-2025:23294" type="vendor" title="Red Hat RHSA-2025:23294" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.20.0" release="2.el10_1" src="skopeo-1.20.0-2.el10_1.src.rpm">
          <filename>skopeo-1.20.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f2c7fe4db461452c90384d8794db82cdc0230a1f7a73d3fe40c355e51cbcfa61</sum>
        </package>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.20.0" release="2.el10_1" src="skopeo-1.20.0-2.el10_1.src.rpm">
          <filename>skopeo-tests-1.20.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">93964e6994c42aaa5c25fe20a324a8fcdbd50f6f23e5368b5056391ce2feb9b1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23295</id>
    <title>Moderate: podman security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23295 (https://access.redhat.com/errata/RHSA-2025:23295), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23295" id="RLSA-2025:23295" type="self" title="RLSA-2025:23295" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23295" id="RHSA-2025:23295" type="vendor" title="Red Hat RHSA-2025:23295" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="7" version="5.6.0" release="8.el10_1" src="podman-5.6.0-8.el10_1.src.rpm">
          <filename>podman-5.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d523f657419a73bc85927e8761dc6794572fb2254b400135c98f42020a5770bd</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="8.el10_1" src="podman-5.6.0-8.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-8.el10_1.noarch.rpm</filename>
          <sum type="sha256">b8dfeb260bbe9bea9e3be8bc0e4fc7c6f61cd18d5ce124845e41bedfb126c84f</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.6.0" release="8.el10_1" src="podman-5.6.0-8.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">408020efe23c4816f0fa9b7ce0e02129a18482784e4f2c892052ef0394ea7098</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23664</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23664 (https://access.redhat.com/errata/RHSA-2025:23664), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation (CVE-2025-68156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68156" id="CVE-2025-68156" type="cve" title="CVE-2025-68156" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2422891" id="2422891" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23664" id="RLSA-2025:23664" type="self" title="RLSA-2025:23664" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23664" id="RHSA-2025:23664" type="vendor" title="Red Hat RHSA-2025:23664" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.135.0" release="2.el10_1" src="opentelemetry-collector-0.135.0-2.el10_1.src.rpm">
          <filename>opentelemetry-collector-0.135.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4b5d1711a801f404be054bc49e06b2040e2406ac78b299688ad72ea8913caf6a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23667</id>
    <title>Important: git-lfs security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23667 (https://access.redhat.com/errata/RHSA-2025:23667), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26625" id="CVE-2025-26625" type="cve" title="CVE-2025-26625" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404720" id="2404720" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23667" id="RLSA-2025:23667" type="self" title="RLSA-2025:23667" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23667" id="RHSA-2025:23667" type="vendor" title="Red Hat RHSA-2025:23667" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git-lfs" arch="x86_64" epoch="0" version="3.6.1" release="4.el10_1" src="git-lfs-3.6.1-4.el10_1.src.rpm">
          <filename>git-lfs-3.6.1-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b66ecde9da47fa2b74247da32b535cc95989592acfb0d8c0594a84ca40e991ac</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23738</id>
    <title>Important: mod_md security update</title>
    <issued date="2025-12-24 09:09:08" />
    <updated date="2026-01-07 09:06:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23738 (https://access.redhat.com/errata/RHSA-2025:23738), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mod_md.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning.  Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.

Security Fix(es):

* mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55753" id="CVE-2025-55753" type="cve" title="CVE-2025-55753" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419140" id="2419140" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23738" id="RLSA-2025:23738" type="self" title="RLSA-2025:23738" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23738" id="RHSA-2025:23738" type="vendor" title="Red Hat RHSA-2025:23738" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_md" arch="x86_64" epoch="1" version="2.4.26" release="4.el10_1" src="mod_md-2.4.26-4.el10_1.src.rpm">
          <filename>mod_md-2.4.26-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">954de3100ce89386f8888cd26ec19b1573b814548ac4dbc754b1cea8408d60b2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23932</id>
    <title>Important: httpd security update</title>
    <issued date="2025-12-24 09:09:08" />
    <updated date="2026-01-07 09:06:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23932 (https://access.redhat.com/errata/RHSA-2025:23932), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)

* httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)

* httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58098" id="CVE-2025-58098" type="cve" title="CVE-2025-58098" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65082" id="CVE-2025-65082" type="cve" title="CVE-2025-65082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66200" id="CVE-2025-66200" type="cve" title="CVE-2025-66200" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419139" id="2419139" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419262" id="2419262" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419365" id="2419365" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23932" id="RLSA-2025:23932" type="self" title="RLSA-2025:23932" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23932" id="RHSA-2025:23932" type="vendor" title="Red Hat RHSA-2025:23932" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="httpd" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">f9341130578019b08f0ec727eadae219f624456b1f06416fe87f17bbea041bbe</sum>
        </package>
        <package name="httpd-core" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-core-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">33ba09317272e35e194103012e797a0cbd15df9917c9ededff447af101816327</sum>
        </package>
        <package name="httpd-devel" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-devel-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">9de053d76295d7247f2bcfd1335ee0b2f7ee2ed16d2b52841ef4fea44dff415a</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-filesystem-2.4.63-4.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">ecf3854d6a4894a4600c34687ac57b55daae3e1a185750514a825ac7b1500d75</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-manual-2.4.63-4.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">6949a406e6a3155db79dc44fc713116f5b40b1d345b6749ab09b2d783faa80af</sum>
        </package>
        <package name="httpd-tools" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-tools-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">afd659378cb08cf351f1a02a61262a1525b7b5b46ed0e39cbd3e3387dcc3a525</sum>
        </package>
        <package name="mod_ldap" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_ldap-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">beb786f382d2e6d67d31babbc2e9dee615a993567f4eb84f1cc3536d999ecc8f</sum>
        </package>
        <package name="mod_lua" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_lua-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">30625b48faad114c3bb8452ffc653dc9cbbb6e071297473b3c19a7ba16aed3f8</sum>
        </package>
        <package name="mod_proxy_html" arch="x86_64" epoch="1" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_proxy_html-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">3ade30491c179285667f82c8f1c169d5bfd52e7ad8e27791a1aac70efa0c9177</sum>
        </package>
        <package name="mod_session" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_session-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">39cfa97fd481230c5b068982cbc6bb0bab6d7af8bd02dff9c9bdd160777389f7</sum>
        </package>
        <package name="mod_ssl" arch="x86_64" epoch="1" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_ssl-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">227671bde2d670506a86b5924f9370c7461e208c7c979f507a3b028bbc6bf144</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23141</id>
    <title>Moderate: ruby security update</title>
    <issued date="2026-01-03 09:07:36" />
    <updated date="2026-01-17 09:08:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2025:23141 (https://access.redhat.com/errata/RHSA-2025:23141), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* resolv: Denial of Service in resolv gem (CVE-2025-24294)

* rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24294" id="CVE-2025-24294" type="cve" title="CVE-2025-24294" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58767" id="CVE-2025-58767" type="cve" title="CVE-2025-58767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61594" id="CVE-2025-61594" type="cve" title="CVE-2025-61594" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379684" id="2379684" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2396186" id="2396186" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426336" id="2426336" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23141" id="RLSA-2025:23141" type="self" title="RLSA-2025:23141" />
      <reference href="https://access.redhat.com/errata/RHSA-2025:23141" id="RHSA-2025:23141" type="vendor" title="Red Hat RHSA-2025:23141" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ruby" arch="x86_64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-3.3.10-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3897719f05801e93b2129284eb0472c16cb3a8342b32e80b016da37703f6f418</sum>
        </package>
        <package name="ruby-bundled-gems" arch="x86_64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-bundled-gems-3.3.10-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">772b6cf0a39bc7a612f6d57e8bb66aa26839af0f130d3f97c915571d6cf0e01b</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-default-gems-3.3.10-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">40f44efb34d21198b1c29a0929c4c51675d04e983cd81465f8cf1532b07441b1</sum>
        </package>
        <package name="ruby-devel" arch="x86_64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-devel-3.3.10-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">36f8ebbceb5941beadd51588446f3407a7d72eda143b141ad9532f17b385fa5d</sum>
        </package>
        <package name="rubygem-bigdecimal" arch="x86_64" epoch="0" version="3.1.5" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ae28f73fba0b12e84d417cc6b27bf2b17be85ba273398ec94ed86a41af1daa40</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-bundler-2.5.22-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">058f37cc1517c22c9bbb5bd1fca687bfa62588b74e84fe713ee7461bdd23e8bb</sum>
        </package>
        <package name="rubygem-io-console" arch="x86_64" epoch="0" version="0.7.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-io-console-0.7.1-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4283b3862f6f19297894ae291fc47cf83b511acf775962d80b7842d36168a2c9</sum>
        </package>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-irb-1.13.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">e4edd538b5968a839b91e449d8349daec2f196776c60d9077d93d5967f77596a</sum>
        </package>
        <package name="rubygem-json" arch="x86_64" epoch="0" version="2.7.2" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-json-2.7.2-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cd9dab4c7c19dbe4af5dd6a5395ed688d0e23745980fbf32e437fc313e0c275f</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-minitest-5.20.0-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">0434b5728cd4944228035d9b77680d2858734453f31d74c391c56f8c2d67d98a</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-power_assert-2.0.3-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">d0bde6352c0ae723efdc4a97696de00def0d82f6a8e8ef7e2400afccce648d59</sum>
        </package>
        <package name="rubygem-psych" arch="x86_64" epoch="0" version="5.1.2" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-psych-5.1.2-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">47452d678912371276902756f72fa4dcd70796476db848942ad591612bee0743</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rake-13.1.0-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">42114b64369326aa4a84ad5f32f116690e712ea7ed501003737ce2bde8ab583f</sum>
        </package>
        <package name="rubygem-rbs" arch="x86_64" epoch="0" version="3.4.0" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rbs-3.4.0-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f720c85c0947d20471f0867e870503fdab7955c918061db38af2788d8726b2c1</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">e71510b81e9beb13670a44249383320eb7c5fa1d774a38adf64bbc7df697536f</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.4.4" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rexml-3.4.4-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">f5ce0a935c6cd55f8b83cae6456ffb26c1a8b64e2ad50ee51e84267fc4207995</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rss-0.3.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">07912be4be20e8c39e41041841ad3d5e259a8f3cafedc1e6b69b92a9f58c5a20</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygems-3.5.22-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">4619bd0477a6a2b7bdfed9977c03765198f1c4f300874e94133bb6a3ff80934c</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygems-devel-3.5.22-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">8d675850b3900bef9a8445e114d3bdcec9a1043b871e659daa0a1b64b9b5f72e</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-test-unit-3.6.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">4567bdec139bad08bd4c25cc304bcd6729fa5765f351f045dd9c6cf89e9e609c</sum>
        </package>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-typeprof-0.21.9-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">d513b152dafea61d7a1f55ad03e2e1ebd0a489a4593a77434377e57c089e87ee</sum>
        </package>
        <package name="ruby-libs" arch="x86_64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-libs-3.3.10-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2431a56069ba051d289be1821e04cd17c77ba43b383f1c2687d59f012657c6e2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0025</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-01-05 09:08:05" />
    <updated date="2026-01-19 09:09:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:0025 (https://access.redhat.com/errata/RHSA-2026:0025), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333)

* firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

* firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

* firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14321" id="CVE-2025-14321" type="cve" title="CVE-2025-14321" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14322" id="CVE-2025-14322" type="cve" title="CVE-2025-14322" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14323" id="CVE-2025-14323" type="cve" title="CVE-2025-14323" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14324" id="CVE-2025-14324" type="cve" title="CVE-2025-14324" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14325" id="CVE-2025-14325" type="cve" title="CVE-2025-14325" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14328" id="CVE-2025-14328" type="cve" title="CVE-2025-14328" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14329" id="CVE-2025-14329" type="cve" title="CVE-2025-14329" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14330" id="CVE-2025-14330" type="cve" title="CVE-2025-14330" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14331" id="CVE-2025-14331" type="cve" title="CVE-2025-14331" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14333" id="CVE-2025-14333" type="cve" title="CVE-2025-14333" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420502" id="2420502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420503" id="2420503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420504" id="2420504" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420506" id="2420506" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420508" id="2420508" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420509" id="2420509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420512" id="2420512" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420513" id="2420513" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420516" id="2420516" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420517" id="2420517" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0025" id="RLSA-2026:0025" type="self" title="RLSA-2026:0025" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:0025" id="RHSA-2026:0025" type="vendor" title="Red Hat RHSA-2026:0025" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.6.0" release="1.el10_1" src="thunderbird-140.6.0-1.el10_1.src.rpm">
          <filename>thunderbird-140.6.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">206328c42c7d7fbd10e4365a988a5235333bfaa5e3a004f305341b522edf3e52</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0525</id>
    <title>Moderate: postgresql16 security update</title>
    <issued date="2026-01-14 09:14:26" />
    <updated date="2026-01-28 09:10:53" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:0525 (https://access.redhat.com/errata/RHSA-2026:0525), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12818" id="CVE-2025-12818" type="cve" title="CVE-2025-12818" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414826" id="2414826" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0525" id="RLSA-2026:0525" type="self" title="RLSA-2026:0525" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:0525" id="RHSA-2026:0525" type="vendor" title="Red Hat RHSA-2026:0525" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postgresql-plpython3" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-plpython3-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">87222f7cf1aeaadee5d008db8fe8c481d4db0068cc72bfff59f7f86ac6eda42e</sum>
        </package>
        <package name="postgresql-static" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-static-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d3d0fec6d0bbcbb0d38fb9421e8226430484a8babefa61f3c9661d4f0f80a06c</sum>
        </package>
        <package name="postgresql-docs" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-docs-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cb500e6a5f7c98ae158cf9ea43ecccb663dc18109b78cd7500a4895b0c452e22</sum>
        </package>
        <package name="postgresql" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5c5190813aed64ee329b3eb9b3fa0d94035bb1680350501054bb4e39bdd3e20c</sum>
        </package>
        <package name="postgresql-private-devel" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-private-devel-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ffa3f840b8f345b2390fbdd93b433b8ff20a292396711cc6a96a649bfc95c5e1</sum>
        </package>
        <package name="postgresql-contrib" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-contrib-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ebc305bd37b61943a6184476e9f21b8d43c7cf2d0c6baa47b58f2890fe6bf7d8</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-devel-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">690e1bd68a9ca334b5150b7033f1f140b70330039bf2c133521d716628dc4249</sum>
        </package>
        <package name="postgresql-plperl" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-plperl-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8657290354edcc8a63941cb5b595cd422ab40c3ea87970fb199c9a867b72906b</sum>
        </package>
        <package name="postgresql-server-devel" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-server-devel-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">51071b0013f300bfd36f2c665de58ece0401dd5803cb9220da98f40596451181</sum>
        </package>
        <package name="postgresql-server" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-server-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">aba6bf7159228cb19135add43fc7291a69d837d572c5fdfed2fe7f960c0dd7d3</sum>
        </package>
        <package name="postgresql-test" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-test-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d49fb5eaaa9c118ca70d4fa9d5d3c8b9ad3d1e0d05d4e260c64b9a40a74a40b3</sum>
        </package>
        <package name="postgresql-pltcl" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-pltcl-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7f590d00de023938ce1362a2bc7d5f32de508632d135f9aeba49dee384bd6af8</sum>
        </package>
        <package name="postgresql-private-libs" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-private-libs-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0a3dd7d8132b3e03313aeca2e6ed2edefb6eda10a76f557500d70f811d5ad71e</sum>
        </package>
        <package name="postgresql-upgrade" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">64d6c42e01f14deed4c209d611439e3530ad709e57e01245232b8eadf2df2e6b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0423</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2026-01-15 09:16:30" />
    <updated date="2026-01-29 09:12:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:0423 (https://access.redhat.com/errata/RHSA-2026:0423), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins) (CVE-2025-14523)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14523" id="CVE-2025-14523" type="cve" title="CVE-2025-14523" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2421349" id="2421349" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0423" id="RLSA-2026:0423" type="self" title="RLSA-2026:0423" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:0423" id="RHSA-2026:0423" type="vendor" title="Red Hat RHSA-2026:0423" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.8" src="libsoup3-3.6.5-3.el10_1.8.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">de26c8b6c6fc6dd1cda0f50504d3a0ce942b3a71a813e44348f21e2498dc89db</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.8" src="libsoup3-3.6.5-3.el10_1.8.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">2129621b3a6cb9c63067172f135838260b46872d69749abb4f8abb79bb63daac</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0436</id>
    <title>Important: buildah security update</title>
    <issued date="2026-01-15 09:16:30" />
    <updated date="2026-01-29 09:12:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:0436 (https://access.redhat.com/errata/RHSA-2026:0436), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47913" id="CVE-2025-47913" type="cve" title="CVE-2025-47913" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414943" id="2414943" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0436" id="RLSA-2026:0436" type="self" title="RLSA-2026:0436" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:0436" id="RHSA-2026:0436" type="vendor" title="Red Hat RHSA-2026:0436" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.41.8" release="1.el10_1" src="buildah-1.41.8-1.el10_1.src.rpm">
          <filename>buildah-tests-1.41.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1b4c4add0688fe4800a57a0f75f2ff8ad6f6bd5a0b07f6a38cf1a607b1b21bda</sum>
        </package>
        <package name="buildah" arch="x86_64" epoch="2" version="1.41.8" release="1.el10_1" src="buildah-1.41.8-1.el10_1.src.rpm">
          <filename>buildah-1.41.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">dd5c9ca1ba7881c7125821a9cf47f730748c2420ddeef83896c27998f0a1e1fa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0545</id>
    <title>Important: podman security update</title>
    <issued date="2026-01-17 09:07:37" />
    <updated date="2026-01-30 22:12:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:0545 (https://access.redhat.com/errata/RHSA-2026:0545), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47913" id="CVE-2025-47913" type="cve" title="CVE-2025-47913" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414943" id="2414943" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0545" id="RLSA-2026:0545" type="self" title="RLSA-2026:0545" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:0545" id="RHSA-2026:0545" type="vendor" title="Red Hat RHSA-2026:0545" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="11.el10_1" src="podman-5.6.0-11.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">16c5e9f16eb94c5e9b7fe3a1eda9b8ea23b083e81067e88b0f31f4d7582476a1</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.6.0" release="11.el10_1" src="podman-5.6.0-11.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">df581bf3b4f137a1bc60a48bc4cf856125aeee15a815367bd7844456ffead24b</sum>
        </package>
        <package name="podman" arch="x86_64" epoch="7" version="5.6.0" release="11.el10_1" src="podman-5.6.0-11.el10_1.src.rpm">
          <filename>podman-5.6.0-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cbf1135449f6083abec22d4f3f534aaf62f85bded59846f455724f8687c1250a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0606</id>
    <title>Moderate: vsftpd security update</title>
    <issued date="2026-01-17 09:07:37" />
    <updated date="2026-01-30 22:12:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:0606 (https://access.redhat.com/errata/RHSA-2026:0606), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for vsftpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

Security Fix(es):

* vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14242" id="CVE-2025-14242" type="cve" title="CVE-2025-14242" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419826" id="2419826" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0606" id="RLSA-2026:0606" type="self" title="RLSA-2026:0606" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:0606" id="RHSA-2026:0606" type="vendor" title="Red Hat RHSA-2026:0606" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="vsftpd" arch="x86_64" epoch="0" version="3.0.5" release="10.el10_1.1" src="vsftpd-3.0.5-10.el10_1.1.src.rpm">
          <filename>vsftpd-3.0.5-10.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">d2cc1377a00a81f215f5f61633d68ba43ff0042b3466a7142170b09cfa2858fa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0668</id>
    <title>Important: net-snmp security update</title>
    <issued date="2026-01-17 09:07:37" />
    <updated date="2026-01-30 22:12:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:0668 (https://access.redhat.com/errata/RHSA-2026:0668), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for net-snmp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

Security Fix(es):

* net-snmp: buffer overflow via a specially crafted packet can cause a crash in snmptrapd (CVE-2025-68615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68615" id="CVE-2025-68615" type="cve" title="CVE-2025-68615" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2424618" id="2424618" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0668" id="RLSA-2026:0668" type="self" title="RLSA-2026:0668" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:0668" id="RHSA-2026:0668" type="vendor" title="Red Hat RHSA-2026:0668" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="net-snmp-perl" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-perl-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">f43cf5e0013647abc79bbefd94bca037590f748daed5dd9076c0a35249588ce2</sum>
        </package>
        <package name="net-snmp-perl-module" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-perl-module-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">4d39c8b030400b52b66f27c4fc6ae3168c76cc3aa84d416a4c10b5f2b6354cdc</sum>
        </package>
        <package name="net-snmp-libs" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-libs-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">d8adf13d22f82adce511a5cea9b5adfe0c7f48827fb47dc0d51d095f9d32e782</sum>
        </package>
        <package name="net-snmp" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">c1ab83861de134346245e6af9c076225de8a2ee2caa4c8702c364a1cbbd65643</sum>
        </package>
        <package name="net-snmp-utils" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-utils-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">66f5955ef5ebba7ce0bafbfc155796a05fb6a071ae8ac9ebdfcda85df577dd59</sum>
        </package>
        <package name="net-snmp-agent-libs" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-agent-libs-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">79adcdbe558fad90d9029815a85522b52afff087e2f047d001b9111bfb5b7336</sum>
        </package>
        <package name="net-snmp-devel" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-devel-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">d9e33bc5fb7ea440aeb440792e0ccd225a1050907803d71b4e14440c84a2a9c0</sum>
        </package>
        <package name="python3-net-snmp" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>python3-net-snmp-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">ae4aa33fb6f62d78d7ac6657d8486165307d3c1c74fbc02513c3e47d016a8355</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0770</id>
    <title>Important: gpsd security update</title>
    <issued date="2026-01-21 09:06:31" />
    <updated date="2026-02-03 17:25:19" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:0770 (https://access.redhat.com/errata/RHSA-2026:0770), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gpsd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.

Security Fix(es):

* gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269)

* gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67268" id="CVE-2025-67268" type="cve" title="CVE-2025-67268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67269" id="CVE-2025-67269" type="cve" title="CVE-2025-67269" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426835" id="2426835" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426810" id="2426810" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0770" id="RLSA-2026:0770" type="self" title="RLSA-2026:0770" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:0770" id="RHSA-2026:0770" type="vendor" title="Red Hat RHSA-2026:0770" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gpsd" arch="x86_64" epoch="1" version="3.26.1" release="1.el10_1.1" src="gpsd-3.26.1-1.el10_1.1.src.rpm">
          <filename>gpsd-3.26.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">2669ad374f675b1ba19f2ccbb41a57b077ca196313bbfe611c95efa327d8bbc5</sum>
        </package>
        <package name="gpsd-clients" arch="x86_64" epoch="1" version="3.26.1" release="1.el10_1.1" src="gpsd-3.26.1-1.el10_1.1.src.rpm">
          <filename>gpsd-clients-3.26.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">26c30b2d4d429c7fd75f55b8f131139f289b63982cf7b64d5579f00f455cf2d6</sum>
        </package>
        <package name="python3-gpsd" arch="x86_64" epoch="1" version="3.26.1" release="1.el10_1.1" src="gpsd-3.26.1-1.el10_1.1.src.rpm">
          <filename>python3-gpsd-3.26.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">c2cb68e2504ecd7ca8d4d2ef48c8e5773f62c2cc67b331a15b0a8a5a14df5f52</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0922</id>
    <title>Important: golang security update</title>
    <issued date="2026-01-23 09:09:09" />
    <updated date="2026-02-06 09:10:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:0922 (https://access.redhat.com/errata/RHSA-2026:0922), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0922" id="RLSA-2026:0922" type="self" title="RLSA-2026:0922" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:0922" id="RHSA-2026:0922" type="vendor" title="Red Hat RHSA-2026:0922" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.5-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">50ed0b06e55a882d383ece3d72f72b4a13f3e31f10a1bcce56172e5c7c28a960</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">37193f1ea5fe167f83ebd687d22a6c0911a285d06a3865a229f59e019e02323f</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">509934389da150ab8af62eadc5261fc91afbeb1f02291b5dd3b94fb73fd64393</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-race-1.25.5-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">073b9098f4976fbfb68f7e1754fb2186d0a390ab121627f69fe90046c8f60dd9</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-1.25.5-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d63a749e61612d2eb4df265f22bdde1425ef1b096584e68a696510e7768a280e</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">0baede789c6eb9f29fb31fc4f2eeac953f7f11de4464a6e5f54155744799cac8</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.5-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">55af6893ad61edaff8816ee911a4f1095536abbed79faba219a812d8a3464a43</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-src-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">3471f8593ee325afc1423143bb49a46d3676a5dbfa904a095a1bb8820e61a05a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1597</id>
    <title>Moderate: iperf3 security update</title>
    <issued date="2026-02-03 17:23:52" />
    <updated date="2026-02-17 09:10:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1597 (https://access.redhat.com/errata/RHSA-2026:1597), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for iperf3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

* iperf3: iperf Heap Buffer Overflow (CVE-2025-54349)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54349" id="CVE-2025-54349" type="cve" title="CVE-2025-54349" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2386151" id="2386151" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1597" id="RLSA-2026:1597" type="self" title="RLSA-2026:1597" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1597" id="RHSA-2026:1597" type="vendor" title="Red Hat RHSA-2026:1597" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="iperf3" arch="x86_64" epoch="0" version="3.17.1" release="5.el10_1" src="iperf3-3.17.1-5.el10_1.src.rpm">
          <filename>iperf3-3.17.1-5.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b9bdca5dca06788f0315dd9d4612e5b9e63e2ec0cd7b862fd3463f5a57ca0a94</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1628</id>
    <title>Important: php security update</title>
    <issued date="2026-02-05 09:13:02" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1628 (https://access.redhat.com/errata/RHSA-2026:1628), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

* php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

* php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14177" id="CVE-2025-14177" type="cve" title="CVE-2025-14177" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14178" id="CVE-2025-14178" type="cve" title="CVE-2025-14178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14180" id="CVE-2025-14180" type="cve" title="CVE-2025-14180" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425627" id="2425627" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425625" id="2425625" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425626" id="2425626" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1628" id="RLSA-2026:1628" type="self" title="RLSA-2026:1628" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1628" id="RHSA-2026:1628" type="vendor" title="Red Hat RHSA-2026:1628" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="php-embedded" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-embedded-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">33fddf1d74e32829ba767e77aeaa5d2977ae88f06b1d195274312611b730b188</sum>
        </package>
        <package name="php-gd" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-gd-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">6fbee4db51f4fa36df6d023121bb77c2a89f8cd7271905720b4039c77f39fda0</sum>
        </package>
        <package name="php-snmp" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-snmp-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c1925b7feb600a76afad66c475377fa116a424391722c3350d3b5627e38b5755</sum>
        </package>
        <package name="php-ldap" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-ldap-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ec577b99eb418ff62d2b3ed5ac1e3925d72bd6fc9abd676d185bf3c9ec75e864</sum>
        </package>
        <package name="php-devel" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-devel-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b89b81bee412bda6aa679e078fa3b80b669790cf79a41ae880404d42220aae4d</sum>
        </package>
        <package name="php" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5a19a0bf092722493ee7c7b22c2a3c2e03938d80b9ef0a9e999b91e5e33bc14d</sum>
        </package>
        <package name="php-dbg" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-dbg-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d09e7929d46a1998a4c23913a4f49dd24c980b07352f1e1413edc0ac6581c6f0</sum>
        </package>
        <package name="php-soap" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-soap-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">021c7e6ef194b3d7cf10f57efc18d3078e53071b880121ddeeb6fed58d1f81d0</sum>
        </package>
        <package name="php-fpm" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-fpm-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e5e73b562a42b3618de03b71fbd641415b77236aed3e65d4589a9313879e8fab</sum>
        </package>
        <package name="php-mysqlnd" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-mysqlnd-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">348dd4d78b22aaf4bad2987c51d9e6e96e4d1686144ec1df6d164b252e179b9b</sum>
        </package>
        <package name="php-common" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-common-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3ecbb4e14c39dc558fe2fc20c545b1bf49fdb0bc60064c9d5f50af82583bb60d</sum>
        </package>
        <package name="php-gmp" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-gmp-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2eca5b2ccd32a008d353917fbc6eb37a128212226c017f9cffd9d823e7c9e7b4</sum>
        </package>
        <package name="php-enchant" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-enchant-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9c6f89ecb11e9e57bb8416a0a4b817cbfa1b2f4eadc5972dcc9905a146ac65fa</sum>
        </package>
        <package name="php-mbstring" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-mbstring-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cfe90863232552cc51a5e4f9e7d4a7aa5b3f724b570b728acba3703f0ac841e5</sum>
        </package>
        <package name="php-odbc" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-odbc-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">6b4bc5e6eca4e57d707cc0fc49bc3bc5dea9d7f935dedc3134f0953d40ba40d5</sum>
        </package>
        <package name="php-dba" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-dba-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f33b17e28714849e59acf8ebb04ba65ebbde7067c933d40851911ece516f756a</sum>
        </package>
        <package name="php-pdo" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-pdo-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">21b2d5fa420cc9f073a31e29999b84dd477439ec301b6e362014710a99cb9770</sum>
        </package>
        <package name="php-intl" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-intl-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">24f4f16fabe63c86251c368d5b4fc4eae4d883870182023441f087d44d52de5b</sum>
        </package>
        <package name="php-opcache" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-opcache-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8f8c724d34748c848eaf8d1c985a99af159ab3612d7dd72380d589b662434715</sum>
        </package>
        <package name="php-process" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-process-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ae5c62894a6e94f0bee88e1de2c9c51e91c3e6834ec1825fa7fd0d84542215e7</sum>
        </package>
        <package name="php-ffi" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-ffi-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">09391134e24a700301f2c4ee7c3b912c06d0444b16a355ff8351280f58c3551e</sum>
        </package>
        <package name="php-pgsql" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-pgsql-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c6084526e71527a5e651e3685c0c29b2b7eddff8893ce258afcf14ee3a85ea75</sum>
        </package>
        <package name="php-bcmath" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-bcmath-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b9fb9de8d80a9fcf90b0040ab366be56810046c28aedc7bf162a9770a3376fdc</sum>
        </package>
        <package name="php-xml" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-xml-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">29dcef05a90519262ab004478e414ba96099d9cf4c5b1855c99985b6692f0c5a</sum>
        </package>
        <package name="php-cli" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-cli-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">87d72a4dc117ec13b32160191809bbdb28e9d6284b4600b408c14032719b3911</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1714</id>
    <title>Moderate: wireshark security update</title>
    <issued date="2026-02-05 09:13:02" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1714 (https://access.redhat.com/errata/RHSA-2026:1714), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* Wireshark: NULL Pointer Dereference in Wireshark (CVE-2025-9817)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9817" id="CVE-2025-9817" type="cve" title="CVE-2025-9817" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2392839" id="2392839" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1714" id="RLSA-2026:1714" type="self" title="RLSA-2026:1714" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1714" id="RHSA-2026:1714" type="vendor" title="Red Hat RHSA-2026:1714" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="wireshark-cli" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.2" src="wireshark-4.4.2-4.el10_1.2.src.rpm">
          <filename>wireshark-cli-4.4.2-4.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">791acb14d6b823c72331cd01ef175a379585d68344364f9c82e397a5b089637a</sum>
        </package>
        <package name="wireshark" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.2" src="wireshark-4.4.2-4.el10_1.2.src.rpm">
          <filename>wireshark-4.4.2-4.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">01a52dfd7e453af47265a5946e526d889c3e70df82589c8534ed8c1495309622</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1715</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-02-05 09:13:02" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1715 (https://access.redhat.com/errata/RHSA-2026:1715), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1715" id="RLSA-2026:1715" type="self" title="RLSA-2026:1715" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1715" id="RHSA-2026:1715" type="vendor" title="Red Hat RHSA-2026:1715" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="4.el10_1" src="golang-github-openprinting-ipp-usb-0.9.27-4.el10_1.src.rpm">
          <filename>ipp-usb-0.9.27-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">55e39f90a58b12ed5c1554a20b1834423029c2811e8370219b2119913691a7f4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1905</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1905 (https://access.redhat.com/errata/RHSA-2026:1905), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23490" id="CVE-2026-23490" type="cve" title="CVE-2026-23490" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430472" id="2430472" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1905" id="RLSA-2026:1905" type="self" title="RLSA-2026:1905" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1905" id="RHSA-2026:1905" type="vendor" title="Red Hat RHSA-2026:1905" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="fence-virtd-multicast" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-multicast-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">0d811f5f3eb8283ca6184024e4ff9bb2aa5477641173a29dc3e4a4ea6bb9af3d</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6d6b49af741df947e13524e43e0955aa2c0f52403d8bf836334e6c951c07664b</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">f7b20f7e215b4808d5083ef2fdb88b7fe6852b022696e398c5923317cb84e699</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">744983f9b876d2e6204e4fa9f7ccf98b53900005a2c60501e820359f56301108</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">fa3c44b37e4e9b99ecde0486d8ffdb9b7686e34e6f96a5a7a1ca25e3e96f342e</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">da9c4f59307029c579f0231587b0f226112896e8d9524a0072cba6995bcd8f62</sum>
        </package>
        <package name="fence-agents-redfish" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-redfish-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">24b7b7939b61ac5ea7b25a4d376abeafa366d5996b610072eb45a35cf82f5402</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">db27ed6e5c4c2bedc1c57e6d188c2fb8eb1b4190db5e3ccf2bc85cd699e31c56</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">a13f18f3a7352dbb80c55920b5804ac145c308861beb7f98d23cb04ce6fb55c1</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-virsh-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6946997cd0e441920755d88aae9fc5e3dff75ac1a8d70a71a78728c2d4ecf17f</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">ad6341e317306438f9eb28bf844390b525aa784bdcd3d86ca3201141bc319895</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">c352c5b8f487314eb9267a04de69cff78ab1cf752e767ed24dcc9ee172d06f95</sum>
        </package>
        <package name="fence-agents-common" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-common-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">1acd85e31b0a1f03106a71dbc6ae3af1647d9e5803da449a2739384f55791a00</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-emerson-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">4d41c05e178981fa8db8579bf696f853f15a1ea37354bbe12366f1b70c49142f</sum>
        </package>
        <package name="fence-agents-aws" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-aws-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">fc9b2794e9c8cf868be148d594fe8c924ef80d3725a93dbe13176c43882cab0d</sum>
        </package>
        <package name="fence-agents-azure-arm" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-azure-arm-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">3160f52859d79f1936be20746708e6c742b9c49e5863865eb9198004ae489370</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-apc-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6069ff740536ce03e921217bbcc695237f025395e8675551bede3ba6b2a2a9e0</sum>
        </package>
        <package name="fence-virtd-tcp" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-tcp-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">861fa1f3acbb8d3f8be3a302350d2adee63beec9e5cbc4cad23482b221ae27c5</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">1d3e3e21a23596020da9c70f61beac80e88ef5bb0a6ab0a1d1cc7f79e8999fbf</sum>
        </package>
        <package name="fence-virtd-serial" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-serial-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">7cf6d97dde813877a9ac8450a77186a4c21642e9f8973a809ce60490f8322411</sum>
        </package>
        <package name="fence-agents-openstack" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-openstack-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">46360b681238bf3b3290f1558ba08b158ebb5d56b6681ee7fadaa2b9cc1c4e6c</sum>
        </package>
        <package name="fence-agents-gce" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-gce-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">c00c44be9d6fd2beda59634a9c60ef3a43d133896795f38852528516147a27dc</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">3d8158d5f7fad1e6437ab26b4ebb670d22bc2bffacd74debda5eca8fbc5d99e8</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-sbd-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">f00dd62eab14ee407ca82c221c62884e7a7015f8faa54b8f1ea0f448f9502ca6</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">94f12803ea6b260f160dad9c1da96ca3eab05aaacfd02ed23457c52e051b1a48</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-rsb-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">db6c37fa9ffa72f12c41d25c5a6182a9a712196e9438e62f70332f930d5526cf</sum>
        </package>
        <package name="ha-cloud-support" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>ha-cloud-support-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">56572ee8c4ab916d9ac0160ecec39bf9d87d230a5eae3986404c14d2ad052053</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">ac8ec113d3e4561b7ad8cc68dc070a75892c982c2accd5e90838a19f7684667d</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">20573bb73c629bbaa9630fc494c081d0b5050bf42fc24f2c2bc048df656ff272</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">59aba5896367a98b1c2fc5d2ddb177d18a415f74504d32a1ba40be7e1d2a2e35</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">04d3d314ab0871cb6b3a2e5b675e043493c3d322e4a78e51075d51e3b0589a61</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-mpath-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">69f5e537c670b4b47389c422b242cd9a62d5f5f28a09bc47c3a58397601902ec</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">9d70edbb0cd1a6268436c33a1e99c54d9f56c3fa8c7f0140d04ba88547648405</sum>
        </package>
        <package name="fence-agents-kdump" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-kdump-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">6ed4a4bdbb02a8646e938ce8de80046e72c6d6e9376bd446c7d9a01728bd7767</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-brocade-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">088994c92aa2eed0381485f4fcbb0c4a6d6d5d38011614fc0cfc133ecc7ea5ce</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-scsi-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">a3c22cbaf14cd9c68558c19337b5e4d82d6ed053c3e3798aa9fdb60db8538b83</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">c938db8c5d2443f7a19598454d72eb7d4cc00f4c460e2db8aa0cae6c323dc40e</sum>
        </package>
        <package name="fence-virtd" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">bd59e3ddb4ecfe3f907387fb7359679c4f45e5a425118fd1799cf7f71f981de1</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-drac5-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">2cbd0cba564e2dc0c8f1df64abb3633714c5cfce3cca1f62bab8212b0e02c1b7</sum>
        </package>
        <package name="fence-virtd-libvirt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-libvirt-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">f39f51d4c3e27a1c9eb7da234c9a06de03fe05d599f3c50ab40abd8acc495e2a</sum>
        </package>
        <package name="fence-agents-aliyun" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-aliyun-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">14cee3ec03c6b35c4f575ca73a9b8f4003b047125de493d17c5dbaf812e2ce21</sum>
        </package>
        <package name="fence-agents-all" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-all-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">6cfa8730436ad830b1af2a38e8c65411438d618cacb095e17bef9953b4cd2abc</sum>
        </package>
        <package name="fence-virt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virt-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">4abde22e83dd28ef7d7c9ad21099da6a26a5124806fd7c142a1e848a1cf9be32</sum>
        </package>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">7ec071eefb60bebdcb40ac3b4d3dde0211749971d7a01296dfe45deb5110e6f4</sum>
        </package>
        <package name="fence-virtd-cpg" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-cpg-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">7bd402a2d37a3aafc6668d478f28933e23e41e8376dc1ce1d65ea87f5f20892e</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">b6ca56e874c07d826cbc2c6db3ed94cae4164f3a892b7a428297eeea98219d09</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">20384778df91636f46cee3afb7d0ffbcb5153d988d4fe84f48df27276066bc11</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-eps-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">c394a51084efead2948dd570410324d03a3f7ad7536d02a7ca00aedf7c7e2a6c</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-wti-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6a0c5faaebea74abe72a2fe4b1aa6f14c69b0f31376863858d5d7c45abfca561</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">957b8b2ba4630b26ed33a390e830e4cfe18212722e40bb0734b6943471b29578</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">5790c225105735536180d29888748191f67188e202ca93084b61cb61e9fc0832</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-rsa-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">176fd22fc375634e906848efe06cb418e9b0209dd59442ffa99d05d1c3372885</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-lpar-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">0a130538f252739c95f1b60984a0c614bab4f99fbb4e170c49c988d8e80e6065</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1842</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1842 (https://access.redhat.com/errata/RHSA-2026:1842), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

* nodejs: Nodejs denial of service (CVE-2026-21637)

* nodejs: Nodejs denial of service (CVE-2025-59466)

* nodejs: Nodejs denial of service (CVE-2025-59465)

* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

* nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55130" id="CVE-2025-55130" type="cve" title="CVE-2025-55130" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55131" id="CVE-2025-55131" type="cve" title="CVE-2025-55131" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55132" id="CVE-2025-55132" type="cve" title="CVE-2025-55132" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59465" id="CVE-2025-59465" type="cve" title="CVE-2025-59465" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59466" id="CVE-2025-59466" type="cve" title="CVE-2025-59466" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21637" id="CVE-2026-21637" type="cve" title="CVE-2026-21637" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431349" id="2431349" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431343" id="2431343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431340" id="2431340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431352" id="2431352" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431350" id="2431350" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431338" id="2431338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1842" id="RLSA-2026:1842" type="self" title="RLSA-2026:1842" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1842" id="RHSA-2026:1842" type="vendor" title="Red Hat RHSA-2026:1842" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs24-full-i18n" arch="x86_64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-full-i18n-24.13.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1729d822171b373061ce17ae6f3429461b98b54dd746c15197b89911573832db</sum>
        </package>
        <package name="nodejs24-devel" arch="x86_64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-devel-24.13.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">efab123f91e4356131d027fac7136998eb939b1b76acd2abf743706270f70d34</sum>
        </package>
        <package name="nodejs24-libs" arch="x86_64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-libs-24.13.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0bec2c9dcc51b53311d9c7615f995370bee7ab4c4df0e859219758f9323f4cb5</sum>
        </package>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-docs-24.13.0-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">1d2e9d7d3bbf686a1862ba194782f22e5eb522f1643084d926e5ba576ab067d0</sum>
        </package>
        <package name="nodejs24" arch="x86_64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-24.13.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">717b3369eac9c05ecab4adc215f58c0699f291d426eaa282bf26c6efa8b503bc</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.6.2" release="1.24.13.0.1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-npm-11.6.2-1.24.13.0.1.el10_1.noarch.rpm</filename>
          <sum type="sha256">47139c6e8c75276e94a4d2cc6f41ac80bd7d7eb07b95f00f1db117d1754e7b48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1843</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1843 (https://access.redhat.com/errata/RHSA-2026:1843), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

* nodejs: Nodejs denial of service (CVE-2026-21637)

* nodejs: Nodejs denial of service (CVE-2025-59466)

* nodejs: Nodejs denial of service (CVE-2025-59465)

* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

* nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55130" id="CVE-2025-55130" type="cve" title="CVE-2025-55130" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55131" id="CVE-2025-55131" type="cve" title="CVE-2025-55131" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55132" id="CVE-2025-55132" type="cve" title="CVE-2025-55132" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59465" id="CVE-2025-59465" type="cve" title="CVE-2025-59465" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59466" id="CVE-2025-59466" type="cve" title="CVE-2025-59466" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21637" id="CVE-2026-21637" type="cve" title="CVE-2026-21637" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431349" id="2431349" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431343" id="2431343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431340" id="2431340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431352" id="2431352" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431350" id="2431350" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431338" id="2431338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1843" id="RLSA-2026:1843" type="self" title="RLSA-2026:1843" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1843" id="RHSA-2026:1843" type="vendor" title="Red Hat RHSA-2026:1843" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs-full-i18n" arch="x86_64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-full-i18n-22.22.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5c416cfb38010f4af98c1ad8130681efebf3a94894af75101e80e19fd9da896c</sum>
        </package>
        <package name="nodejs-devel" arch="x86_64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-devel-22.22.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cac51ee1f8e5760c346abbd780c175b9ce9145b590be2d3f4d9c93705244769f</sum>
        </package>
        <package name="nodejs-libs" arch="x86_64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-libs-22.22.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">bec93652c8e54a0d358217945d2b1a6676f9259b7e0ffd099968a92e6842705f</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-docs-22.22.0-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">12418e04b77a2c1137c2647a82575b946895b7fc9ae0b47193086ae6efb251f4</sum>
        </package>
        <package name="nodejs-npm" arch="x86_64" epoch="1" version="10.9.4" release="1.22.22.0.3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-npm-10.9.4-1.22.22.0.3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4058f97a56f0eb154eb483aa12b47ba74d5e840eb87d4d1339d0b20bddd8bad1</sum>
        </package>
        <package name="nodejs" arch="x86_64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-22.22.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">aa4b88728ebff319b824f7836234580a7184cb3a316d9811d8c4a5ee22878c1e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1831</id>
    <title>Moderate: qemu-kvm security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1831 (https://access.redhat.com/errata/RHSA-2026:1831), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qemu-kvm.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

* qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11234" id="CVE-2025-11234" type="cve" title="CVE-2025-11234" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401209" id="2401209" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1831" id="RLSA-2026:1831" type="self" title="RLSA-2026:1831" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1831" id="RHSA-2026:1831" type="vendor" title="Red Hat RHSA-2026:1831" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qemu-kvm-device-usb-host" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-usb-host-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">f87fdd2b244c471a5e8cbfe4587179c47d778bb55fa6731e9e52e9e730600c65</sum>
        </package>
        <package name="qemu-kvm-ui-egl-headless" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-ui-egl-headless-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">2c5829736f841afa5be470e144c28ee34346ecbb5a404be9a23d803ce7181809</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">aa0d134da8432d7c61bb86d1ebcf712a05ffd0f6f5ac2c4e90d0a67de71b8f48</sum>
        </package>
        <package name="qemu-kvm-audio-pa" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-audio-pa-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">e35e3e17762ec1d27d58f51fe07d92f55aa4a2e1669d9f8f120b34c8f2789850</sum>
        </package>
        <package name="qemu-pr-helper" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-pr-helper-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">80408401721b35773810732e6ab3d8766cba88762b8a65c38484fa00253d758b</sum>
        </package>
        <package name="qemu-kvm-block-blkio" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-block-blkio-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">c7bd05a9d8f8a525e1f9c31ea147bb6072674a84171769a234c4b1892f63984c</sum>
        </package>
        <package name="qemu-kvm-device-usb-redirect" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-usb-redirect-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">fecf054d61dfd7cc827a218ac53f8a2cfa2453dab7fb44d948aaf3f632966a14</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu-pci" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-pci-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">662334824dcda7324d8ae307e5878b9b2eff45670f970a487a1685e4a7a0abeb</sum>
        </package>
        <package name="qemu-kvm-ui-opengl" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-ui-opengl-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">98ca0652d9df86f8e2c9376754e4b0d2cb9e7501cec384adb35ca666c25ce167</sum>
        </package>
        <package name="qemu-kvm-tools" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-tools-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">b680d61e18933cd22076dac16176fec4403b060f252e0449959f00bce2438aaf</sum>
        </package>
        <package name="qemu-kvm-core" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-core-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">a0ff863204cab19d7981b3984416892191c3b004221eb57d27e24f8d1145b6dd</sum>
        </package>
        <package name="qemu-guest-agent" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-guest-agent-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">1182cdb32760eaa4b082d6ba7cb8b1d8710360de9b4adbf142f8266b4da8e8b6</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-vga" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-vga-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">5a6b2a6730bd3aac95b760b132630613aea82ecf7acce92193acb4b5c4cc9521</sum>
        </package>
        <package name="qemu-kvm-docs" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-docs-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">9a2966ed7ea381c009b84efa4097d5d3277c0440c4c78382b2b00735749cbb8b</sum>
        </package>
        <package name="qemu-kvm-block-curl" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-block-curl-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">d219e8198b876097fbdfdf6212425ad7c9e7a4a4060770ee030adb1246e1f638</sum>
        </package>
        <package name="qemu-img" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-img-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">6cc93d0f9e281f2d1440f9af81e8a9d64cacad112891dfdc6f4ceba69550a5d6</sum>
        </package>
        <package name="qemu-kvm-block-rbd" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-block-rbd-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">110413b3589ff44a2b9298872a27af91fd39331005dfc365bf35bc07e4cb2a7c</sum>
        </package>
        <package name="qemu-kvm-common" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-common-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">15a67022c4d89f74686c18c52d680dd9f7f66a6fdfacac52934c80ac274a020e</sum>
        </package>
        <package name="qemu-kvm" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">0cac2f915783c817aafffb7e40ff9fd5ac813f70755d22311f5d712ca2ad40ca</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2182</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2026-02-07 09:09:45" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:2182 (https://access.redhat.com/errata/RHSA-2026:2182), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication (CVE-2026-0719)

* libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0719" id="CVE-2026-0719" type="cve" title="CVE-2026-0719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1761" id="CVE-2026-1761" type="cve" title="CVE-2026-1761" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2427906" id="2427906" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2435961" id="2435961" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2182" id="RLSA-2026:2182" type="self" title="RLSA-2026:2182" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:2182" id="RHSA-2026:2182" type="vendor" title="Red Hat RHSA-2026:2182" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.9" src="libsoup3-3.6.5-3.el10_1.9.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.9.x86_64.rpm</filename>
          <sum type="sha256">e9a92678a2b5dcec77fcc390be5165549df20219354c0e014ba6c31d127bec71</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.9" src="libsoup3-3.6.5-3.el10_1.9.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.9.x86_64.rpm</filename>
          <sum type="sha256">882b0b57482f0065dc023362d5c4ec442f9abbdced56aa5065097e79aa9b4ab5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2225</id>
    <title>Critical: keylime security update</title>
    <issued date="2026-02-11 09:16:03" />
    <updated date="2026-02-24 18:58:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:2225 (https://access.redhat.com/errata/RHSA-2026:2225), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>An update is available for keylime.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

* keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1709" id="CVE-2026-1709" type="cve" title="CVE-2026-1709" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2435514" id="2435514" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2225" id="RLSA-2026:2225" type="self" title="RLSA-2026:2225" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:2225" id="RHSA-2026:2225" type="vendor" title="Red Hat RHSA-2026:2225" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="keylime" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">62eb3a1759578ea026256fa1b9e268d8c62b3e791edff9e96aad123087656442</sum>
        </package>
        <package name="keylime-registrar" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-registrar-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">e9a1fe96f4accf6b1947cbd3f186238b933323e163246fbf3f28e917cf087abb</sum>
        </package>
        <package name="python3-keylime" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>python3-keylime-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">5af53f6130e6dc111be74fc036b61a8a7ba7364527609a52be3b9f928f648a01</sum>
        </package>
        <package name="keylime-selinux" arch="noarch" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-selinux-7.12.1-11.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">cf74ec0786a2fb42cf5d46aeb335f4a59596ac3b4c0f380088d7dc98a4912fed</sum>
        </package>
        <package name="keylime-tenant" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-tenant-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">71b93ce7f4c37db85f9f6a4cd8844ec0cfc68ce4ea7ad447059e21705cb80298</sum>
        </package>
        <package name="keylime-tools" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-tools-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">4fdb6b701d9831884dac60aa14de5406aeb5f0b1201298a056c1cc4c27fd0268</sum>
        </package>
        <package name="keylime-verifier" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-verifier-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">2a94093739648408d6db54ac71bc44384d20dd16cf5107a70bbc2fd6628fec92</sum>
        </package>
        <package name="keylime-base" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-base-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">436e06521ce5d159e39d227c84fb4f3ca948e85ede15725f29aa9af91e9f37ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2222</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-02-11 09:16:03" />
    <updated date="2026-02-24 18:58:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:2222 (https://access.redhat.com/errata/RHSA-2026:2222), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530)

* freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884)

* freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)

* freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533)

* freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531)

* freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534)

* freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23530" id="CVE-2026-23530" type="cve" title="CVE-2026-23530" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23531" id="CVE-2026-23531" type="cve" title="CVE-2026-23531" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23532" id="CVE-2026-23532" type="cve" title="CVE-2026-23532" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23533" id="CVE-2026-23533" type="cve" title="CVE-2026-23533" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23534" id="CVE-2026-23534" type="cve" title="CVE-2026-23534" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23883" id="CVE-2026-23883" type="cve" title="CVE-2026-23883" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23884" id="CVE-2026-23884" type="cve" title="CVE-2026-23884" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430880" id="2430880" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430886" id="2430886" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430885" id="2430885" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430891" id="2430891" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430877" id="2430877" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430887" id="2430887" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430888" id="2430888" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2222" id="RLSA-2026:2222" type="self" title="RLSA-2026:2222" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:2222" id="RHSA-2026:2222" type="vendor" title="Red Hat RHSA-2026:2222" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.1" src="freerdp-3.10.3-5.el10_1.1.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">58d1389647dac0fe3666bcda68dcdd68249d21c865298330920acedfc237b8a5</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.1" src="freerdp-3.10.3-5.el10_1.1.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">5a0bcaea3bf0df4a46089661f3d524e83e1fe6abb0fa74845ea9795360430f8b</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.1" src="freerdp-3.10.3-5.el10_1.1.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">5cfa78a7231209e47cd2cd0b10cd809474cdbd8bb7ace135d6fb34569716348a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2410</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2026-02-13 09:09:56" />
    <updated date="2026-02-26 20:49:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:2410 (https://access.redhat.com/errata/RHSA-2026:2410), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1761" id="CVE-2026-1761" type="cve" title="CVE-2026-1761" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2435961" id="2435961" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2410" id="RLSA-2026:2410" type="self" title="RLSA-2026:2410" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:2410" id="RHSA-2026:2410" type="vendor" title="Red Hat RHSA-2026:2410" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.10" src="libsoup3-3.6.5-3.el10_1.10.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.10.x86_64.rpm</filename>
          <sum type="sha256">dfb245438542b1b6a348ba498504beebc622a95d81e27121afc8d0a046fa0e31</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.10" src="libsoup3-3.6.5-3.el10_1.10.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.10.x86_64.rpm</filename>
          <sum type="sha256">6bfefa84caaec3d210215786e2e8810bd47d1d02492fbeaa3458d685ff127048</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2706</id>
    <title>Important: golang security update</title>
    <issued date="2026-02-17 09:08:42" />
    <updated date="2026-03-02 09:10:55" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:2706 (https://access.redhat.com/errata/RHSA-2026:2706), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61732" id="CVE-2025-61732" type="cve" title="CVE-2025-61732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437016" id="2437016" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2706" id="RLSA-2026:2706" type="self" title="RLSA-2026:2706" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:2706" id="RHSA-2026:2706" type="vendor" title="Red Hat RHSA-2026:2706" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang" arch="x86_64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-1.25.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">81db2b9314a04f3095031db47a9d8f3c94ecd8a36e6859dc8650429328a20b60</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e919b39c47979171d95fba6b72cbe2c625a403eb2d65dc8417c5a5b4cf5ef7de</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">30c746dab593cd0c646919439cd688eb19a9f442ea5c0905de14836f1b89c5d2</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cd491c0a88130a78c3d9540bf63a5b1f358c4e1a0de3f1c7c122d61b6b09e00e</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">27e6ef9ca5cf6b646ea3832990b77afbdef885afd9c6768c360cc95d1d5c87e1</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-race-1.25.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1ad6706399127eac0eaab787541fb2c4556c8430e935a8489f0e549345e1572c</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">a5c9084a174853dde1a972c47efc09986f37062a178d9846e02f2964cabc0bb6</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-src-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">f155d31640cca7f4abb754b982b9f359504bc9047e1852dc24d168bb3f631e68</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2914</id>
    <title>Important: grafana security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:2914 (https://access.redhat.com/errata/RHSA-2026:2914), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross?Dashboard Privilege Escalation (CVE-2026-21721)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21721" id="CVE-2026-21721" type="cve" title="CVE-2026-21721" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433242" id="2433242" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2914" id="RLSA-2026:2914" type="self" title="RLSA-2026:2914" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:2914" id="RHSA-2026:2914" type="vendor" title="Red Hat RHSA-2026:2914" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="22.el10_1" src="grafana-10.2.6-22.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-22.el10_1.x86_64.rpm</filename>
          <sum type="sha256">69d116bb11e3a0455568c0312c0dec6fe33e2a3f338dfa5d9721e490c7ccebd6</sum>
        </package>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="22.el10_1" src="grafana-10.2.6-22.el10_1.src.rpm">
          <filename>grafana-10.2.6-22.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7698bcdd197f7530a499fdb404176def1b17cfbd71ffb30081dcdf8902838ddf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3035</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3035 (https://access.redhat.com/errata/RHSA-2026:3035), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3035" id="RLSA-2026:3035" type="self" title="RLSA-2026:3035" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3035" id="RHSA-2026:3035" type="vendor" title="Red Hat RHSA-2026:3035" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-pcp" arch="x86_64" epoch="0" version="5.3.0" release="2.el10_1" src="grafana-pcp-5.3.0-2.el10_1.src.rpm">
          <filename>grafana-pcp-5.3.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1bec30fa1d1285a2b8a21b8668c0adab9db0f93f7c156e7c4daa04a588c3953d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3033</id>
    <title>Important: munge security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3033 (https://access.redhat.com/errata/RHSA-2026:3033), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for munge.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.

Security Fix(es):

* MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25506" id="CVE-2026-25506" type="cve" title="CVE-2026-25506" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438715" id="2438715" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3033" id="RLSA-2026:3033" type="self" title="RLSA-2026:3033" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3033" id="RHSA-2026:3033" type="vendor" title="Red Hat RHSA-2026:3033" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="munge-libs" arch="x86_64" epoch="0" version="0.5.15" release="11.el10_1" src="munge-0.5.15-11.el10_1.src.rpm">
          <filename>munge-libs-0.5.15-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">36fb45ac40af73ff5b8e96305582bc465a3dcdee8b509e402738bcfe4489ed3e</sum>
        </package>
        <package name="munge" arch="x86_64" epoch="0" version="0.5.15" release="11.el10_1" src="munge-0.5.15-11.el10_1.src.rpm">
          <filename>munge-0.5.15-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">60cc3e3fc68761fa7b108b1a207af91930bcf937b58a12c82f74eacfff360d95</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3068</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3068 (https://access.redhat.com/errata/RHSA-2026:3068), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22853)

* freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859)

* freerdp: FreeRDP: Denial of Service via use after free in ecam_channel_write (CVE-2026-24678)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22853" id="CVE-2026-22853" type="cve" title="CVE-2026-22853" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22855" id="CVE-2026-22855" type="cve" title="CVE-2026-22855" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22858" id="CVE-2026-22858" type="cve" title="CVE-2026-22858" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22859" id="CVE-2026-22859" type="cve" title="CVE-2026-22859" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24678" id="CVE-2026-24678" type="cve" title="CVE-2026-24678" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429653" id="2429653" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429649" id="2429649" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429647" id="2429647" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438197" id="2438197" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429645" id="2429645" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3068" id="RLSA-2026:3068" type="self" title="RLSA-2026:3068" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3068" id="RHSA-2026:3068" type="vendor" title="Red Hat RHSA-2026:3068" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.2" src="freerdp-3.10.3-5.el10_1.2.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">067b278c5ebbb71c0baf33f032ea9596e8751b8947b579a74c0c86e7bf5fe994</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.2" src="freerdp-3.10.3-5.el10_1.2.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">8300eb4b2fb4db3ce2bfe3992b7d2667440f6cf2acf18da3a0fad532a9e237f9</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.2" src="freerdp-3.10.3-5.el10_1.2.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">f11eb1d57995ed9934127962b7e68ed46e37c6595a6862ecefafdd71ed14917c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3092</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3092 (https://access.redhat.com/errata/RHSA-2026:3092), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3092" id="RLSA-2026:3092" type="self" title="RLSA-2026:3092" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3092" id="RHSA-2026:3092" type="vendor" title="Red Hat RHSA-2026:3092" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="5.el10_1" src="golang-github-openprinting-ipp-usb-0.9.27-5.el10_1.src.rpm">
          <filename>ipp-usb-0.9.27-5.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8888d69bb8115ae7dc3b1b7594367d17ffa3d3575d4b1e0e470a975e69f633a8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3094</id>
    <title>Important: protobuf security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3094 (https://access.redhat.com/errata/RHSA-2026:3094), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for protobuf.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.

Security Fix(es):

* python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0994" id="CVE-2026-0994" type="cve" title="CVE-2026-0994" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2432398" id="2432398" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3094" id="RLSA-2026:3094" type="self" title="RLSA-2026:3094" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3094" id="RHSA-2026:3094" type="vendor" title="Red Hat RHSA-2026:3094" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-protobuf" arch="x86_64" epoch="0" version="3.19.6" release="15.el10_1" src="protobuf-3.19.6-15.el10_1.src.rpm">
          <filename>python3-protobuf-3.19.6-15.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1ab7d1cd924f808e8cc4e40f912949d91b213a137d996ccccb0a9257d2d4eb19</sum>
        </package>
        <package name="protobuf" arch="x86_64" epoch="0" version="3.19.6" release="15.el10_1" src="protobuf-3.19.6-15.el10_1.src.rpm">
          <filename>protobuf-3.19.6-15.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8163275f67eb66ab63faa6fb334dbb6887cb5a467e3a8cdac7da6ed61e8ba86f</sum>
        </package>
        <package name="protobuf-lite" arch="x86_64" epoch="0" version="3.19.6" release="15.el10_1" src="protobuf-3.19.6-15.el10_1.src.rpm">
          <filename>protobuf-lite-3.19.6-15.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1f62a6df4a8eb547595f9523a2515665c7557e3488c451cb9d223d4f868369f2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3208</id>
    <title>Moderate: 389-ds-base security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3208 (https://access.redhat.com/errata/RHSA-2026:3208), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for 389-ds-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14905" id="CVE-2025-14905" type="cve" title="CVE-2025-14905" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2423624" id="2423624" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3208" id="RLSA-2026:3208" type="self" title="RLSA-2026:3208" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3208" id="RHSA-2026:3208" type="vendor" title="Red Hat RHSA-2026:3208" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="389-ds-base" arch="x86_64" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>389-ds-base-3.1.3-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d8417f093ec7f287ce02ca02b2bee0e9157b4b1492247dc27e9ecc1f8761d331</sum>
        </package>
        <package name="389-ds-base-libs" arch="x86_64" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>389-ds-base-libs-3.1.3-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">6d8d1dd9f46e4bcd0a6bcdb3fc8563cafb6f933912c11d4f30b0aeda8b8541e0</sum>
        </package>
        <package name="389-ds-base-snmp" arch="x86_64" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>389-ds-base-snmp-3.1.3-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">813419ef0afd252f43c8bad687d102de3acd2362c6727688ec59e6b704317565</sum>
        </package>
        <package name="python3-lib389" arch="noarch" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>python3-lib389-3.1.3-7.el10_1.noarch.rpm</filename>
          <sum type="sha256">3de41c1f87bf374e89d73ff11abb7793efb0c38be054059155cde52dc2d29e48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3297</id>
    <title>Important: buildah security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3297 (https://access.redhat.com/errata/RHSA-2026:3297), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3297" id="RLSA-2026:3297" type="self" title="RLSA-2026:3297" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3297" id="RHSA-2026:3297" type="vendor" title="Red Hat RHSA-2026:3297" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah" arch="x86_64" epoch="2" version="1.41.8" release="2.el10_1" src="buildah-1.41.8-2.el10_1.src.rpm">
          <filename>buildah-1.41.8-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">487d17bf6f1dde78c174fb25d2db606feb88ca3a86d3489f4cc0004d85732678</sum>
        </package>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.41.8" release="2.el10_1" src="buildah-1.41.8-2.el10_1.src.rpm">
          <filename>buildah-tests-1.41.8-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">85e895acf869d4065e76486418ca25ea60e15a3187fed762f4b446e3a9911f58</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3336</id>
    <title>Important: podman security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3336 (https://access.redhat.com/errata/RHSA-2026:3336), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3336" id="RLSA-2026:3336" type="self" title="RLSA-2026:3336" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3336" id="RHSA-2026:3336" type="vendor" title="Red Hat RHSA-2026:3336" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.6.0" release="12.el10_1" src="podman-5.6.0-12.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ce7a01d1c6fd9274194fb2e30f823c74bdc3c50c320292a763ecb95e0b1d1a99</sum>
        </package>
        <package name="podman" arch="x86_64" epoch="7" version="5.6.0" release="12.el10_1" src="podman-5.6.0-12.el10_1.src.rpm">
          <filename>podman-5.6.0-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">959c3a3141f194118d11d1aad559afc230989fe61af6ffc378a4748fca3626a3</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="12.el10_1" src="podman-5.6.0-12.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">2dd7bd90122e6ba9f8bd5e0acc65c7395f2d0160075dfdf770e2df9ff4cb4f41</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3343</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3343 (https://access.redhat.com/errata/RHSA-2026:3343), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3343" id="RLSA-2026:3343" type="self" title="RLSA-2026:3343" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3343" id="RHSA-2026:3343" type="vendor" title="Red Hat RHSA-2026:3343" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.20.0" release="3.el10_1" src="skopeo-1.20.0-3.el10_1.src.rpm">
          <filename>skopeo-tests-1.20.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">bab0f80a1af729a0cf71e4b9db0891477a65862b35e54993b06783f8c4df2406</sum>
        </package>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.20.0" release="3.el10_1" src="skopeo-1.20.0-3.el10_1.src.rpm">
          <filename>skopeo-1.20.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">04ae842d360de62f8b2124b89818c8044418148e456cbe6b693cc74bee53fe72</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3354</id>
    <title>Important: python-pyasn1 security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3354 (https://access.redhat.com/errata/RHSA-2026:3354), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-pyasn1.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23490" id="CVE-2026-23490" type="cve" title="CVE-2026-23490" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430472" id="2430472" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3354" id="RLSA-2026:3354" type="self" title="RLSA-2026:3354" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3354" id="RHSA-2026:3354" type="vendor" title="Red Hat RHSA-2026:3354" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-pyasn1-modules" arch="noarch" epoch="0" version="0.6.2" release="1.el10_1" src="python-pyasn1-0.6.2-1.el10_1.src.rpm">
          <filename>python3-pyasn1-modules-0.6.2-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">1c60e78956141e52bf419861d056c95bcbddda4c480f855146d603ddf86e41e1</sum>
        </package>
        <package name="python3-pyasn1" arch="noarch" epoch="0" version="0.6.2" release="1.el10_1" src="python-pyasn1-0.6.2-1.el10_1.src.rpm">
          <filename>python3-pyasn1-0.6.2-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">ce218548da8b604e37639340da121a27df8b87cc1901835fb99135a70de2dfd1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3361</id>
    <title>Important: firefox security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3361 (https://access.redhat.com/errata/RHSA-2026:3361), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

* firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785)

* firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793)

* firefox: Undefined behavior in the DOM: Core &amp; HTML component (CVE-2026-2771)

* firefox: Integer overflow in the Audio/Video component (CVE-2026-2774)

* firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776)

* firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781)

* firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766)

* firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769)

* firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787)

* firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768)

* firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783)

* firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784)

* firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759)

* firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762)

* firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761)

* firefox: Privilege escalation in the Messaging System component (CVE-2026-2777)

* firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790)

* firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763)

* firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792)

* firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786)

* firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760)

* firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772)

* firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779)

* firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767)

* firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780)

* firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core &amp; HTML component (CVE-2026-2778)

* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758)

* firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791)

* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447" id="CVE-2026-2447" type="cve" title="CVE-2026-2447" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2757" id="CVE-2026-2757" type="cve" title="CVE-2026-2757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2758" id="CVE-2026-2758" type="cve" title="CVE-2026-2758" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2759" id="CVE-2026-2759" type="cve" title="CVE-2026-2759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2760" id="CVE-2026-2760" type="cve" title="CVE-2026-2760" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2761" id="CVE-2026-2761" type="cve" title="CVE-2026-2761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2762" id="CVE-2026-2762" type="cve" title="CVE-2026-2762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2763" id="CVE-2026-2763" type="cve" title="CVE-2026-2763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2764" id="CVE-2026-2764" type="cve" title="CVE-2026-2764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2765" id="CVE-2026-2765" type="cve" title="CVE-2026-2765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2766" id="CVE-2026-2766" type="cve" title="CVE-2026-2766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2767" id="CVE-2026-2767" type="cve" title="CVE-2026-2767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2768" id="CVE-2026-2768" type="cve" title="CVE-2026-2768" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2769" id="CVE-2026-2769" type="cve" title="CVE-2026-2769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2770" id="CVE-2026-2770" type="cve" title="CVE-2026-2770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2771" id="CVE-2026-2771" type="cve" title="CVE-2026-2771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2772" id="CVE-2026-2772" type="cve" title="CVE-2026-2772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2773" id="CVE-2026-2773" type="cve" title="CVE-2026-2773" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2774" id="CVE-2026-2774" type="cve" title="CVE-2026-2774" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2775" id="CVE-2026-2775" type="cve" title="CVE-2026-2775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2776" id="CVE-2026-2776" type="cve" title="CVE-2026-2776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2777" id="CVE-2026-2777" type="cve" title="CVE-2026-2777" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2778" id="CVE-2026-2778" type="cve" title="CVE-2026-2778" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2779" id="CVE-2026-2779" type="cve" title="CVE-2026-2779" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2780" id="CVE-2026-2780" type="cve" title="CVE-2026-2780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2781" id="CVE-2026-2781" type="cve" title="CVE-2026-2781" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2782" id="CVE-2026-2782" type="cve" title="CVE-2026-2782" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2783" id="CVE-2026-2783" type="cve" title="CVE-2026-2783" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2784" id="CVE-2026-2784" type="cve" title="CVE-2026-2784" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2785" id="CVE-2026-2785" type="cve" title="CVE-2026-2785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2786" id="CVE-2026-2786" type="cve" title="CVE-2026-2786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2787" id="CVE-2026-2787" type="cve" title="CVE-2026-2787" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2788" id="CVE-2026-2788" type="cve" title="CVE-2026-2788" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2789" id="CVE-2026-2789" type="cve" title="CVE-2026-2789" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2790" id="CVE-2026-2790" type="cve" title="CVE-2026-2790" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2791" id="CVE-2026-2791" type="cve" title="CVE-2026-2791" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2792" id="CVE-2026-2792" type="cve" title="CVE-2026-2792" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2793" id="CVE-2026-2793" type="cve" title="CVE-2026-2793" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442331" id="2442331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442337" id="2442337" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442322" id="2442322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442295" id="2442295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442292" id="2442292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442343" id="2442343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442290" id="2442290" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442307" id="2442307" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442316" id="2442316" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442304" id="2442304" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442328" id="2442328" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442335" id="2442335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442318" id="2442318" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442342" id="2442342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442288" id="2442288" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442325" id="2442325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442320" id="2442320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442291" id="2442291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442314" id="2442314" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442312" id="2442312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442297" id="2442297" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442324" id="2442324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442319" id="2442319" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442327" id="2442327" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442300" id="2442300" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442313" id="2442313" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442284" id="2442284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442287" id="2442287" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442308" id="2442308" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442298" id="2442298" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442294" id="2442294" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440219" id="2440219" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442333" id="2442333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442309" id="2442309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442334" id="2442334" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442329" id="2442329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442326" id="2442326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442302" id="2442302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3361" id="RLSA-2026:3361" type="self" title="RLSA-2026:3361" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3361" id="RHSA-2026:3361" type="vendor" title="Red Hat RHSA-2026:3361" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.8.0" release="2.el10_1" src="firefox-140.8.0-2.el10_1.src.rpm">
          <filename>firefox-140.8.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a944bc24190bf48df069e9c11e078a5ae04773e24718bea263386cb7f608dfad</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3443</id>
    <title>Important: valkey security update</title>
    <issued date="2026-02-28 09:08:38" />
    <updated date="2026-03-14 06:06:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3443 (https://access.redhat.com/errata/RHSA-2026:3443), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts (CVE-2025-67733)

* valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67733" id="CVE-2025-67733" type="cve" title="CVE-2025-67733" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21863" id="CVE-2026-21863" type="cve" title="CVE-2026-21863" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442025" id="2442025" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442026" id="2442026" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3443" id="RLSA-2026:3443" type="self" title="RLSA-2026:3443" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3443" id="RHSA-2026:3443" type="vendor" title="Red Hat RHSA-2026:3443" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.7" release="1.el10_1" src="valkey-8.0.7-1.el10_1.src.rpm">
          <filename>valkey-devel-8.0.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">80335402f592eaf2a707b0e7c4aae259d8e1d8d7dafd7a013d8bd4939ef9b8c7</sum>
        </package>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.7" release="1.el10_1" src="valkey-8.0.7-1.el10_1.src.rpm">
          <filename>valkey-8.0.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4347ca6fa7aa18c96a78a39b6975fbdd9182d68e1184619c8b098e847879d8d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3476</id>
    <title>Important: udisks2 security update</title>
    <issued date="2026-03-05 09:12:24" />
    <updated date="2026-03-19 06:08:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3476 (https://access.redhat.com/errata/RHSA-2026:3476), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for udisks2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.

Security Fix(es):

* udisks: Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API (CVE-2026-26104)

* udisks: Missing Authorization Check Allows Unprivileged Users to Restore LUKS Headers via udisks D-Bus API (CVE-2026-26103)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26103" id="CVE-2026-26103" type="cve" title="CVE-2026-26103" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26104" id="CVE-2026-26104" type="cve" title="CVE-2026-26104" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433719" id="2433719" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433717" id="2433717" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3476" id="RLSA-2026:3476" type="self" title="RLSA-2026:3476" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3476" id="RHSA-2026:3476" type="vendor" title="Red Hat RHSA-2026:3476" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="udisks2" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">5dc13f37724ce55e3aa71f9f969f7ae4a53b7ea5217ef0d760efa67eac81037f</sum>
        </package>
        <package name="udisks2-iscsi" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-iscsi-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">c571842faf525f4f7c3ed1e7c262b677bb69629d5eecab7419599c72282837d2</sum>
        </package>
        <package name="udisks2-lsm" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-lsm-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">3ff722dccb439a7c683e878205491d6463a7678d7c1ea21cd4fa61f425d7a547</sum>
        </package>
        <package name="udisks2-lvm2" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-lvm2-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">93b067c439621c4fe506b46e36bba1e62693b9b231b81a1b1d1b7d69d647ccca</sum>
        </package>
        <package name="libudisks2" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>libudisks2-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">7fdedfe10915f0a731e4fb51244c60438e03b9034d1eeba925beb9d0af87b6fa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3517</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-03-05 09:12:24" />
    <updated date="2026-03-19 06:08:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3517 (https://access.redhat.com/errata/RHSA-2026:3517), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

* firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785)

* firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793)

* firefox: Undefined behavior in the DOM: Core &amp; HTML component (CVE-2026-2771)

* firefox: Integer overflow in the Audio/Video component (CVE-2026-2774)

* firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776)

* firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781)

* firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766)

* firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769)

* firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787)

* firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768)

* firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783)

* firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784)

* firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759)

* firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762)

* firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761)

* firefox: Privilege escalation in the Messaging System component (CVE-2026-2777)

* firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790)

* firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763)

* firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792)

* firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786)

* firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760)

* firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772)

* firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779)

* firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767)

* firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780)

* firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core &amp; HTML component (CVE-2026-2778)

* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758)

* firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791)

* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447" id="CVE-2026-2447" type="cve" title="CVE-2026-2447" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2757" id="CVE-2026-2757" type="cve" title="CVE-2026-2757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2758" id="CVE-2026-2758" type="cve" title="CVE-2026-2758" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2759" id="CVE-2026-2759" type="cve" title="CVE-2026-2759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2760" id="CVE-2026-2760" type="cve" title="CVE-2026-2760" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2761" id="CVE-2026-2761" type="cve" title="CVE-2026-2761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2762" id="CVE-2026-2762" type="cve" title="CVE-2026-2762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2763" id="CVE-2026-2763" type="cve" title="CVE-2026-2763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2764" id="CVE-2026-2764" type="cve" title="CVE-2026-2764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2765" id="CVE-2026-2765" type="cve" title="CVE-2026-2765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2766" id="CVE-2026-2766" type="cve" title="CVE-2026-2766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2767" id="CVE-2026-2767" type="cve" title="CVE-2026-2767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2768" id="CVE-2026-2768" type="cve" title="CVE-2026-2768" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2769" id="CVE-2026-2769" type="cve" title="CVE-2026-2769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2770" id="CVE-2026-2770" type="cve" title="CVE-2026-2770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2771" id="CVE-2026-2771" type="cve" title="CVE-2026-2771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2772" id="CVE-2026-2772" type="cve" title="CVE-2026-2772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2773" id="CVE-2026-2773" type="cve" title="CVE-2026-2773" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2774" id="CVE-2026-2774" type="cve" title="CVE-2026-2774" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2775" id="CVE-2026-2775" type="cve" title="CVE-2026-2775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2776" id="CVE-2026-2776" type="cve" title="CVE-2026-2776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2777" id="CVE-2026-2777" type="cve" title="CVE-2026-2777" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2778" id="CVE-2026-2778" type="cve" title="CVE-2026-2778" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2779" id="CVE-2026-2779" type="cve" title="CVE-2026-2779" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2780" id="CVE-2026-2780" type="cve" title="CVE-2026-2780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2781" id="CVE-2026-2781" type="cve" title="CVE-2026-2781" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2782" id="CVE-2026-2782" type="cve" title="CVE-2026-2782" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2783" id="CVE-2026-2783" type="cve" title="CVE-2026-2783" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2784" id="CVE-2026-2784" type="cve" title="CVE-2026-2784" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2785" id="CVE-2026-2785" type="cve" title="CVE-2026-2785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2786" id="CVE-2026-2786" type="cve" title="CVE-2026-2786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2787" id="CVE-2026-2787" type="cve" title="CVE-2026-2787" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2788" id="CVE-2026-2788" type="cve" title="CVE-2026-2788" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2789" id="CVE-2026-2789" type="cve" title="CVE-2026-2789" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2790" id="CVE-2026-2790" type="cve" title="CVE-2026-2790" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2791" id="CVE-2026-2791" type="cve" title="CVE-2026-2791" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2792" id="CVE-2026-2792" type="cve" title="CVE-2026-2792" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2793" id="CVE-2026-2793" type="cve" title="CVE-2026-2793" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442331" id="2442331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442337" id="2442337" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442322" id="2442322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442295" id="2442295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442292" id="2442292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442343" id="2442343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442290" id="2442290" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442307" id="2442307" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442316" id="2442316" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442304" id="2442304" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442328" id="2442328" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442335" id="2442335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442318" id="2442318" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442342" id="2442342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442288" id="2442288" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442325" id="2442325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442320" id="2442320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442291" id="2442291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442314" id="2442314" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442312" id="2442312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442297" id="2442297" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442324" id="2442324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442319" id="2442319" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442327" id="2442327" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442300" id="2442300" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442313" id="2442313" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442284" id="2442284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442287" id="2442287" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442308" id="2442308" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442298" id="2442298" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442294" id="2442294" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440219" id="2440219" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442333" id="2442333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442309" id="2442309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442334" id="2442334" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442329" id="2442329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442326" id="2442326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442302" id="2442302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3517" id="RLSA-2026:3517" type="self" title="RLSA-2026:3517" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3517" id="RHSA-2026:3517" type="vendor" title="Red Hat RHSA-2026:3517" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.8.0" release="2.el10_1" src="thunderbird-140.8.0-2.el10_1.src.rpm">
          <filename>thunderbird-140.8.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b8470174fc8f00d83cf6917570f600ccf3f799d0132eb60b6c497a7bd448f707</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3669</id>
    <title>Important: go-rpm-macros security update</title>
    <issued date="2026-03-05 09:12:24" />
    <updated date="2026-03-19 06:08:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3669 (https://access.redhat.com/errata/RHSA-2026:3669), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-rpm-macros.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages.  It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3669" id="RLSA-2026:3669" type="self" title="RLSA-2026:3669" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3669" id="RHSA-2026:3669" type="vendor" title="Red Hat RHSA-2026:3669" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-srpm-macros" arch="noarch" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-srpm-macros-3.6.0-7.el10_1.noarch.rpm</filename>
          <sum type="sha256">fc47fdd7894de333af41c359159c250478c82358fff84549f21a5b18fb3f2448</sum>
        </package>
        <package name="go-rpm-templates" arch="x86_64" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-rpm-templates-3.6.0-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c6703a81330552b99348d8fa32f8bfab4313015b57b5b05f2945cc4e1ea407c0</sum>
        </package>
        <package name="go-filesystem" arch="x86_64" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-filesystem-3.6.0-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b7febe578e988ebec2579f4452cd4ae65fa413216a7fc676fe5d9ad8c123ac9a</sum>
        </package>
        <package name="go-rpm-macros" arch="x86_64" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-rpm-macros-3.6.0-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8fef469c81e67e0cb7f45ee19d94cb76804da84790a4c71de329a4fb27520b7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3887</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-03-06 06:05:39" />
    <updated date="2026-03-20 06:07:20" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3887 (https://access.redhat.com/errata/RHSA-2026:3887), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)

* postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)

* postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439326" id="2439326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439324" id="2439324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439325" id="2439325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439322" id="2439322" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3887" id="RLSA-2026:3887" type="self" title="RLSA-2026:3887" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3887" id="RHSA-2026:3887" type="vendor" title="Red Hat RHSA-2026:3887" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postgresql-upgrade" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">bbaa940c2772c32ab0d8f9aba06946b5b3240dd92a4465fe116791fb9464643c</sum>
        </package>
        <package name="postgresql-pltcl" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-pltcl-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f1148225856b3a23c615ac3353637f376dc5f722b5ffe0b55f9836097dc7248c</sum>
        </package>
        <package name="postgresql-contrib" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-contrib-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e3db43a735eeb2dc9d338884656f564572c46054ca194bce2bebbab209feae5c</sum>
        </package>
        <package name="postgresql-server-devel" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-devel-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ecc05602fbd70b728d5650dbe55ebef287e198d7e14ded1c5dea917c305e3e24</sum>
        </package>
        <package name="postgresql-server" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d6016a2a5606030f1d91f9ca8b6f6702f01298e165f30ae80f0562b9562050f2</sum>
        </package>
        <package name="postgresql-private-devel" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-devel-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ac082bb70390f1a58feb81e556ebd34ded9b73bcffeba8e4fb7b6f346e4d1d23</sum>
        </package>
        <package name="postgresql-private-libs" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-libs-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b7f5141db1187e4c9c3b31f6a063b767c1351750ab19b942c005177bec91ee79</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-devel-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b8e915b2f81e3d4162a0af085764f10dbf7275b34786b6b1c4a0c5f887efc655</sum>
        </package>
        <package name="postgresql-docs" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-docs-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">dc6c0ea794ef7caad8e64b534461785279963853bce3dd17aa614685ddc8143e</sum>
        </package>
        <package name="postgresql-test" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-test-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c8ff7236899a608a19742e89f157b3c954b5325ec6e98693c30fb874292ce4f1</sum>
        </package>
        <package name="postgresql-plpython3" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plpython3-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4d206b98eacba4020c3afb216f927dc9cb6a3510c90f6de3309abfbf18b927dc</sum>
        </package>
        <package name="postgresql-plperl" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plperl-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b7e62f6de8b1072d727098bacc7c0821f54717e8d6edcc102750f438978ffa5e</sum>
        </package>
        <package name="postgresql" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">eb97f78910abd34961a6832e0caa67d88313db86a4061df178de114b696a905f</sum>
        </package>
        <package name="postgresql-static" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-static-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">588f6e8ba3097e363bc170fe8fc744eaf01ddf2d1d2bd73408da34f5f48e29ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3864</id>
    <title>Important: delve security update</title>
    <issued date="2026-03-07 12:07:41" />
    <updated date="2026-03-21 12:09:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3864 (https://access.redhat.com/errata/RHSA-2026:3864), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3864" id="RLSA-2026:3864" type="self" title="RLSA-2026:3864" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3864" id="RHSA-2026:3864" type="vendor" title="Red Hat RHSA-2026:3864" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.25.2" release="2.el10_1" src="delve-1.25.2-2.el10_1.src.rpm">
          <filename>delve-1.25.2-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7b6c422f73a96b10a57ccfc7c6b1717484b4d44220609af825f8eea3536cdca7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4164</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-03-11 12:08:24" />
    <updated date="2026-03-25 12:11:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:4164 (https://access.redhat.com/errata/RHSA-2026:4164), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4164" id="RLSA-2026:4164" type="self" title="RLSA-2026:4164" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:4164" id="RHSA-2026:4164" type="vendor" title="Red Hat RHSA-2026:4164" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git-lfs" arch="x86_64" epoch="0" version="3.6.1" release="7.el10_1" src="git-lfs-3.6.1-7.el10_1.src.rpm">
          <filename>git-lfs-3.6.1-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">befdf1a94e2bea7adf98bbe5da2326b60e9027cb5716b7ca2b2d18a1a96b8693</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4629</id>
    <title>Important: libvpx security update</title>
    <issued date="2026-03-17 12:07:50" />
    <updated date="2026-03-31 12:09:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:4629 (https://access.redhat.com/errata/RHSA-2026:4629), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libvpx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447" id="CVE-2026-2447" type="cve" title="CVE-2026-2447" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440219" id="2440219" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4629" id="RLSA-2026:4629" type="self" title="RLSA-2026:4629" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:4629" id="RHSA-2026:4629" type="vendor" title="Red Hat RHSA-2026:4629" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libvpx" arch="x86_64" epoch="0" version="1.14.1" release="6.el10_1" src="libvpx-1.14.1-6.el10_1.src.rpm">
          <filename>libvpx-1.14.1-6.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c1f3df9da63f18b383962c7c3af74e8098a0bd0426b1b79f61ab939c55e80276</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4705</id>
    <title>Moderate: nginx security update</title>
    <issued date="2026-03-27 12:07:50" />
    <updated date="2026-04-10 12:09:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:4705 (https://access.redhat.com/errata/RHSA-2026:4705), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1642" id="CVE-2026-1642" type="cve" title="CVE-2026-1642" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2436738" id="2436738" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4705" id="RLSA-2026:4705" type="self" title="RLSA-2026:4705" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:4705" id="RHSA-2026:4705" type="vendor" title="Red Hat RHSA-2026:4705" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nginx" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">498543a275456947be44f55d91f4a06047e0b315e9babf0f83817609d02e20d6</sum>
        </package>
        <package name="nginx-mod-mail" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-mail-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">07c352330fcff14c16ce2d2ce941ba37aa55f0f49833af2b7e782879d5821b22</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7e76cb403bcead9e42662d15999bcab1c66179ad64017b63fa73723f038944ef</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0383e8dc3d9471b59e4ef12b15bbe16d7b8232c6df14089f7a22561743d18119</sum>
        </package>
        <package name="nginx-mod-stream" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-stream-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7c3cf19faae15b1d48bdc52b22af825cd8f1f2ae2ac6b24a7dd4edc7191a87e3</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-filesystem-1.26.3-2.el10_1.noarch.rpm</filename>
          <sum type="sha256">2e48093d794898fb1642f0bb71e0ef1f0e0e446a3654319b193ad44620e105ff</sum>
        </package>
        <package name="nginx-core" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-core-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1b527fb832d44e1d1365949c5c0068f8f2c2cb676ea39cdd6de92188196d15c1</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b47594564200ef32425618098e855b8c03f8233bd88b8b204a9dc7b0d7478961</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-all-modules-1.26.3-2.el10_1.noarch.rpm</filename>
          <sum type="sha256">181b674c0cd77cd494499242f41b59c06a0b49baa0cbdc38f09807c1f0e6723d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5145</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-03-27 12:07:50" />
    <updated date="2026-04-10 12:09:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:5145 (https://access.redhat.com/errata/RHSA-2026:5145), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5145" id="RLSA-2026:5145" type="self" title="RLSA-2026:5145" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:5145" id="RHSA-2026:5145" type="vendor" title="Red Hat RHSA-2026:5145" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="x86_64" epoch="0" version="0.2.3" release="4.el10_1" src="yggdrasil-worker-package-manager-0.2.3-4.el10_1.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">db4f7c1cd0b9a3d113bdba1d47dc1d65ed1830f99098871388e57e5910f0bd86</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5146</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-03-27 12:07:50" />
    <updated date="2026-04-10 12:09:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:5146 (https://access.redhat.com/errata/RHSA-2026:5146), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5146" id="RLSA-2026:5146" type="self" title="RLSA-2026:5146" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:5146" id="RHSA-2026:5146" type="vendor" title="Red Hat RHSA-2026:5146" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.8" release="3.el10_1" src="yggdrasil-0.4.8-3.el10_1.src.rpm">
          <filename>yggdrasil-0.4.8-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">eae31e27a9f8352c1d22812af68894c4a727dbe93ad56514c040921b47cbef98</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5931</id>
    <title>Important: firefox security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:5931 (https://access.redhat.com/errata/RHSA-2026:5931), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

* firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

* firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)

* firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

* firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

* firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)

* firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)

* firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

* firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4684" id="CVE-2026-4684" type="cve" title="CVE-2026-4684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4685" id="CVE-2026-4685" type="cve" title="CVE-2026-4685" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4686" id="CVE-2026-4686" type="cve" title="CVE-2026-4686" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4687" id="CVE-2026-4687" type="cve" title="CVE-2026-4687" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4688" id="CVE-2026-4688" type="cve" title="CVE-2026-4688" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4689" id="CVE-2026-4689" type="cve" title="CVE-2026-4689" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4690" id="CVE-2026-4690" type="cve" title="CVE-2026-4690" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4691" id="CVE-2026-4691" type="cve" title="CVE-2026-4691" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4692" id="CVE-2026-4692" type="cve" title="CVE-2026-4692" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4693" id="CVE-2026-4693" type="cve" title="CVE-2026-4693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4694" id="CVE-2026-4694" type="cve" title="CVE-2026-4694" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4695" id="CVE-2026-4695" type="cve" title="CVE-2026-4695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4696" id="CVE-2026-4696" type="cve" title="CVE-2026-4696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4697" id="CVE-2026-4697" type="cve" title="CVE-2026-4697" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4698" id="CVE-2026-4698" type="cve" title="CVE-2026-4698" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4699" id="CVE-2026-4699" type="cve" title="CVE-2026-4699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4700" id="CVE-2026-4700" type="cve" title="CVE-2026-4700" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4701" id="CVE-2026-4701" type="cve" title="CVE-2026-4701" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4702" id="CVE-2026-4702" type="cve" title="CVE-2026-4702" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4704" id="CVE-2026-4704" type="cve" title="CVE-2026-4704" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4705" id="CVE-2026-4705" type="cve" title="CVE-2026-4705" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4706" id="CVE-2026-4706" type="cve" title="CVE-2026-4706" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4707" id="CVE-2026-4707" type="cve" title="CVE-2026-4707" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4708" id="CVE-2026-4708" type="cve" title="CVE-2026-4708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4709" id="CVE-2026-4709" type="cve" title="CVE-2026-4709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4710" id="CVE-2026-4710" type="cve" title="CVE-2026-4710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4711" id="CVE-2026-4711" type="cve" title="CVE-2026-4711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4712" id="CVE-2026-4712" type="cve" title="CVE-2026-4712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4713" id="CVE-2026-4713" type="cve" title="CVE-2026-4713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4714" id="CVE-2026-4714" type="cve" title="CVE-2026-4714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4715" id="CVE-2026-4715" type="cve" title="CVE-2026-4715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4716" id="CVE-2026-4716" type="cve" title="CVE-2026-4716" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4717" id="CVE-2026-4717" type="cve" title="CVE-2026-4717" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4718" id="CVE-2026-4718" type="cve" title="CVE-2026-4718" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4719" id="CVE-2026-4719" type="cve" title="CVE-2026-4719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4720" id="CVE-2026-4720" type="cve" title="CVE-2026-4720" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4721" id="CVE-2026-4721" type="cve" title="CVE-2026-4721" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450733" id="2450733" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450741" id="2450741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450744" id="2450744" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450752" id="2450752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450747" id="2450747" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450738" id="2450738" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450710" id="2450710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450755" id="2450755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450725" id="2450725" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450739" id="2450739" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450726" id="2450726" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450714" id="2450714" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450727" id="2450727" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450723" id="2450723" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450724" id="2450724" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450734" id="2450734" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450748" id="2450748" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450757" id="2450757" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450730" id="2450730" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450713" id="2450713" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450711" id="2450711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450719" id="2450719" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450729" id="2450729" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450722" id="2450722" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450720" id="2450720" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450712" id="2450712" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450718" id="2450718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450751" id="2450751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450735" id="2450735" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450721" id="2450721" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450715" id="2450715" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450732" id="2450732" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450742" id="2450742" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450746" id="2450746" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450756" id="2450756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450740" id="2450740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450728" id="2450728" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5931" id="RLSA-2026:5931" type="self" title="RLSA-2026:5931" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:5931" id="RHSA-2026:5931" type="vendor" title="Red Hat RHSA-2026:5931" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.9.0" release="1.el10_1" src="firefox-140.9.0-1.el10_1.src.rpm">
          <filename>firefox-140.9.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9d315f7df09caa192229ca640859f9ed48b8ac59db82ec0f2c70c15a4c2074a9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5941</id>
    <title>Important: golang security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:5941 (https://access.redhat.com/errata/RHSA-2026:5941), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61731" id="CVE-2025-61731" type="cve" title="CVE-2025-61731" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434433" id="2434433" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5941" id="RLSA-2026:5941" type="self" title="RLSA-2026:5941" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:5941" id="RHSA-2026:5941" type="vendor" title="Red Hat RHSA-2026:5941" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">fc8f1a185cef97ab179b3b1477bf13405134c6388c1ed1be6bda5f9d4d816926</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-1.25.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">69af4d4d301da0021c57721594129ba0b6197de366743e26d5d4cc75a3eafe11</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-race-1.25.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">50271359e86ee3f4af7190e19491ebe0ead2c0fb1df2966a8ae9f8bb956fd6ef</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">827d2ee8ef54c00bb4f8440cdcfb6108a00df6f0131c46153600b63e90f61903</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5241e0d9bf410d518e2b0d6117ef492dad4d53497567cee2904641372f98df04</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">db3ff67272fcaf8c30871aa3c5e138379325eaf9acb04905b84eb2e7ed68db4b</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">fc08056daced4942367d12f1740d6eb3537d643175a8a7a443a4ea76dc5195e4</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-src-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e5958f50c1ecb5d498b5fd89b07951b2dc97e9b4f8975f25537fb7f9a97136be</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6259</id>
    <title>Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:6259 (https://access.redhat.com/errata/RHSA-2026:6259), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-plugins-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

* GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)

* GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)

* GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)

* GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2920" id="CVE-2026-2920" type="cve" title="CVE-2026-2920" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2921" id="CVE-2026-2921" type="cve" title="CVE-2026-2921" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2922" id="CVE-2026-2922" type="cve" title="CVE-2026-2922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2923" id="CVE-2026-2923" type="cve" title="CVE-2026-2923" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3082" id="CVE-2026-3082" type="cve" title="CVE-2026-3082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3083" id="CVE-2026-3083" type="cve" title="CVE-2026-3083" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3085" id="CVE-2026-3085" type="cve" title="CVE-2026-3085" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447496" id="2447496" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447492" id="2447492" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447495" id="2447495" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447498" id="2447498" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447503" id="2447503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447490" id="2447490" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447500" id="2447500" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6259" id="RLSA-2026:6259" type="self" title="RLSA-2026:6259" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:6259" id="RHSA-2026:6259" type="vendor" title="Red Hat RHSA-2026:6259" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-ugly-free" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-ugly-free-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">90fee47f4214e4bc8a1a2027625606ead4449f22005364886760c3f5c42aa7eb</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="x86_64" epoch="0" version="1.24.11" release="3.el10_1" src="gstreamer1-plugins-bad-free-1.24.11-3.el10_1.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.24.11-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">502a66251cb8bcf1bd9fbaa5d878bdc2ff1c936874db0a22d841f44d69cd6b0d</sum>
        </package>
        <package name="gstreamer1-plugins-base-devel" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-base-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-base-devel-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">09eb997ea0c338c5069eb170470b98ca68b089b7b8140dfd2dabe333214ac2f5</sum>
        </package>
        <package name="gstreamer1-plugins-good" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-good-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-good-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e80ee1ee49716047f7f3e5413252bcb67a0eae9a3fa2f4e254a00981a376cb4e</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" arch="x86_64" epoch="0" version="1.24.11" release="3.el10_1" src="gstreamer1-plugins-bad-free-1.24.11-3.el10_1.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.24.11-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a7c2239b0b54705286b844f858f36631729bd710fe8e00ba9e8a7f8b74afab3e</sum>
        </package>
        <package name="gstreamer1-plugins-base-tools" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-base-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-base-tools-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">78e512e12338b4febe1ab9013f7ffc9da7cb6e773863f8d4ba08ae0de18f42f7</sum>
        </package>
        <package name="gstreamer1-plugins-base" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-base-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-base-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">20c08a993e6067492ba945d8e85ecd6b9a351a010ec12bde66a69bea88422d51</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-good-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d0a354e36f6a6683568ee8e38fabcb9e39524420f83bcf02d07c550276a9cda6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6342</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:6342 (https://access.redhat.com/errata/RHSA-2026:6342), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

* firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

* firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)

* firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

* firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

* firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)

* firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)

* firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

* firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)

* thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371)

* thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3889" id="CVE-2026-3889" type="cve" title="CVE-2026-3889" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4371" id="CVE-2026-4371" type="cve" title="CVE-2026-4371" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4684" id="CVE-2026-4684" type="cve" title="CVE-2026-4684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4685" id="CVE-2026-4685" type="cve" title="CVE-2026-4685" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4686" id="CVE-2026-4686" type="cve" title="CVE-2026-4686" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4687" id="CVE-2026-4687" type="cve" title="CVE-2026-4687" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4688" id="CVE-2026-4688" type="cve" title="CVE-2026-4688" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4689" id="CVE-2026-4689" type="cve" title="CVE-2026-4689" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4690" id="CVE-2026-4690" type="cve" title="CVE-2026-4690" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4691" id="CVE-2026-4691" type="cve" title="CVE-2026-4691" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4692" id="CVE-2026-4692" type="cve" title="CVE-2026-4692" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4693" id="CVE-2026-4693" type="cve" title="CVE-2026-4693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4694" id="CVE-2026-4694" type="cve" title="CVE-2026-4694" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4695" id="CVE-2026-4695" type="cve" title="CVE-2026-4695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4696" id="CVE-2026-4696" type="cve" title="CVE-2026-4696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4697" id="CVE-2026-4697" type="cve" title="CVE-2026-4697" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4698" id="CVE-2026-4698" type="cve" title="CVE-2026-4698" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4699" id="CVE-2026-4699" type="cve" title="CVE-2026-4699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4700" id="CVE-2026-4700" type="cve" title="CVE-2026-4700" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4701" id="CVE-2026-4701" type="cve" title="CVE-2026-4701" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4702" id="CVE-2026-4702" type="cve" title="CVE-2026-4702" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4704" id="CVE-2026-4704" type="cve" title="CVE-2026-4704" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4705" id="CVE-2026-4705" type="cve" title="CVE-2026-4705" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4706" id="CVE-2026-4706" type="cve" title="CVE-2026-4706" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4707" id="CVE-2026-4707" type="cve" title="CVE-2026-4707" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4708" id="CVE-2026-4708" type="cve" title="CVE-2026-4708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4709" id="CVE-2026-4709" type="cve" title="CVE-2026-4709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4710" id="CVE-2026-4710" type="cve" title="CVE-2026-4710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4711" id="CVE-2026-4711" type="cve" title="CVE-2026-4711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4712" id="CVE-2026-4712" type="cve" title="CVE-2026-4712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4713" id="CVE-2026-4713" type="cve" title="CVE-2026-4713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4714" id="CVE-2026-4714" type="cve" title="CVE-2026-4714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4715" id="CVE-2026-4715" type="cve" title="CVE-2026-4715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4716" id="CVE-2026-4716" type="cve" title="CVE-2026-4716" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4717" id="CVE-2026-4717" type="cve" title="CVE-2026-4717" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4718" id="CVE-2026-4718" type="cve" title="CVE-2026-4718" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4719" id="CVE-2026-4719" type="cve" title="CVE-2026-4719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4720" id="CVE-2026-4720" type="cve" title="CVE-2026-4720" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4721" id="CVE-2026-4721" type="cve" title="CVE-2026-4721" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450733" id="2450733" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450741" id="2450741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450744" id="2450744" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450752" id="2450752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450747" id="2450747" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450738" id="2450738" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450710" id="2450710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450755" id="2450755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450725" id="2450725" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450739" id="2450739" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450726" id="2450726" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450714" id="2450714" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450727" id="2450727" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450723" id="2450723" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450724" id="2450724" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451006" id="2451006" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450734" id="2450734" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450748" id="2450748" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450757" id="2450757" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450730" id="2450730" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450713" id="2450713" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450711" id="2450711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450719" id="2450719" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451001" id="2451001" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450729" id="2450729" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450722" id="2450722" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450720" id="2450720" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450712" id="2450712" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450718" id="2450718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450751" id="2450751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450735" id="2450735" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450721" id="2450721" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450715" id="2450715" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450732" id="2450732" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450742" id="2450742" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450746" id="2450746" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450756" id="2450756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450740" id="2450740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450728" id="2450728" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6342" id="RLSA-2026:6342" type="self" title="RLSA-2026:6342" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:6342" id="RHSA-2026:6342" type="vendor" title="Red Hat RHSA-2026:6342" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.9.0" release="1.el10_1" src="thunderbird-140.9.0-1.el10_1.src.rpm">
          <filename>thunderbird-140.9.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">53bb93ccdb6a0cb7c4fd1e5f109b2b708161a4d43b43d3d0b67f778bed72afbc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6344</id>
    <title>Important: grafana security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:6344 (https://access.redhat.com/errata/RHSA-2026:6344), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6344" id="RLSA-2026:6344" type="self" title="RLSA-2026:6344" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:6344" id="RHSA-2026:6344" type="vendor" title="Red Hat RHSA-2026:6344" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="23.el10_1" src="grafana-10.2.6-23.el10_1.src.rpm">
          <filename>grafana-10.2.6-23.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8f56a2763097d7692750dbd4720fcd8c811010d92087c88c9dc6068bd5bfb34c</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="23.el10_1" src="grafana-10.2.6-23.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-23.el10_1.x86_64.rpm</filename>
          <sum type="sha256">778cf1846d17b188d22265bda24b939736b11841b0610d48edd6a47387e109a2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6388</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:6388 (https://access.redhat.com/errata/RHSA-2026:6388), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6388" id="RLSA-2026:6388" type="self" title="RLSA-2026:6388" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:6388" id="RHSA-2026:6388" type="vendor" title="Red Hat RHSA-2026:6388" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-pcp" arch="x86_64" epoch="0" version="5.3.0" release="3.el10_1" src="grafana-pcp-5.3.0-3.el10_1.src.rpm">
          <filename>grafana-pcp-5.3.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3144a6f761221f9db3fbc8f8c1f07eee48ad86f335b6f78eccafc7dcb083b08b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6622</id>
    <title>Moderate: crun security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:6622 (https://access.redhat.com/errata/RHSA-2026:6622), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for crun.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>crun is a OCI runtime

Security Fix(es):

* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30892" id="CVE-2026-30892" type="cve" title="CVE-2026-30892" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451576" id="2451576" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6622" id="RLSA-2026:6622" type="self" title="RLSA-2026:6622" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:6622" id="RHSA-2026:6622" type="vendor" title="Red Hat RHSA-2026:6622" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="crun" arch="x86_64" epoch="0" version="1.27" release="1.el10_1" src="crun-1.27-1.el10_1.src.rpm">
          <filename>crun-1.27-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ac79b86cee5d368e4bf60f16e4fc49bc93dd0c749abee1c5ebc17637e7e76e07</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6799</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:6799 (https://access.redhat.com/errata/RHSA-2026:6799), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

* freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

* freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

* freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

* freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

* freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

* freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

* freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free (CVE-2026-24682)

* freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)

* freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

* freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

* freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages (CVE-2026-31806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22852" id="CVE-2026-22852" type="cve" title="CVE-2026-22852" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22854" id="CVE-2026-22854" type="cve" title="CVE-2026-22854" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22856" id="CVE-2026-22856" type="cve" title="CVE-2026-22856" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23732" id="CVE-2026-23732" type="cve" title="CVE-2026-23732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23948" id="CVE-2026-23948" type="cve" title="CVE-2026-23948" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24491" id="CVE-2026-24491" type="cve" title="CVE-2026-24491" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24675" id="CVE-2026-24675" type="cve" title="CVE-2026-24675" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24676" id="CVE-2026-24676" type="cve" title="CVE-2026-24676" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24679" id="CVE-2026-24679" type="cve" title="CVE-2026-24679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24681" id="CVE-2026-24681" type="cve" title="CVE-2026-24681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24682" id="CVE-2026-24682" type="cve" title="CVE-2026-24682" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24683" id="CVE-2026-24683" type="cve" title="CVE-2026-24683" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24684" id="CVE-2026-24684" type="cve" title="CVE-2026-24684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31806" id="CVE-2026-31806" type="cve" title="CVE-2026-31806" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438207" id="2438207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429652" id="2429652" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438217" id="2438217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429654" id="2429654" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438216" id="2438216" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430881" id="2430881" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438202" id="2438202" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438221" id="2438221" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447376" id="2447376" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429650" id="2429650" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438201" id="2438201" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438212" id="2438212" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438210" id="2438210" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438208" id="2438208" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6799" id="RLSA-2026:6799" type="self" title="RLSA-2026:6799" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:6799" id="RHSA-2026:6799" type="vendor" title="Red Hat RHSA-2026:6799" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.5" src="freerdp-3.10.3-5.el10_1.5.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">2de810860042c9a2f41676c3a270d76cf06611eca85f950e4275764889533b25</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.5" src="freerdp-3.10.3-5.el10_1.5.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">b89356db455451566de063e3e47c2a33b55ba5eb5b471ed4aeb976dab5ea24b2</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.5" src="freerdp-3.10.3-5.el10_1.5.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">efe0451f4af8e2d642bb31585bdbb46b8bb48f5d9df5f30bfae35436f18e71a7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6817</id>
    <title>Important: capstone security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:6817 (https://access.redhat.com/errata/RHSA-2026:6817), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for capstone.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community.

Security Fix(es):

* capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114)

* capstone: Capstone: Heap buffer overflow via skipdata callback allows denial of service or arbitrary code execution. (CVE-2025-67873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67873" id="CVE-2025-67873" type="cve" title="CVE-2025-67873" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68114" id="CVE-2025-68114" type="cve" title="CVE-2025-68114" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2423416" id="2423416" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2423419" id="2423419" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6817" id="RLSA-2026:6817" type="self" title="RLSA-2026:6817" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:6817" id="RHSA-2026:6817" type="vendor" title="Red Hat RHSA-2026:6817" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="capstone" arch="x86_64" epoch="0" version="5.0.1" release="7.el10_1" src="capstone-5.0.1-7.el10_1.src.rpm">
          <filename>capstone-5.0.1-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e21f3fbdf6e92358d088550c3c0cc6cd342195a0eb8015c7b81bb83a3584937f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6906</id>
    <title>Important: nginx security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:6906 (https://access.redhat.com/errata/RHSA-2026:6906), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647)

* NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654)

* NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784)

* NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27651" id="CVE-2026-27651" type="cve" title="CVE-2026-27651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27654" id="CVE-2026-27654" type="cve" title="CVE-2026-27654" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27784" id="CVE-2026-27784" type="cve" title="CVE-2026-27784" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32647" id="CVE-2026-32647" type="cve" title="CVE-2026-32647" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450776" id="2450776" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450791" id="2450791" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449598" id="2449598" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450785" id="2450785" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6906" id="RLSA-2026:6906" type="self" title="RLSA-2026:6906" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:6906" id="RHSA-2026:6906" type="vendor" title="Red Hat RHSA-2026:6906" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-all-modules-1.26.3-2.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">0cf5d43356d16886e4f7d968b477fef07cda8f308e07da83bcade0af8a691d45</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">6e52dc6fea20ae093c3d1c8e23bc1de226169e7e2b3d6016c3d0b04663ce2860</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-filesystem-1.26.3-2.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">945bf06d1fdc8c45505929a01d6b1ef0a0341bd292a4a118850bbf05d3acdb66</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">27a12413889bb7d05f520fe84d6ea22cdcbebed01e0144e20160261b78e84982</sum>
        </package>
        <package name="nginx-mod-mail" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-mail-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">d1e241b974a5798c1892a36cf96fe7142f6519d70c68f75c8fde4fec4002ffa5</sum>
        </package>
        <package name="nginx-core" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-core-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">80289b3c7bbdd94d85ead32ecf669e6b2acc27b5358f286c11a17018b575ae9f</sum>
        </package>
        <package name="nginx" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">fda291c600c12078980ca21966f06dd73d7b3b7414605b0e965c385df733be11</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">fe486b24c97e86f356e587d0a928b423812879188438f74b3548e0ad9d4107ab</sum>
        </package>
        <package name="nginx-mod-stream" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-stream-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">57afb80b63a8716c15f32c50663e46c93df1496d769c5534239a41df2dd6c1c6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7005</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-04-10 12:07:15" />
    <updated date="2026-04-24 12:08:46" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:7005 (https://access.redhat.com/errata/RHSA-2026:7005), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7005" id="RLSA-2026:7005" type="self" title="RLSA-2026:7005" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:7005" id="RHSA-2026:7005" type="vendor" title="Red Hat RHSA-2026:7005" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git-lfs" arch="x86_64" epoch="0" version="3.6.1" release="8.el10_1" src="git-lfs-3.6.1-8.el10_1.src.rpm">
          <filename>git-lfs-3.6.1-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2b02d8dd609037e80537836e7d5ef59c1b2ce4fe00aa542b4fa00a761dd0fccb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7081</id>
    <title>Moderate: libtiff security update</title>
    <issued date="2026-04-10 12:07:15" />
    <updated date="2026-04-24 12:08:46" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:7081 (https://access.redhat.com/errata/RHSA-2026:7081), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52356" id="CVE-2023-52356" type="cve" title="CVE-2023-52356" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2251344" id="2251344" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7081" id="RLSA-2026:7081" type="self" title="RLSA-2026:7081" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:7081" id="RHSA-2026:7081" type="vendor" title="Red Hat RHSA-2026:7081" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libtiff-devel" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_1.2" src="libtiff-4.6.0-6.el10_1.2.src.rpm">
          <filename>libtiff-devel-4.6.0-6.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">04b7a8384c51c5d75101faf4c45c431851df9368c5a427baaf31f50d365264c4</sum>
        </package>
        <package name="libtiff" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_1.2" src="libtiff-4.6.0-6.el10_1.2.src.rpm">
          <filename>libtiff-4.6.0-6.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">302809a69a6284cd0180931d77630946f02b4367bc0e699326cf27db21250bef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7080</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-04-12 06:07:10" />
    <updated date="2026-04-26 06:08:43" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:7080 (https://access.redhat.com/errata/RHSA-2026:7080), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1525" id="CVE-2026-1525" type="cve" title="CVE-2026-1525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1526" id="CVE-2026-1526" type="cve" title="CVE-2026-1526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1528" id="CVE-2026-1528" type="cve" title="CVE-2026-1528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21710" id="CVE-2026-21710" type="cve" title="CVE-2026-21710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2229" id="CVE-2026-2229" type="cve" title="CVE-2026-2229" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25547" id="CVE-2026-25547" type="cve" title="CVE-2026-25547" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26996" id="CVE-2026-26996" type="cve" title="CVE-2026-26996" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135" id="CVE-2026-27135" type="cve" title="CVE-2026-27135" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27904" id="CVE-2026-27904" type="cve" title="CVE-2026-27904" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447142" id="2447142" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442922" id="2442922" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447144" id="2447144" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2441268" id="2441268" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448754" id="2448754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447143" id="2447143" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2436942" id="2436942" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453151" id="2453151" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447145" id="2447145" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7080" id="RLSA-2026:7080" type="self" title="RLSA-2026:7080" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:7080" id="RHSA-2026:7080" type="vendor" title="Red Hat RHSA-2026:7080" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs-full-i18n" arch="x86_64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-full-i18n-22.22.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">58e629ba81ffd6a5d457b2bee67655476ec695261f872e5f39f8fc379b2ab360</sum>
        </package>
        <package name="nodejs" arch="x86_64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-22.22.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8cc93ca6e9f77b9fa1dced29c06824e43b31587ee68d932d6ba2110e47c19cf3</sum>
        </package>
        <package name="nodejs-devel" arch="x86_64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-devel-22.22.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4eb5f45ee4eea040c529847310f859c4389cce8049a4ffcd2a150723b932663a</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-docs-22.22.2-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">fa500ed62f11dffa01482db76251ee423b1cabe3ae9f406e6630204b7aa3949c</sum>
        </package>
        <package name="nodejs-npm" arch="x86_64" epoch="1" version="10.9.7" release="1.22.22.2.1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-npm-10.9.7-1.22.22.2.1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">de5fd7ffd391052023dbe0386a72d1fd14b9a910ddfc776c5fe8c741c4e96df4</sum>
        </package>
        <package name="nodejs-libs" arch="x86_64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-libs-22.22.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4f5627252bf9fe1e51273e59ff3b5c5010201ffe8fbf73de7d122a10484c8de8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7672</id>
    <title>Important: firefox security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:7672 (https://access.redhat.com/errata/RHSA-2026:7672), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5731" id="CVE-2026-5731" type="cve" title="CVE-2026-5731" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5732" id="CVE-2026-5732" type="cve" title="CVE-2026-5732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5734" id="CVE-2026-5734" type="cve" title="CVE-2026-5734" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451819" id="2451819" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455897" id="2455897" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451805" id="2451805" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455908" id="2455908" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455901" id="2455901" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7672" id="RLSA-2026:7672" type="self" title="RLSA-2026:7672" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:7672" id="RHSA-2026:7672" type="vendor" title="Red Hat RHSA-2026:7672" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.9.1" release="1.el10_1" src="firefox-140.9.1-1.el10_1.src.rpm">
          <filename>firefox-140.9.1-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">53a351ec7ba6fb02ea2a8f44630cfe2a3b0c17c5290d5fdd4bc5ed3c8650e4b4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7680</id>
    <title>Important: perl-XML-Parser security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:7680 (https://access.redhat.com/errata/RHSA-2026:7680), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-XML-Parser.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.

Security Fix(es):

* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)

* perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-10002" id="CVE-2006-10002" type="cve" title="CVE-2006-10002" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-10003" id="CVE-2006-10003" type="cve" title="CVE-2006-10003" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448999" id="2448999" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449001" id="2449001" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7680" id="RLSA-2026:7680" type="self" title="RLSA-2026:7680" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:7680" id="RHSA-2026:7680" type="vendor" title="Red Hat RHSA-2026:7680" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl-XML-Parser" arch="x86_64" epoch="0" version="2.47" release="6.1.el10_1" src="perl-XML-Parser-2.47-6.1.el10_1.src.rpm">
          <filename>perl-XML-Parser-2.47-6.1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8b9b2cc50b1414f0433b7bff1145914ea93609204d8e5585f66c215699559e43</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7675</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:7675 (https://access.redhat.com/errata/RHSA-2026:7675), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs denial of service (CVE-2026-21637)

* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)

* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1525" id="CVE-2026-1525" type="cve" title="CVE-2026-1525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1526" id="CVE-2026-1526" type="cve" title="CVE-2026-1526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1527" id="CVE-2026-1527" type="cve" title="CVE-2026-1527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1528" id="CVE-2026-1528" type="cve" title="CVE-2026-1528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21637" id="CVE-2026-21637" type="cve" title="CVE-2026-21637" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21710" id="CVE-2026-21710" type="cve" title="CVE-2026-21710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21711" id="CVE-2026-21711" type="cve" title="CVE-2026-21711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21712" id="CVE-2026-21712" type="cve" title="CVE-2026-21712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21713" id="CVE-2026-21713" type="cve" title="CVE-2026-21713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21714" id="CVE-2026-21714" type="cve" title="CVE-2026-21714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21715" id="CVE-2026-21715" type="cve" title="CVE-2026-21715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21716" id="CVE-2026-21716" type="cve" title="CVE-2026-21716" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21717" id="CVE-2026-21717" type="cve" title="CVE-2026-21717" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2229" id="CVE-2026-2229" type="cve" title="CVE-2026-2229" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25547" id="CVE-2026-25547" type="cve" title="CVE-2026-25547" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2581" id="CVE-2026-2581" type="cve" title="CVE-2026-2581" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26996" id="CVE-2026-26996" type="cve" title="CVE-2026-26996" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135" id="CVE-2026-27135" type="cve" title="CVE-2026-27135" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453162" id="2453162" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447142" id="2447142" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453160" id="2453160" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447144" id="2447144" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447140" id="2447140" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453161" id="2453161" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2436942" id="2436942" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453151" id="2453151" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453037" id="2453037" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447141" id="2447141" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453158" id="2453158" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453157" id="2453157" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453152" id="2453152" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2441268" id="2441268" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448754" id="2448754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447143" id="2447143" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431340" id="2431340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447145" id="2447145" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7675" id="RLSA-2026:7675" type="self" title="RLSA-2026:7675" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:7675" id="RHSA-2026:7675" type="vendor" title="Red Hat RHSA-2026:7675" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-docs-24.14.1-2.el10_1.noarch.rpm</filename>
          <sum type="sha256">ddbec5004cc902972469c329b9376ecdba0d2394339a57df343f4248be51ac78</sum>
        </package>
        <package name="nodejs24" arch="x86_64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-24.14.1-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3ea0442ac2a1c70225619edcdf2baa1f66a5182e6294b07fddf24502f521bd1a</sum>
        </package>
        <package name="nodejs24-full-i18n" arch="x86_64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-full-i18n-24.14.1-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">617f0071ab2f72b3126fea27cd5e552a4b9a22a62501226d5ed5ac1764ab8130</sum>
        </package>
        <package name="nodejs24-libs" arch="x86_64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-libs-24.14.1-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a7f881bbbcc89d0faa07d5400fbfb03b2ae7c496001371ab489d45ec55706651</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.11.0" release="1.24.14.1.2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-npm-11.11.0-1.24.14.1.2.el10_1.noarch.rpm</filename>
          <sum type="sha256">efc7fe76818e6134795e26544413a2fd735ad8ffeca272117f0111c64d2c261e</sum>
        </package>
        <package name="nodejs24-devel" arch="x86_64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-devel-24.14.1-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">95753691d020186b7c170bc5c9f09e9bb37cdd6910d65bd07cbaf271da34fd7b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7992</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:7992 (https://access.redhat.com/errata/RHSA-2026:7992), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7992" id="RLSA-2026:7992" type="self" title="RLSA-2026:7992" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:7992" id="RHSA-2026:7992" type="vendor" title="Red Hat RHSA-2026:7992" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="5.el10_1.1" src="golang-github-openprinting-ipp-usb-0.9.27-5.el10_1.1.src.rpm">
          <filename>ipp-usb-0.9.27-5.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">a3ebe131ce135985565081b4fee48048494ba3328d151288947a2dd0c28e8327</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8119</id>
    <title>Important: squid security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:8119 (https://access.redhat.com/errata/RHSA-2026:8119), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for squid.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

* squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

* Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32748" id="CVE-2026-32748" type="cve" title="CVE-2026-32748" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33526" id="CVE-2026-33526" type="cve" title="CVE-2026-33526" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451574" id="2451574" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451577" id="2451577" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8119" id="RLSA-2026:8119" type="self" title="RLSA-2026:8119" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:8119" id="RHSA-2026:8119" type="vendor" title="Red Hat RHSA-2026:8119" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="squid" arch="x86_64" epoch="7" version="6.10" release="6.el10_1.3" src="squid-6.10-6.el10_1.3.src.rpm">
          <filename>squid-6.10-6.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">763138e0e2444c03ab5a4ad5577fdfb84e68072b2f4d17b66d1200f01209cc8f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7682</id>
    <title>Important: openexr security update</title>
    <issued date="2026-04-16 18:06:57" />
    <updated date="2026-04-30 18:08:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:7682 (https://access.redhat.com/errata/RHSA-2026:7682), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openexr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.

Security Fix(es):

* openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27622" id="CVE-2026-27622" type="cve" title="CVE-2026-27622" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2444251" id="2444251" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7682" id="RLSA-2026:7682" type="self" title="RLSA-2026:7682" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:7682" id="RHSA-2026:7682" type="vendor" title="Red Hat RHSA-2026:7682" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="openexr-libs" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_1.1" src="openexr-3.1.10-8.el10_1.1.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">67220e04bec910a9a7732bbb733ca2ce360bba0d6219dc72d45a2332c0240550</sum>
        </package>
        <package name="openexr" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_1.1" src="openexr-3.1.10-8.el10_1.1.src.rpm">
          <filename>openexr-3.1.10-8.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">05c23288d0ff65964479f28a7edfaf4cb216ba694ddf55a7c87aa01002f6539c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8312</id>
    <title>Important: bind security update</title>
    <issued date="2026-04-16 18:06:57" />
    <updated date="2026-04-30 18:08:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:8312 (https://access.redhat.com/errata/RHSA-2026:8312), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for bind.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1519" id="CVE-2026-1519" type="cve" title="CVE-2026-1519" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451305" id="2451305" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8312" id="RLSA-2026:8312" type="self" title="RLSA-2026:8312" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:8312" id="RHSA-2026:8312" type="vendor" title="Red Hat RHSA-2026:8312" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="bind-utils" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-utils-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">ac86f2a4a6e7e028c6b5098ba2a21fba8e0c71e1568107283e910007ad5d1eba</sum>
        </package>
        <package name="bind-chroot" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-chroot-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">8df2f0cd9ba313a30ed97fe5468122888e9325d7fa522d0b673029db442d5f45</sum>
        </package>
        <package name="bind-libs" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-libs-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">e4b199c1d6bab99a907b28ae7d9c5c55c4a0f868abd54f400912792e0e55b06f</sum>
        </package>
        <package name="bind-license" arch="noarch" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-license-9.18.33-10.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">90e75203bd53bc0e6581db642fb9c148b0b20799bcb7cb181ba24b59c5d16611</sum>
        </package>
        <package name="bind" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">fc64b91c2a3de06eb13b0ad15690553a83ac02239bd505067205f18d6b6feb57</sum>
        </package>
        <package name="bind-dnssec-utils" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">d65186db2fe4d5cf636d5e23cdb3a69284faefbba849c18276f9f22124b5bd8a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8458</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:8458 (https://access.redhat.com/errata/RHSA-2026:8458), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)

* FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33983" id="CVE-2026-33983" type="cve" title="CVE-2026-33983" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33984" id="CVE-2026-33984" type="cve" title="CVE-2026-33984" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453220" id="2453220" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453219" id="2453219" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8458" id="RLSA-2026:8458" type="self" title="RLSA-2026:8458" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:8458" id="RHSA-2026:8458" type="vendor" title="Red Hat RHSA-2026:8458" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.6" src="freerdp-3.10.3-5.el10_1.6.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">363b55da5e419d351630d496025056474887cf6528b0416db1eebdbdc6fabe50</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.6" src="freerdp-3.10.3-5.el10_1.6.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">3c07fca37360dd31324266b21c3f16f629b43a7397c006f85d8c68f93300d92b</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.6" src="freerdp-3.10.3-5.el10_1.6.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">ad5789e2e76dc6a35cf14a2651e81d9262a6f88a58fb08f038f2e548a30f1686</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8470</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:8470 (https://access.redhat.com/errata/RHSA-2026:8470), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

* dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

* dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

* dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26171" id="CVE-2026-26171" type="cve" title="CVE-2026-26171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32178" id="CVE-2026-32178" type="cve" title="CVE-2026-32178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32203" id="CVE-2026-32203" type="cve" title="CVE-2026-32203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33116" id="CVE-2026-33116" type="cve" title="CVE-2026-33116" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457741" id="2457741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457740" id="2457740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457781" id="2457781" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457739" id="2457739" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8470" id="RLSA-2026:8470" type="self" title="RLSA-2026:8470" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:8470" id="RHSA-2026:8470" type="vendor" title="Red Hat RHSA-2026:8470" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f5e3982c5d4ec31d3cc1eacb947a01dfd602e9358507bce70cb0f3d7501e7059</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.126" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-templates-8.0-8.0.126-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">52216ae8036e30f9b33cfe752b54243f115bb15b44a1e7be50d884c686956b36</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.126" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.126-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5291d2cc1ced34c876258b3a9c1f5c3e82eb54f85da39259b7bad6f17cc41840</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.126" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.126-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7b7c5ee7e93d601b469ed7ab5201d7868e5e6a7af551bf61c4b30ffaac818ad2</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">fead6c44a9095936b89bd0fdbc207c531e0b7737716bf5a71b498a3c4c5d7ad8</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">63612640084f3fff4281cee5fead84f44e91999bfbf9973a0a494815ea5d3260</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a3ffa06a0f80981dd03ebd103dee942a10472be2341e5f62406e58c3f6b52e6c</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5e27786ae6ff01c6673eb46845bf43523b556e17b42464c8eb5c029c2135a06b</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a42c047b2f5743d8a78a5fa6e47b3070a03664f7604017e9ada1ee11cb04bb22</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e152c979546075d6df91bb97830a3aaff0bf759034ab30e3a11d66ec22eb5036</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3544b3fb7738a981ddc4d121d86152947e45cbdfb6e5c66517f98b244e1c33fd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8472</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:8472 (https://access.redhat.com/errata/RHSA-2026:8472), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.116 and .NET Runtime 9.0.15.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

* dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

* dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

* dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26171" id="CVE-2026-26171" type="cve" title="CVE-2026-26171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32178" id="CVE-2026-32178" type="cve" title="CVE-2026-32178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32203" id="CVE-2026-32203" type="cve" title="CVE-2026-32203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33116" id="CVE-2026-33116" type="cve" title="CVE-2026-33116" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457741" id="2457741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457740" id="2457740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457781" id="2457781" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457739" id="2457739" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8472" id="RLSA-2026:8472" type="self" title="RLSA-2026:8472" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:8472" id="RHSA-2026:8472" type="vendor" title="Red Hat RHSA-2026:8472" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0c7c008020216c0c590678da0c8e661e1c2c1c757f1a01904ed6961bd685489c</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">27e88fb3f909f23bf8233c6aa72071412a38bea4bad5e9781b8f8804f1f49311</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f8db1719b903133d9bbc1eaf255dea47c1557465e3117fbc10cb0a8aac7f645b</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">667539593e8f48bf8023d97ec91c51875d733b40682ff2882801fec7bf37c883</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-templates-9.0-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">aab29daedf806babe3b9ded8e24bd36e072a97d1115c15c7444cdd9004c473bd</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">25642b8fe93d10b9b95eb122aa125cb3814ec82352acaa2507c2e6f142cb6599</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9c688d6890da7960e1ec15a320b4a6c53fcaf50691745f530799f50c0d6b0af1</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">194de292b0b71a7699683a25db28b8cff23796e4a0cf951fc9cb49fc749b520d</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">bc6d920012d806f17e8c3bc384d34c65d175525403cc7785a8f7f9a661509cf5</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">67695a190787bdfb9812192c8be1e2f610cbe19453fe2adccd12d1090e3cb625</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1b12256decf40558cf142712a7162b2ecb1b10d37df170c9a629ed087c25b2ea</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4bdb94b80db20f0239b97e2f23af695c4a3260135c847055fbb4bae243710ea8</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a85690dbe864f01dcfff2bb1ad8c6cb6e3aae78dde838b3a68f3dc2003d9b332</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8467</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:8467 (https://access.redhat.com/errata/RHSA-2026:8467), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.106 and .NET Runtime 10.0.6.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

* dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

* dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

* dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26171" id="CVE-2026-26171" type="cve" title="CVE-2026-26171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32178" id="CVE-2026-32178" type="cve" title="CVE-2026-32178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32203" id="CVE-2026-32203" type="cve" title="CVE-2026-32203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33116" id="CVE-2026-33116" type="cve" title="CVE-2026-33116" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457741" id="2457741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457740" id="2457740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457781" id="2457781" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457739" id="2457739" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8467" id="RLSA-2026:8467" type="self" title="RLSA-2026:8467" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:8467" id="RHSA-2026:8467" type="vendor" title="Red Hat RHSA-2026:8467" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-sdk-dbg-10.0" arch="x86_64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.106-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c975355736c293630ff24a2fd1f6004bba422b065ea149b670dc2deaf93c8763</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="x86_64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.106-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">90f0169cb3385b9fc4ef0acd0de4a31e2cf137ea6efc9e9ef84ff696f3da9358</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">aaa56b12495b5d84ad00c59efd710673ebd61994efe7ae0d3f2f495e5616f815</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="x86_64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-templates-10.0-10.0.106-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">fe8eb4b92c3262cf354832f22aa48914b85d2c8e37a4fc18405846c874320876</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-host-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f4e8f52851edc851ca2576237b06a6c1fbbf2c31af9c97c20d11f2f1f8a7b166</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b271c72018f14bf9e762ab5c2daff4a466f9c3ba95f363356f58e3da25e6d8ca</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2cb5f0346350271b3065f3a2a9f3533de4ea6ef45222ed26d26eb23bdef856eb</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e5cc179f7d1a84aa7464acb2ce68284289464718286d6b5f73df30a29377c32d</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9fa0d633ae68a13ecf55b3f995fd9bb42cea848f459993f3537a368f3d0a11a0</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e91090e6fd45464499ef7c0d706ca82c0d908821f3642826a991f9c65c9a77f1</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="x86_64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.106-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d859fc6728101c26d3ff140765e4aa2a0cf057130795466ace5d0f3c01efb5fc</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">98845113e93174af0f535405d1c2c97729269db0d639c7cd0469a2c50d6f0451</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c6b575eb13e86ba0b221c43b94a933c1344386f0ae7fe3f6f94dc149e1eed645</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8840</id>
    <title>Important: go-rpm-macros security update</title>
    <issued date="2026-04-21 12:07:14" />
    <updated date="2026-05-05 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:8840 (https://access.redhat.com/errata/RHSA-2026:8840), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-rpm-macros.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages.  It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8840" id="RLSA-2026:8840" type="self" title="RLSA-2026:8840" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:8840" id="RHSA-2026:8840" type="vendor" title="Red Hat RHSA-2026:8840" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-filesystem" arch="x86_64" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-filesystem-3.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0b24e4faa5a5b201bd6edd0c36089b55c17aef60e91bf00ecf06657ac3514611</sum>
        </package>
        <package name="go-srpm-macros" arch="noarch" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-srpm-macros-3.6.0-8.el10_1.noarch.rpm</filename>
          <sum type="sha256">ff881959d3210ef017fb6dd6a8a138c214d341f70d7e38f34fd4adb6efd956c7</sum>
        </package>
        <package name="go-rpm-macros" arch="x86_64" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-rpm-macros-3.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">524ff43725bc80b68d12eed61311d711796bc9b9c6ab56d8d3d730a2a106aff2</sum>
        </package>
        <package name="go-rpm-templates" arch="x86_64" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-rpm-templates-3.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7e8f6698e0495cdc9ad87f2804f934a42b8f73ad086ef1d762764b3ce444d327</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8842</id>
    <title>Important: delve security update</title>
    <issued date="2026-04-21 12:07:14" />
    <updated date="2026-05-05 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:8842 (https://access.redhat.com/errata/RHSA-2026:8842), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445345" id="2445345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8842" id="RLSA-2026:8842" type="self" title="RLSA-2026:8842" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:8842" id="RHSA-2026:8842" type="vendor" title="Red Hat RHSA-2026:8842" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.25.2" release="3.el10_1" src="delve-1.25.2-3.el10_1.src.rpm">
          <filename>delve-1.25.2-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">90a75f6099678ecea3a66581b553f6557fcd6536b93013bd4cd90b7fa63ef0b3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8858</id>
    <title>Important: giflib security update</title>
    <issued date="2026-04-21 12:07:14" />
    <updated date="2026-05-05 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:8858 (https://access.redhat.com/errata/RHSA-2026:8858), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for giflib.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>giflib is a library for reading and writing gif images.

Security Fix(es):

* giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23868" id="CVE-2026-23868" type="cve" title="CVE-2026-23868" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446207" id="2446207" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8858" id="RLSA-2026:8858" type="self" title="RLSA-2026:8858" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:8858" id="RHSA-2026:8858" type="vendor" title="Red Hat RHSA-2026:8858" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="giflib" arch="x86_64" epoch="0" version="5.2.1" release="22.el10_1.1" src="giflib-5.2.1-22.el10_1.1.src.rpm">
          <filename>giflib-5.2.1-22.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">1f45ccfa0cb24d080d7d158827acf1f06164a7b039602c49d06d8f0e56f218a6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:9638</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-04-24 12:06:29" />
    <updated date="2026-05-08 12:09:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:9638 (https://access.redhat.com/errata/RHSA-2026:9638), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5731" id="CVE-2026-5731" type="cve" title="CVE-2026-5731" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5732" id="CVE-2026-5732" type="cve" title="CVE-2026-5732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5734" id="CVE-2026-5734" type="cve" title="CVE-2026-5734" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451819" id="2451819" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455897" id="2455897" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451805" id="2451805" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455908" id="2455908" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455901" id="2455901" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:9638" id="RLSA-2026:9638" type="self" title="RLSA-2026:9638" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:9638" id="RHSA-2026:9638" type="vendor" title="Red Hat RHSA-2026:9638" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.9.1" release="1.el10_1" src="thunderbird-140.9.1-1.el10_1.src.rpm">
          <filename>thunderbird-140.9.1-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3d4ecd88bb9a95f975e28829475f7c15d32f0f7b4fb1d5e9497c5a22bd3fa88e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:9666</id>
    <title>Moderate: wireshark security update</title>
    <issued date="2026-04-24 12:06:29" />
    <updated date="2026-05-08 12:09:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:9666 (https://access.redhat.com/errata/RHSA-2026:9666), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Buffer Over-read in Wireshark (CVE-2026-3203)

* wireshark: Improperly Controlled Sequential Memory Allocation in Wireshark (CVE-2026-3201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3201" id="CVE-2026-3201" type="cve" title="CVE-2026-3201" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3203" id="CVE-2026-3203" type="cve" title="CVE-2026-3203" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442639" id="2442639" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442641" id="2442641" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:9666" id="RLSA-2026:9666" type="self" title="RLSA-2026:9666" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:9666" id="RHSA-2026:9666" type="vendor" title="Red Hat RHSA-2026:9666" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="wireshark" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.4" src="wireshark-4.4.2-4.el10_1.4.src.rpm">
          <filename>wireshark-4.4.2-4.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">b416fa143f93d81aaa12c3ca589ad57f77985458bdf11d6671fcaae59ec01e30</sum>
        </package>
        <package name="wireshark-cli" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.4" src="wireshark-4.4.2-4.el10_1.4.src.rpm">
          <filename>wireshark-cli-4.4.2-4.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">b5c40b0d6899158a8bcc0bfd477b0c07f7c6f78be404853be7c91bc578aa80d9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10223</id>
    <title>Important: grafana security update</title>
    <issued date="2026-04-28 12:06:44" />
    <updated date="2026-05-12 12:09:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:10223 (https://access.redhat.com/errata/RHSA-2026:10223), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27877" id="CVE-2026-27877" type="cve" title="CVE-2026-27877" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452293" id="2452293" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10223" id="RLSA-2026:10223" type="self" title="RLSA-2026:10223" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:10223" id="RHSA-2026:10223" type="vendor" title="Red Hat RHSA-2026:10223" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="24.el10_1" src="grafana-10.2.6-24.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-24.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1d587dfc3c9dc75297f2ce8947b49a7eb3344e7829a785750a8566359f9a79e2</sum>
        </package>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="24.el10_1" src="grafana-10.2.6-24.el10_1.src.rpm">
          <filename>grafana-10.2.6-24.el10_1.x86_64.rpm</filename>
          <sum type="sha256">378c0773c41fbc1272a2966ea98df6b921eb5671d1f75283c46da2893525dd70</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10707</id>
    <title>Important: gdk-pixbuf2 security update</title>
    <issued date="2026-04-28 12:06:44" />
    <updated date="2026-05-12 12:09:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:10707 (https://access.redhat.com/errata/RHSA-2026:10707), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gdk-pixbuf2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.

Security Fix(es):

* gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5201" id="CVE-2026-5201" type="cve" title="CVE-2026-5201" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453291" id="2453291" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10707" id="RLSA-2026:10707" type="self" title="RLSA-2026:10707" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:10707" id="RHSA-2026:10707" type="vendor" title="Red Hat RHSA-2026:10707" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gdk-pixbuf2" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">0f10e2b54827459dc8d4d0c0a5b693c99f30fe993618d13fc9f6c1c49aa29204</sum>
        </package>
        <package name="gdk-pixbuf2-modules" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">de5a7450e05a6ac80992886ef49a286abe72c5ac2df44a62b236faed2052c073</sum>
        </package>
        <package name="gdk-pixbuf2-devel" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">ec62d18124f5b9275b7439732fc4088d82d0b7a90e38003089c482403315cdd2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10767</id>
    <title>Important: firefox security update</title>
    <issued date="2026-04-28 12:06:44" />
    <updated date="2026-05-12 12:09:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:10767 (https://access.redhat.com/errata/RHSA-2026:10767), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

* firefox: thunderbird: Spoofing issue in the DOM: Core &amp; HTML component (CVE-2026-6762)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

* firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

* firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

* firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

* firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

* firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)

* firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

* firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

* firefox: thunderbird: Use-after-free in the DOM: Core &amp; HTML component (CVE-2026-6746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6746" id="CVE-2026-6746" type="cve" title="CVE-2026-6746" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6747" id="CVE-2026-6747" type="cve" title="CVE-2026-6747" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6748" id="CVE-2026-6748" type="cve" title="CVE-2026-6748" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6749" id="CVE-2026-6749" type="cve" title="CVE-2026-6749" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6750" id="CVE-2026-6750" type="cve" title="CVE-2026-6750" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6751" id="CVE-2026-6751" type="cve" title="CVE-2026-6751" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6752" id="CVE-2026-6752" type="cve" title="CVE-2026-6752" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6753" id="CVE-2026-6753" type="cve" title="CVE-2026-6753" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6754" id="CVE-2026-6754" type="cve" title="CVE-2026-6754" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6757" id="CVE-2026-6757" type="cve" title="CVE-2026-6757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6759" id="CVE-2026-6759" type="cve" title="CVE-2026-6759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6761" id="CVE-2026-6761" type="cve" title="CVE-2026-6761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6762" id="CVE-2026-6762" type="cve" title="CVE-2026-6762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6763" id="CVE-2026-6763" type="cve" title="CVE-2026-6763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6764" id="CVE-2026-6764" type="cve" title="CVE-2026-6764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6765" id="CVE-2026-6765" type="cve" title="CVE-2026-6765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6766" id="CVE-2026-6766" type="cve" title="CVE-2026-6766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6767" id="CVE-2026-6767" type="cve" title="CVE-2026-6767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6769" id="CVE-2026-6769" type="cve" title="CVE-2026-6769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6770" id="CVE-2026-6770" type="cve" title="CVE-2026-6770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6771" id="CVE-2026-6771" type="cve" title="CVE-2026-6771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6772" id="CVE-2026-6772" type="cve" title="CVE-2026-6772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6776" id="CVE-2026-6776" type="cve" title="CVE-2026-6776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6785" id="CVE-2026-6785" type="cve" title="CVE-2026-6785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6786" id="CVE-2026-6786" type="cve" title="CVE-2026-6786" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460109" id="2460109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460112" id="2460112" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460076" id="2460076" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460075" id="2460075" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460086" id="2460086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460104" id="2460104" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460099" id="2460099" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460106" id="2460106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460094" id="2460094" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460088" id="2460088" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460105" id="2460105" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460101" id="2460101" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460092" id="2460092" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460107" id="2460107" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460079" id="2460079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460097" id="2460097" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460078" id="2460078" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460096" id="2460096" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460085" id="2460085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460095" id="2460095" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460102" id="2460102" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460108" id="2460108" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460074" id="2460074" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460110" id="2460110" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460103" id="2460103" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10767" id="RLSA-2026:10767" type="self" title="RLSA-2026:10767" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:10767" id="RHSA-2026:10767" type="vendor" title="Red Hat RHSA-2026:10767" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.10.0" release="1.el10_1" src="firefox-140.10.0-1.el10_1.src.rpm">
          <filename>firefox-140.10.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9cbee92b756eb0536bc0d9ba28c77ca9dac9f05be9a9337560691a9555e81844</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11352</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-15 12:09:35" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:11352 (https://access.redhat.com/errata/RHSA-2026:11352), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)

* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)

* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999" id="CVE-2026-33999" type="cve" title="CVE-2026-33999" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001" id="CVE-2026-34001" type="cve" title="CVE-2026-34001" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003" id="CVE-2026-34003" type="cve" title="CVE-2026-34003" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451106" id="2451106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451109" id="2451109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451113" id="2451113" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11352" id="RLSA-2026:11352" type="self" title="RLSA-2026:11352" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:11352" id="RHSA-2026:11352" type="vendor" title="Red Hat RHSA-2026:11352" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="x86_64" epoch="0" version="24.1.5" release="6.el10_1" src="xorg-x11-server-Xwayland-24.1.5-6.el10_1.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-6.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2773b6f4f548e184215b454d564c7b4c1d0ceb7f2a14b836b59712bd912aaf52</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11412</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-15 12:09:35" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:11412 (https://access.redhat.com/errata/RHSA-2026:11412), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11412" id="RLSA-2026:11412" type="self" title="RLSA-2026:11412" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:11412" id="RHSA-2026:11412" type="vendor" title="Red Hat RHSA-2026:11412" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="x86_64" epoch="0" version="0.2.3" release="5.el10_1" src="yggdrasil-worker-package-manager-0.2.3-5.el10_1.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-5.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a5bf4faee56bfb43ae7e1496caad25d997f8d22957769284250b5fad8b190a8a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11413</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-15 12:09:35" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:11413 (https://access.redhat.com/errata/RHSA-2026:11413), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11413" id="RLSA-2026:11413" type="self" title="RLSA-2026:11413" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:11413" id="RHSA-2026:11413" type="vendor" title="Red Hat RHSA-2026:11413" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.8" release="4.el10_1" src="yggdrasil-0.4.8-4.el10_1.src.rpm">
          <filename>yggdrasil-0.4.8-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">301f3dde22e7cfb6f410c85a21194367458c4ac23972c691898051eae3149048</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:12265</id>
    <title>Important: libtiff security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-15 12:09:35" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:12265 (https://access.redhat.com/errata/RHSA-2026:12265), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4775" id="CVE-2026-4775" type="cve" title="CVE-2026-4775" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450768" id="2450768" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:12265" id="RLSA-2026:12265" type="self" title="RLSA-2026:12265" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:12265" id="RHSA-2026:12265" type="vendor" title="Red Hat RHSA-2026:12265" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libtiff-devel" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_1.3" src="libtiff-4.6.0-6.el10_1.3.src.rpm">
          <filename>libtiff-devel-4.6.0-6.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">8d58c22ff69659212b8263e3819e712375fcf3311e2fa1f8c917fdf20cb80c23</sum>
        </package>
        <package name="libtiff" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_1.3" src="libtiff-4.6.0-6.el10_1.3.src.rpm">
          <filename>libtiff-4.6.0-6.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">1d765509d1db530e4f0a24fe7c84e300ac08ab30e08318ef3e77841ab54a47fe</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:12285</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-05-07 12:06:53" />
    <updated date="2026-05-21 12:09:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:12285 (https://access.redhat.com/errata/RHSA-2026:12285), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

* firefox: thunderbird: Spoofing issue in the DOM: Core &amp; HTML component (CVE-2026-6762)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

* firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

* firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

* firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

* firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

* firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)

* firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

* firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

* firefox: thunderbird: Use-after-free in the DOM: Core &amp; HTML component (CVE-2026-6746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6746" id="CVE-2026-6746" type="cve" title="CVE-2026-6746" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6747" id="CVE-2026-6747" type="cve" title="CVE-2026-6747" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6748" id="CVE-2026-6748" type="cve" title="CVE-2026-6748" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6749" id="CVE-2026-6749" type="cve" title="CVE-2026-6749" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6750" id="CVE-2026-6750" type="cve" title="CVE-2026-6750" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6751" id="CVE-2026-6751" type="cve" title="CVE-2026-6751" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6752" id="CVE-2026-6752" type="cve" title="CVE-2026-6752" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6753" id="CVE-2026-6753" type="cve" title="CVE-2026-6753" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6754" id="CVE-2026-6754" type="cve" title="CVE-2026-6754" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6757" id="CVE-2026-6757" type="cve" title="CVE-2026-6757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6759" id="CVE-2026-6759" type="cve" title="CVE-2026-6759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6761" id="CVE-2026-6761" type="cve" title="CVE-2026-6761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6762" id="CVE-2026-6762" type="cve" title="CVE-2026-6762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6763" id="CVE-2026-6763" type="cve" title="CVE-2026-6763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6764" id="CVE-2026-6764" type="cve" title="CVE-2026-6764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6765" id="CVE-2026-6765" type="cve" title="CVE-2026-6765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6766" id="CVE-2026-6766" type="cve" title="CVE-2026-6766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6767" id="CVE-2026-6767" type="cve" title="CVE-2026-6767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6769" id="CVE-2026-6769" type="cve" title="CVE-2026-6769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6770" id="CVE-2026-6770" type="cve" title="CVE-2026-6770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6771" id="CVE-2026-6771" type="cve" title="CVE-2026-6771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6772" id="CVE-2026-6772" type="cve" title="CVE-2026-6772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6776" id="CVE-2026-6776" type="cve" title="CVE-2026-6776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6785" id="CVE-2026-6785" type="cve" title="CVE-2026-6785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6786" id="CVE-2026-6786" type="cve" title="CVE-2026-6786" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460109" id="2460109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460112" id="2460112" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460076" id="2460076" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460075" id="2460075" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460086" id="2460086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460104" id="2460104" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460099" id="2460099" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460106" id="2460106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460094" id="2460094" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460088" id="2460088" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460105" id="2460105" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460101" id="2460101" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460092" id="2460092" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460107" id="2460107" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460079" id="2460079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460097" id="2460097" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460078" id="2460078" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460096" id="2460096" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460085" id="2460085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460095" id="2460095" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460102" id="2460102" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460108" id="2460108" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460074" id="2460074" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460110" id="2460110" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460103" id="2460103" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:12285" id="RLSA-2026:12285" type="self" title="RLSA-2026:12285" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:12285" id="RHSA-2026:12285" type="vendor" title="Red Hat RHSA-2026:12285" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.10.0" release="1.el10_1" src="thunderbird-140.10.0-1.el10_1.src.rpm">
          <filename>thunderbird-140.10.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c56aef091d8ab54d5522e8fadc00473b99d6d479ffac3e6ef8edb0f2bf31896d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13916</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-05-07 12:06:53" />
    <updated date="2026-05-21 12:09:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:13916 (https://access.redhat.com/errata/RHSA-2026:13916), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

* pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30922" id="CVE-2026-30922" type="cve" title="CVE-2026-30922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32597" id="CVE-2026-32597" type="cve" title="CVE-2026-32597" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448553" id="2448553" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447194" id="2447194" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13916" id="RLSA-2026:13916" type="self" title="RLSA-2026:13916" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:13916" id="RHSA-2026:13916" type="vendor" title="Red Hat RHSA-2026:13916" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="fence-virtd-libvirt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-libvirt-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">fb4e6b75469a906eefa7bd3d653c941693d8344141a556a2535e895eff0e5a15</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-lpar-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">981ff44f226405eca95e6de80f296cd96e6d1b4aa44e2add42962d867cb76720</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">f2ef46ed7dcc733ea9b38e016f831a1b135f2893c60d14eb562e4e4a6da73d17</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">1fab49a737ba68c2d3077e671b149205440fa5382d881d812652b39ef6b47329</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-rsa-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">1490f943d5a44cf0007134f184c9795fcd14ebe6b5ad11944a9af07dabaf36b2</sum>
        </package>
        <package name="fence-agents-aws" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-aws-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">7d469bca8834b7c4d161a6fad56bbc19dbb297369e57e4dd2fd0e61987e92b21</sum>
        </package>
        <package name="fence-virtd-serial" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-serial-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">a63d74935705bcf6eeceacb34495da459cf6aea612fe5c87089d4e8dbadf464c</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">5bae7f51f65347a95f2ecfbf3966ede1047342b13c1a13328f4d43de4fcbf5db</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">f1777031e8cc51d50ad0e0c15ea32088bfae61dcffc4936d5497504cdbe6fa90</sum>
        </package>
        <package name="fence-agents-common" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-common-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">b0d99066aaecb88bcbd1f7969764bf83fe8b5d6c7c085d52b75de432c641c326</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">e6a389f09ec2978e64f892d7503d2a80e3754d02607463515c891bedabd045f5</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-mpath-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9061470a51469ddd08a181189747e894f7bda0c5588ba853bc0eaf8e232043b8</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-eps-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">2ced8e456e9e92ffb16fb6294dc77efaac9063b8ed4f54b81036530016a12580</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">10df6b8aa47e2444576424418b573fc242cee671365a867baf0db20901ecf06b</sum>
        </package>
        <package name="fence-agents-azure-arm" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-azure-arm-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">ec0e32b0e1d8fa4467927f91639cf074bbf2a9cdc9f624e1e5cedbf2db9e94bc</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9cd6497f78ad316d505950136f9ea2c06b462d6aefed93419db61fcc71cf08d9</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">38c924f9968238922e30064aae6be6e51fed28f09160e5e919a55d9ab2284b93</sum>
        </package>
        <package name="fence-agents-aliyun" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-aliyun-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">8f50d15317190913281165cb75681808c2abf931f80414f067cca075cce91e59</sum>
        </package>
        <package name="fence-virtd-multicast" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-multicast-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">fc53e4d84eff596107d78d9fae525d51806a8fbfd15ce3e92c7c7742a527b383</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">021df5b65d9523b053bcde8500aa3c8bffdb5c64f58dfb164d14f106d66a8d62</sum>
        </package>
        <package name="fence-agents-all" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-all-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">ff83d5ab9dec375cf4385a31dfe7c912e242c42c43fd7a376d0aef669381322c</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9f506bf9b726167aa665206b4108b5e96cfac636aa2257e564101fbdfbab0d94</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-wti-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">fabd7b4f7ae8f35f1643de268e666997d841520ae6e47c3f8474ff482519bca8</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">bb36d6d3accb87981f37038b330011c9986a995cf600eaf8c77ca5d465cd26cd</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">ce7d9b7547f3dd857702ca013289e8bc6f32a1da6a9e2b81b51894eb244ee3ae</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-brocade-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">32eebe0a7a2388ca850db416e3c36f580449aa1ae55217d89a5a58fe50d5c674</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">e5cf28ffff5766813020949d9fef4b6ce4bcc4873a6aa44b7543492b4097fb95</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">4bf67a266a26a0b3d5b6de075c81b4464003b7d594504d7522f00dc3aaf35a37</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">aafb5992aacf5cf9009ab898c89b53b347970fb1f53ce8d33a04f8519e061fd3</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">0271eadca27a8a77590ab8bc06935fa8700ae773e690963bbae3a5bda3fa828e</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-rsb-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">16b0e55ce0217b852ebe2ab9e0cf4049885644b34d6b393d0e51ec256f868da1</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-apc-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">8251bb5b72d1d2e816ac108fc3acec1eb97f954d8a69f0c89c291e58c5185bc0</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-drac5-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9ef0494a9ce4c3a8d62e0bf9fac7aae830d07b51223e49cbb494f60d0cea40ed</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-emerson-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">3488879b0d9eb2daaa441ea673f2dd6581e56a43cdb35f72122e89d9fe1b3dc7</sum>
        </package>
        <package name="fence-agents-gce" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-gce-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">a78056774c49199077a37a87016ff15bc1d6df6171ca7c95adec6ec897866344</sum>
        </package>
        <package name="fence-agents-redfish" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-redfish-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">928d27053cc8789437a700ea1474e702bbb2915f85b4216bc780b6c4413a6421</sum>
        </package>
        <package name="fence-virt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virt-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">08f1dc1f449f4458b77dc8fec9b8121b70efad0d1836261c13c1244aa31f9dab</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">0c4374f6d9e78fab3292eaf0d0e7cac5d07715b39f22ae7a8cdcaabbb8caa449</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-virsh-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">81b8f85345b49f128204ba2b7746efe3225b3d21154dc4f2c5f93cf485a25f9b</sum>
        </package>
        <package name="fence-virtd-tcp" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-tcp-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">9cf961c8c3b8a009f63534a47c35dc50ced6380a7df9a4825f102f7f7f57c1bd</sum>
        </package>
        <package name="fence-virtd" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">7193111dd76aa50b08a639c17e2267149d29c450e0b09783b5d78ebd557d4557</sum>
        </package>
        <package name="fence-agents-kdump" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-kdump-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">f48566127b8587be8f307636295c3459e49f8512dc0240293b8442e92d6708d0</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">7bcdbce5f15b9018f580617c5fa053b9430e36e42ba8fc35bf9dca753587d6db</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">020b810f275075663aac2863fd6723eb956aa61c4d9de642304064457a1374a2</sum>
        </package>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">f15d108229f811d4c04d1d82bacdd9fbd217c5781080057dafbbe8786fe58b20</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">b893c4330a530902ba09aee58d5814639d4a162d9454ea4bc9e778fe8d301846</sum>
        </package>
        <package name="fence-virtd-cpg" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-cpg-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">b5950530183471ec4c987272e4ded11f28f9ea1ba9623f74f150224893cd31bd</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">96e28b353c60bf7c8196aedcf938f3479458df1f39c735abd70a1aae2a214c27</sum>
        </package>
        <package name="ha-cloud-support" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>ha-cloud-support-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">d1ad7d466384a5660a90d13fb5d10985ea7e220d869ea6f559447bbd8092f554</sum>
        </package>
        <package name="fence-agents-openstack" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-openstack-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">a8d5991126e9346358e51f0bb607f82d00c860ad6591c1948ca28a672d810472</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">5e77f44c1f102777aab4827a4df540d381444cc562272fc62eddcd978081f201</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-scsi-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">5f2cc5c2b757a06f976d74b6e33911904380286ab62827cb364f56e6d626b212</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-sbd-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">7df0ffe235bc1349d7945fa8bb51e6e464e6eeb32910d9eaea3b4d0ff3870c54</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:16014</id>
    <title>Moderate: freerdp security update</title>
    <issued date="2026-05-13 12:06:54" />
    <updated date="2026-05-27 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:16014 (https://access.redhat.com/errata/RHSA-2026:16014), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)

* freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

* freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

* freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

* freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

* freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

* freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

* FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

* FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982)

* FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25952" id="CVE-2026-25952" type="cve" title="CVE-2026-25952" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25997" id="CVE-2026-25997" type="cve" title="CVE-2026-25997" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26986" id="CVE-2026-26986" type="cve" title="CVE-2026-26986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29775" id="CVE-2026-29775" type="cve" title="CVE-2026-29775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31883" id="CVE-2026-31883" type="cve" title="CVE-2026-31883" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31884" id="CVE-2026-31884" type="cve" title="CVE-2026-31884" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31885" id="CVE-2026-31885" type="cve" title="CVE-2026-31885" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33982" id="CVE-2026-33982" type="cve" title="CVE-2026-33982" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33985" id="CVE-2026-33985" type="cve" title="CVE-2026-33985" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33987" id="CVE-2026-33987" type="cve" title="CVE-2026-33987" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442782" id="2442782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442768" id="2442768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453226" id="2453226" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447383" id="2447383" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442764" id="2442764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453217" id="2453217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447386" id="2447386" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447385" id="2447385" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447379" id="2447379" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453218" id="2453218" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:16014" id="RLSA-2026:16014" type="self" title="RLSA-2026:16014" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:16014" id="RHSA-2026:16014" type="vendor" title="Red Hat RHSA-2026:16014" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.8" src="freerdp-3.10.3-5.el10_1.8.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">c7cedd841f12da93d0a3948a912ec65438201166e169e62fa0045c5aa1496a07</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.8" src="freerdp-3.10.3-5.el10_1.8.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">ae3c984490f5372f899e68a17b3fe16a76858078b3fc40960b51215aa3cc2c4c</sum>
        </package>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.8" src="freerdp-3.10.3-5.el10_1.8.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">35845c40d8072ed276075bfe5fa1cfcea90ddded9814922fdeb830cd73742a9a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:15888</id>
    <title>Important: openexr security update</title>
    <issued date="2026-05-13 12:06:54" />
    <updated date="2026-05-27 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:15888 (https://access.redhat.com/errata/RHSA-2026:15888), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openexr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.

Security Fix(es):

* OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34588" id="CVE-2026-34588" type="cve" title="CVE-2026-34588" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455408" id="2455408" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:15888" id="RLSA-2026:15888" type="self" title="RLSA-2026:15888" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:15888" id="RHSA-2026:15888" type="vendor" title="Red Hat RHSA-2026:15888" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="openexr-libs" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_1.2" src="openexr-3.1.10-8.el10_1.2.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">d95244d2dde18211d2aa58d3d0e1ada9dfdfa5395f6c5d5db297cf57280c447e</sum>
        </package>
        <package name="openexr" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_1.2" src="openexr-3.1.10-8.el10_1.2.src.rpm">
          <filename>openexr-3.1.10-8.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">9613951acfc1801ea2073e60eadf9a7ff74e129394db0571db924c28ee87e6cd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:15968</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2026-05-13 12:06:54" />
    <updated date="2026-05-27 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:15968 (https://access.redhat.com/errata/RHSA-2026:15968), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)

* libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4271" id="CVE-2026-4271" type="cve" title="CVE-2026-4271" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5119" id="CVE-2026-5119" type="cve" title="CVE-2026-5119" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452932" id="2452932" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448044" id="2448044" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:15968" id="RLSA-2026:15968" type="self" title="RLSA-2026:15968" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:15968" id="RHSA-2026:15968" type="vendor" title="Red Hat RHSA-2026:15968" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.11" src="libsoup3-3.6.5-3.el10_1.11.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.11.x86_64.rpm</filename>
          <sum type="sha256">4285234397e16121f49d99fef660a2a7c801c793dd0d7b46688f2bfe06614cf8</sum>
        </package>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.11" src="libsoup3-3.6.5-3.el10_1.11.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.11.x86_64.rpm</filename>
          <sum type="sha256">624ef4e2d67b28d44b59fdf018fa21e490524f0899e9f993e2a7f25ea90b68d1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:17075</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-16 12:07:04" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:17075 (https://access.redhat.com/errata/RHSA-2026:17075), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:17075" id="RLSA-2026:17075" type="self" title="RLSA-2026:17075" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:17075" id="RHSA-2026:17075" type="vendor" title="Red Hat RHSA-2026:17075" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.8" release="5.el10_1" src="yggdrasil-0.4.8-5.el10_1.src.rpm">
          <filename>yggdrasil-0.4.8-5.el10_1.x86_64.rpm</filename>
          <sum type="sha256">6cffa954fb7a0483512cde10fc8c139db519f5904ccc294b0f48ea27d3fa1d48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18065</id>
    <title>Important: ruby security update</title>
    <issued date="2026-05-19 12:07:45" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:18065 (https://access.redhat.com/errata/RHSA-2026:18065), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41316" id="CVE-2026-41316" type="cve" title="CVE-2026-41316" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2461369" id="2461369" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18065" id="RLSA-2026:18065" type="self" title="RLSA-2026:18065" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:18065" id="RHSA-2026:18065" type="vendor" title="Red Hat RHSA-2026:18065" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-typeprof-0.21.9-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">1591f8f6aa7f4ae1093186cb3d794d2c1e3b6151140c3e97f59529c28281e244</sum>
        </package>
        <package name="rubygem-rbs" arch="x86_64" epoch="0" version="3.4.0" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rbs-3.4.0-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4aea9485bfebf8c9714a9d56acc08aabec4b9c396b621fcc46a33a988088fd34</sum>
        </package>
        <package name="rubygem-psych" arch="x86_64" epoch="0" version="5.1.2" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-psych-5.1.2-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f9987820c01dd4fec2985f1b919dd4d25ceed1787e656d74ecf66044a4867815</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygems-devel-3.5.22-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">aa4d6cc07d9a3dcbb281df8a91e703aa8f8dbfa04628e73c798394723f082690</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-test-unit-3.6.1-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">16fe13ffa10c0de42b9cf7b3d26bbf6e7ddd73ad6a2ab7bfed325d439ed4c50a</sum>
        </package>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-irb-1.13.1-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">c525023b1949e8ff9d098f95cfb87efb58495b85a9e9f35a229f2cf8a94541bb</sum>
        </package>
        <package name="rubygem-bigdecimal" arch="x86_64" epoch="0" version="3.1.5" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">319d58cafaff5a8d8db7575d0dff920b058d70201fc3eb5f5d5169e7153b236c</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.4.4" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rexml-3.4.4-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">6ae1d244c5081c03f2190c3168e3e8145469e6727ecd62b08213104f6d98c6bb</sum>
        </package>
        <package name="ruby-devel" arch="x86_64" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-devel-3.3.10-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">15382ff583bf066c0e6462994598e937eac3255ee8ea5d47bfb42a2897a25b61</sum>
        </package>
        <package name="rubygem-io-console" arch="x86_64" epoch="0" version="0.7.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-io-console-0.7.1-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8e167ff8cee77580f4151a03d6425260734d7a15d47053b41ab78e380bb94dc9</sum>
        </package>
        <package name="ruby-bundled-gems" arch="x86_64" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-bundled-gems-3.3.10-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a0fea5ad0e8669989355329b40ee9ec40ab4b298e04dd6a25d9e37c21300a0a1</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-bundler-2.5.22-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">8c629183e49a02ee3e3a1e4f7f7ace24e7321c4a8ab14eb9ed5823b4084b2549</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-default-gems-3.3.10-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">a0b5aecda2a23b08fbd4f51197bc7e8dc14cbd9138c912950af5ecdc14095dae</sum>
        </package>
        <package name="ruby-libs" arch="x86_64" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-libs-3.3.10-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">018ad040b6087207dcf83b5c49e1ff33204f75092deac68487932fd5c893c405</sum>
        </package>
        <package name="ruby" arch="x86_64" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-3.3.10-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f455224ad00ddc08527d5139909bebc353eddb1aca107cb205fbd792a0b49a28</sum>
        </package>
        <package name="rubygem-json" arch="x86_64" epoch="0" version="2.7.2" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-json-2.7.2-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2ad3eb589becb84cddee23675b44e16434e5ee65114c013db6bb08a1a8706520</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygems-3.5.22-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">d66f9fc8190b04763be7f5be79b3b1425123b140febc4a06e5807ee8a057c38b</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rss-0.3.1-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">b3271503289165fa3cad040f6673633a6ef2e6d131f5330908dd57cce9712e80</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rake-13.1.0-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">bdc61b9c993809f338bd389463110b54e54f316afeee7c9f3ca25de947e8239b</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">9c2dda742c727dc3b7495d63b063789a8b6dbbaab32ed6466a3031c8bd801791</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-minitest-5.20.0-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">23e70e10ea07b826927a7b0fd47cddbe9a657e32a08978715b316ee354271049</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-power_assert-2.0.3-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">75d0fedf91f6dde0aadca90e8b1babbee4e9d5929918eaafd4f3c2bce22ae45f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18063</id>
    <title>Critical: nginx security update</title>
    <issued date="2026-05-19 12:07:45" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:18063 (https://access.redhat.com/errata/RHSA-2026:18063), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42945" id="CVE-2026-42945" type="cve" title="CVE-2026-42945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477116" id="2477116" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18063" id="RLSA-2026:18063" type="self" title="RLSA-2026:18063" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:18063" id="RHSA-2026:18063" type="vendor" title="Red Hat RHSA-2026:18063" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nginx" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-1.26.3-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">e32e4aae6e3ce822d062b36cc07eba42ae86d1a311fa2d0081b89b75140f2865</sum>
        </package>
        <package name="nginx-mod-mail" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-mail-1.26.3-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">7397af17fef42fcda0a41edeeb34d7092c4709ab08ba4b8c3a4ae4420bba2afb</sum>
        </package>
        <package name="nginx-mod-stream" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-stream-1.26.3-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">f065226916a0b317472d6c9fa4dc5256702019112da9d1d510da5a01417f4b58</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-all-modules-1.26.3-2.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">9f7b17160bbf8a7e1a4a7d33b9ba97af2bcf08f1949eddbf017f59f0cb7c3b9d</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">41b8dc91fb6b183ad13e3dbc29d4176c223f82d1812673046b0208ee8aebebdd</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-filesystem-1.26.3-2.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">1cd73d91c3f0ee1fb2cfbc0ebd57f038c943c3966dde8ff24f514d31fafc8703</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">32d5f7db7632b94e7d3b1b6eb39379b953c5b7db13970b38d24710f0f4034f59</sum>
        </package>
        <package name="nginx-core" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-core-1.26.3-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">dc5407990cab0531913254699700579487b445787ce439295e824a60f5a64b18</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">c8df1b18678d10760ea41f659a41b7dc374693a2b44a2365c5dbfc23167012c3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1838</id>
    <title>Moderate: image-builder security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1838 (https://access.redhat.com/errata/RHSA-2026:1838), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1838" id="RLSA-2026:1838" type="self" title="RLSA-2026:1838" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1838" id="RHSA-2026:1838" type="vendor" title="Red Hat RHSA-2026:1838" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="image-builder" arch="x86_64" epoch="0" version="31" release="3.el10_1.rocky.0.2" src="image-builder-31-3.el10_1.rocky.0.2.src.rpm">
          <filename>image-builder-31-3.el10_1.rocky.0.2.x86_64.rpm</filename>
          <sum type="sha256">ecb0538316db71db862a983024fd9b8c8e301d660f87dfb1b53861ebc08d56a4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1837</id>
    <title>Moderate: osbuild-composer security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:1837 (https://access.redhat.com/errata/RHSA-2026:1837), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for osbuild-composer.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1837" id="RLSA-2026:1837" type="self" title="RLSA-2026:1837" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:1837" id="RHSA-2026:1837" type="vendor" title="Red Hat RHSA-2026:1837" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="osbuild-composer-worker" arch="x86_64" epoch="0" version="149" release="4.el10_1.rocky.0.8" src="osbuild-composer-149-4.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-worker-149-4.el10_1.rocky.0.8.x86_64.rpm</filename>
          <sum type="sha256">6d0af810551ee23aa362f4da4469cda0625869c85f49e53f67fc848502922287</sum>
        </package>
        <package name="osbuild-composer-core" arch="x86_64" epoch="0" version="149" release="4.el10_1.rocky.0.8" src="osbuild-composer-149-4.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-core-149-4.el10_1.rocky.0.8.x86_64.rpm</filename>
          <sum type="sha256">a912cb64b926b5753696e54db4beecca20bd48a757f9ffa40bd30b99470fe34f</sum>
        </package>
        <package name="osbuild-composer" arch="x86_64" epoch="0" version="149" release="4.el10_1.rocky.0.8" src="osbuild-composer-149-4.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-149-4.el10_1.rocky.0.8.x86_64.rpm</filename>
          <sum type="sha256">97d99c5d92d048657a065a824b18b3b8f73d4a10fa1852f812d634ca1abb443c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3752</id>
    <title>Important: osbuild-composer security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3752 (https://access.redhat.com/errata/RHSA-2026:3752), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for osbuild-composer.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3752" id="RLSA-2026:3752" type="self" title="RLSA-2026:3752" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3752" id="RHSA-2026:3752" type="vendor" title="Red Hat RHSA-2026:3752" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="osbuild-composer" arch="x86_64" epoch="0" version="149" release="5.el10_1.rocky.0.8" src="osbuild-composer-149-5.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-149-5.el10_1.rocky.0.8.x86_64.rpm</filename>
          <sum type="sha256">ecb6c0fd924ffca062f997d76b05d30daffb6e167a0c21eb54f14c0b258135ea</sum>
        </package>
        <package name="osbuild-composer-core" arch="x86_64" epoch="0" version="149" release="5.el10_1.rocky.0.8" src="osbuild-composer-149-5.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-core-149-5.el10_1.rocky.0.8.x86_64.rpm</filename>
          <sum type="sha256">4261e3db1a5dc5fa959054336e3c01feca05ab1107a9bdb46bbb9a7e13fa61fc</sum>
        </package>
        <package name="osbuild-composer-worker" arch="x86_64" epoch="0" version="149" release="5.el10_1.rocky.0.8" src="osbuild-composer-149-5.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-worker-149-5.el10_1.rocky.0.8.x86_64.rpm</filename>
          <sum type="sha256">55ab6460e3c2026709c0de44231d2b0d03d2ea03671c66fd7ed23d2b067fc7cc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3840</id>
    <title>Important: image-builder security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:3840 (https://access.redhat.com/errata/RHSA-2026:3840), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3840" id="RLSA-2026:3840" type="self" title="RLSA-2026:3840" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:3840" id="RHSA-2026:3840" type="vendor" title="Red Hat RHSA-2026:3840" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="image-builder" arch="x86_64" epoch="0" version="31" release="4.el10_1.rocky.0.2" src="image-builder-31-4.el10_1.rocky.0.2.src.rpm">
          <filename>image-builder-31-4.el10_1.rocky.0.2.x86_64.rpm</filename>
          <sum type="sha256">d3fc0f16429e0dac6addebc207d7eddf256f47f890f91a7f5bbc193fbe0433d8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4162</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:4162 (https://access.redhat.com/errata/RHSA-2026:4162), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21941)

* mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21948)

* mysql: InnoDB unspecified vulnerability (CPU Jan 2026) (CVE-2026-21936)

* mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21968)

* mysql: DDL unspecified vulnerability (CPU Jan 2026) (CVE-2026-21937)

* mysql: Thread Pooling unspecified vulnerability (CPU Jan 2026) (CVE-2026-21964)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21936" id="CVE-2026-21936" type="cve" title="CVE-2026-21936" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21937" id="CVE-2026-21937" type="cve" title="CVE-2026-21937" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21941" id="CVE-2026-21941" type="cve" title="CVE-2026-21941" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21948" id="CVE-2026-21948" type="cve" title="CVE-2026-21948" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21964" id="CVE-2026-21964" type="cve" title="CVE-2026-21964" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21968" id="CVE-2026-21968" type="cve" title="CVE-2026-21968" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431413" id="2431413" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431385" id="2431385" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431431" id="2431431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431402" id="2431402" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431409" id="2431409" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431384" id="2431384" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4162" id="RLSA-2026:4162" type="self" title="RLSA-2026:4162" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:4162" id="RHSA-2026:4162" type="vendor" title="Red Hat RHSA-2026:4162" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mysql8.4-server" arch="x86_64" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-server-8.4.8-1.el10_1.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">14d759e323852395421ca2d4056fcc72120d01febc6e92e07e0da70a94d4eb58</sum>
        </package>
        <package name="mysql8.4" arch="x86_64" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-8.4.8-1.el10_1.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">9b94bc03ee0ec8f36c03bd9cddaf61e82a314ec08b8d9963a9410206dfd5b210</sum>
        </package>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-common-8.4.8-1.el10_1.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">7c6a4067dfcdc037824a1dc2ff66ec369d1aab6b88dd78b1c00118980f3c223e</sum>
        </package>
        <package name="mysql8.4-libs" arch="x86_64" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-libs-8.4.8-1.el10_1.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">d0d221efed96c0ed10e9120e23fdf246d50d65c765c0632e0eacb04e39c12114</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.8-1.el10_1.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">a3559f314f01fb1114bce29e54f7e5ee1e47b5259fadaae79c034fb071b4e2ca</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:9693</id>
    <title>Important: java-25-openjdk security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:9693 (https://access.redhat.com/errata/RHSA-2026:9693), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for java-25-openjdk.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

* JDK: Enhance crypto algorithm support (CVE-2026-22007)

* JDK: Improved Arena allocations (CVE-2026-22008)

* JDK: Improve Kerberos credentialing (CVE-2026-22013)

* JDK: Enhance Path Factories Redux (CVE-2026-22016)

* JDK: Enhance Zip file reading (CVE-2026-22018)

* JDK: Enhance certificate chain validation (CVE-2026-22021)

* JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

* JDK: Enhance TLS connection handling (CVE-2026-34282)

* JDK: Enhance key generation (CVE-2026-34268)

This release also updates a number of third-party libraries included in the JDK.  The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

* giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)

* libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

* libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

Bug Fix(es):

* When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails.  However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile.  This is rectified in this release. (Rocky Linux-169939, Rocky Linux-169937)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22007" id="CVE-2026-22007" type="cve" title="CVE-2026-22007" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22008" id="CVE-2026-22008" type="cve" title="CVE-2026-22008" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22013" id="CVE-2026-22013" type="cve" title="CVE-2026-22013" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22016" id="CVE-2026-22016" type="cve" title="CVE-2026-22016" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22018" id="CVE-2026-22018" type="cve" title="CVE-2026-22018" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22021" id="CVE-2026-22021" type="cve" title="CVE-2026-22021" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23865" id="CVE-2026-23865" type="cve" title="CVE-2026-23865" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26740" id="CVE-2026-26740" type="cve" title="CVE-2026-26740" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34268" id="CVE-2026-34268" type="cve" title="CVE-2026-34268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34282" id="CVE-2026-34282" type="cve" title="CVE-2026-34282" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451819" id="2451819" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451805" id="2451805" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460029" id="2460029" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460041" id="2460041" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460038" id="2460038" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460043" id="2460043" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460039" id="2460039" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448747" id="2448747" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460042" id="2460042" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460040" id="2460040" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2443891" id="2443891" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460044" id="2460044" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:9693" id="RLSA-2026:9693" type="self" title="RLSA-2026:9693" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:9693" id="RHSA-2026:9693" type="vendor" title="Red Hat RHSA-2026:9693" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="java-25-openjdk-crypto-adapter" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-crypto-adapter-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">035164a81e587b48f56210689ce08bc823207777fbac0f3835c1847c39672f6a</sum>
        </package>
        <package name="java-25-openjdk-demo" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-demo-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3d1ebaf06804a299b44cf1f2f7e2a7e76c51b3877ffb876e8b1c8d49bbdfad86</sum>
        </package>
        <package name="java-25-openjdk-javadoc-zip" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-javadoc-zip-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a821f10784533a1a20c95ea6b0af2cff5c059561b3b0b1d507b88e1af8e2fbcc</sum>
        </package>
        <package name="java-25-openjdk-jmods" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-jmods-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b3e5e09adbc098a4aabdf5d25e062283fad967f18e7d217b645c803dee617490</sum>
        </package>
        <package name="java-25-openjdk-headless" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-headless-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">32acd2e8b5cd09bd619c41736f4279241d4cf2d933da396524d439c619816878</sum>
        </package>
        <package name="java-25-openjdk-src" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-src-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ef7c81ef0112b029d029136e1eb9492cfd4d928eb9db8ffac8b453874903773b</sum>
        </package>
        <package name="java-25-openjdk-javadoc" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-javadoc-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e079d313207008e3451d1faa77a143eae16e76bacdac9f1e37adcb70a2a1dae1</sum>
        </package>
        <package name="java-25-openjdk" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">691835c10dd9e063759885aad52f5a2e3ffa4ebec1ec8e140235a62aa5ea454c</sum>
        </package>
        <package name="java-25-openjdk-devel" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-devel-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">630428005a08f22f6bd5c605fb3ec22ea7f9446a76da1993030833ddafc0244d</sum>
        </package>
        <package name="java-25-openjdk-static-libs" arch="x86_64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-static-libs-25.0.3.0.9-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c8c1d8cc9b53e810bc790ce365a73cf18a1d5a2d3aec87163c50c5c6f1e6e60f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13642</id>
    <title>Important: image-builder security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:13642 (https://access.redhat.com/errata/RHSA-2026:13642), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13642" id="RLSA-2026:13642" type="self" title="RLSA-2026:13642" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:13642" id="RHSA-2026:13642" type="vendor" title="Red Hat RHSA-2026:13642" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="image-builder" arch="x86_64" epoch="0" version="31" release="5.el10_1.rocky.0.2" src="image-builder-31-5.el10_1.rocky.0.2.src.rpm">
          <filename>image-builder-31-5.el10_1.rocky.0.2.x86_64.rpm</filename>
          <sum type="sha256">5fa739923a2276c88da0ce377860c7b3610b33e815cb4fce4916306410f2fe1a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13643</id>
    <title>Important: osbuild-composer security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:13643 (https://access.redhat.com/errata/RHSA-2026:13643), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for osbuild-composer.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13643" id="RLSA-2026:13643" type="self" title="RLSA-2026:13643" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:13643" id="RHSA-2026:13643" type="vendor" title="Red Hat RHSA-2026:13643" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="osbuild-composer" arch="x86_64" epoch="0" version="149" release="6.el10_1.rocky.0.8" src="osbuild-composer-149-6.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-149-6.el10_1.rocky.0.8.x86_64.rpm</filename>
          <sum type="sha256">a43e8ddb8ee0e0e504a40ac94b81e63db0cb5573b333801cf948bb296192d688</sum>
        </package>
        <package name="osbuild-composer-core" arch="x86_64" epoch="0" version="149" release="6.el10_1.rocky.0.8" src="osbuild-composer-149-6.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-core-149-6.el10_1.rocky.0.8.x86_64.rpm</filename>
          <sum type="sha256">335b154eda4177cfcba377747369ba06c80670709a63a3075d63e412d053fe4f</sum>
        </package>
        <package name="osbuild-composer-worker" arch="x86_64" epoch="0" version="149" release="6.el10_1.rocky.0.8" src="osbuild-composer-149-6.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-worker-149-6.el10_1.rocky.0.8.x86_64.rpm</filename>
          <sum type="sha256">88574822c8e165b6ab08b4ee062c2edb149252782e36924589fab22610b15903</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18556</id>
    <title>Moderate: unbound security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:18556 (https://access.redhat.com/errata/RHSA-2026:18556), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: DNSBomb vulnerability (CVE-2024-33655)

* unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33655" id="CVE-2024-33655" type="cve" title="CVE-2024-33655" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11411" id="CVE-2025-11411" type="cve" title="CVE-2025-11411" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2279942" id="2279942" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405706" id="2405706" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18556" id="RLSA-2026:18556" type="self" title="RLSA-2026:18556" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:18556" id="RHSA-2026:18556" type="vendor" title="Red Hat RHSA-2026:18556" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="unbound-dracut" arch="x86_64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">04a878d04b9ecb7805e52c29556a4f18eda13d2df51ea19708ed6eeb6da2492e</sum>
        </package>
        <package name="unbound-utils" arch="x86_64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">c477a02c965587cda69ab8bee6c256392f893c6861ebac2b1180d0f275c91c8c</sum>
        </package>
        <package name="unbound" arch="x86_64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">886b41643e859cb7f45689c3c2d74333ae8e5f8ffcfaace51dec1c24cff9fd62</sum>
        </package>
        <package name="unbound-anchor" arch="x86_64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">24f14da07c3ed33e256b7ac468dea3969fa63f25ce84ba14f58f94fcde478a78</sum>
        </package>
        <package name="python3-unbound" arch="x86_64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">cddde4e445e152aa9d3a060768017ed2076e0c4c72f423ea390d2ac735bd81dc</sum>
        </package>
        <package name="unbound-libs" arch="x86_64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">88b02ba2d823ebcd81745772c41389b2c5dd2215fd5cfe813b1b21958ec29aef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18326</id>
    <title>Moderate: libvirt security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:18326 (https://access.redhat.com/errata/RHSA-2026:18326), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libvirt.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

* libvirt: Denial of service in XML parsing (CVE-2025-12748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12748" id="CVE-2025-12748" type="cve" title="CVE-2025-12748" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2413801" id="2413801" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18326" id="RLSA-2026:18326" type="self" title="RLSA-2026:18326" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:18326" id="RHSA-2026:18326" type="vendor" title="Red Hat RHSA-2026:18326" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libvirt-daemon-driver-network" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-network-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f840195c11507eda6197c2820c02ad0e5ddc07bb7355488b6f869cea14439e99</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-mpath" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-mpath-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3a6e20599896fe37e455c605e78f90355efa4efc3e220f2d261cc79e0b4a48f6</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-core" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-core-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0588be06011fc901417cbcf723883a6577277fff86c3570bada1cdb8403966b0</sum>
        </package>
        <package name="libvirt-ssh-proxy" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-ssh-proxy-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">83d19d2dfc7dc8e8e8219b8bf3fff45755bc361b0f20edf81010aa261c03c3f4</sum>
        </package>
        <package name="libvirt-daemon" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c5d769ec28f2850ae5e1eeeab0e6ce07527804f15cdc565fff673ab430a86682</sum>
        </package>
        <package name="libvirt-daemon-driver-interface" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-interface-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3ee17f8caf1e35e0ef7bee5cd82f71bd6d16ebcda5aaec45ea49bdc00d7aa7f1</sum>
        </package>
        <package name="libvirt-daemon-driver-secret" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-secret-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">04b28c57bd8d115db3820452308049b1091237fcd7b36eaa66fa48754f3a3f5d</sum>
        </package>
        <package name="libvirt-daemon-config-network" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-config-network-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ced1458498167d974ff19d42575141cfdce21787f7920766c803ba4eccc282a1</sum>
        </package>
        <package name="libvirt-daemon-proxy" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-proxy-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2dba59c89a4ae8f8419286898cd25330cecbace1d6a2bb59ed9de71a343ce33b</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-iscsi" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-iscsi-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">42a76cbad73050f91dce97ac64577442b282a1f2d6d207fe06efe5e6e6520ee8</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-scsi" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-scsi-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">13b8b6cb6975a18ae5b1795a76b7a80a820846d0a2d40b66b621ea75a26c471a</sum>
        </package>
        <package name="libvirt-daemon-driver-nodedev" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-nodedev-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">821d0ba5631d3172f8b71eebd353a4f473e0b52f86e4ba1bc582473389e761bb</sum>
        </package>
        <package name="libvirt-daemon-common" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-common-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fcf9fd1fd2a4d4de8f1b11bd552a865aa1fea7d34e2ec3a30b6fd1c998025397</sum>
        </package>
        <package name="libvirt-client" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-client-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d65f61df879df75d22cf09fff91d42c6cd3ac455adbc54fbe4641fb488214f11</sum>
        </package>
        <package name="libvirt-nss" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-nss-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8472f4eb71a99491f7d746d60d2dc45cd1cb8a43e494578f430e0112bf7640f3</sum>
        </package>
        <package name="libvirt-daemon-lock" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-lock-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c76bf5ffcb92b94e504b6893f174f3e8492f56432ecfb24bbcbc9f69a87a36f7</sum>
        </package>
        <package name="libvirt-daemon-config-nwfilter" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-config-nwfilter-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">954ad73d2ebfa8984171c44855194604bc8eb39c9ddb388fb8e31e79e8967b82</sum>
        </package>
        <package name="libvirt-client-qemu" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-client-qemu-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f6edffe499bcc670b85cf153f21ca4f89c242625d6e18e6c403fb2348afd78a1</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-rbd" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-rbd-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1fdbe91536dfd6021c3e90518fa9f8639a1415bed2e244df33a926db4204a23d</sum>
        </package>
        <package name="libvirt-daemon-kvm" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-kvm-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fc9e7ac734211a2ac3ffd52d13b5dc6ea3b820d0cfc5fa8dc1ee5767fcc6aea2</sum>
        </package>
        <package name="libvirt-daemon-driver-qemu" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-qemu-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3cedc632e3fd46f445f65de3adfa3d8f3a81968d54be3c279696d01af36b277e</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-disk" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-disk-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">96e247e0144b924fea779fcf20dbcd8df94587e35ea1528bf8e33e1de00f5a6a</sum>
        </package>
        <package name="libvirt-daemon-driver-storage" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8c366bb01a37fc984a8240d5af41e21566c213f31ace5ce6aaf876c7626ccf1c</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-logical" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-logical-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bed93d4cddabb863f5511c97ea974e02a71d5cf5b21585770f4dd3323c8ac0a5</sum>
        </package>
        <package name="libvirt-daemon-driver-nwfilter" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-nwfilter-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">735f598b83a0a43eb4a1efe33e8749e6fd2c810a44be19dd61c4dc713edb0787</sum>
        </package>
        <package name="libvirt-libs" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-libs-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">671001327af2e72a3265a95880871bd91d763a68ebb4a6a7014712c917059c96</sum>
        </package>
        <package name="libvirt-daemon-log" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-log-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f2163dd3b2cd2863fb31a39aa5a80615dd3c4792baf05a522567ff6cdfdda009</sum>
        </package>
        <package name="libvirt-daemon-plugin-lockd" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-plugin-lockd-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8163bdeb6a09bb789f67fdd38a64f1434f865de1440732df404abbf741def607</sum>
        </package>
        <package name="libvirt" arch="x86_64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-11.10.0-12.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e383ce34e507a9b477a6379a24204f338115b2beede76f0f6def2f62e19d3986</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18479</id>
    <title>Important: qemu-kvm security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:18479 (https://access.redhat.com/errata/RHSA-2026:18479), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for qemu-kvm.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

* firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)

* firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)

* firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699)

* firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695)

* firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11692" id="CVE-2024-11692" type="cve" title="CVE-2024-11692" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11694" id="CVE-2024-11694" type="cve" title="CVE-2024-11694" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11695" id="CVE-2024-11695" type="cve" title="CVE-2024-11695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11696" id="CVE-2024-11696" type="cve" title="CVE-2024-11696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11697" id="CVE-2024-11697" type="cve" title="CVE-2024-11697" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11699" id="CVE-2024-11699" type="cve" title="CVE-2024-11699" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328947" id="2328947" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328950" id="2328950" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328946" id="2328946" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328948" id="2328948" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328943" id="2328943" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328941" id="2328941" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18479" id="RLSA-2026:18479" type="self" title="RLSA-2026:18479" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:18479" id="RHSA-2026:18479" type="vendor" title="Red Hat RHSA-2026:18479" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qemu-kvm-ui-egl-headless" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-ui-egl-headless-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bb5d19cd665dee5fdf2ef071ac7ef29cb179de20ab26ed4e1c338d6628dbed44</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">59e80ad414270f97a44af9b7b366ca50c3eb3c337ee3b218e4f417bcec9ff849</sum>
        </package>
        <package name="qemu-kvm-block-blkio" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-block-blkio-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5f00efe82fc01b5600203a54cda2d75f3e60e8fdddcedd88e5ba74388dd6f9ad</sum>
        </package>
        <package name="qemu-kvm-block-rbd" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-block-rbd-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d89d3fd2b6db17b99ddd374d4d6a0cf0033219f9698f3ff214aa438618089008</sum>
        </package>
        <package name="qemu-kvm-ui-opengl" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-ui-opengl-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9514145bb353c00af68c4a592233dc52e7288d2d061b0104e638efd97fd02132</sum>
        </package>
        <package name="qemu-kvm-block-curl" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-block-curl-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">59eee51ed91d9e29738fa2f0cd2728d4e1f06e7d953db6aa37b54c2730cd7ba8</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu-pci" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2bc997f152a858b683f03a73a37aafaca1668a49490a3add987356f32f94e7b7</sum>
        </package>
        <package name="qemu-kvm-core" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-core-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7ab5d283261a4f54144c4735b31e4fd5080f1ad65eb484d26c44ce77522783b2</sum>
        </package>
        <package name="qemu-kvm-audio-pa" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-audio-pa-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">24c6a1ed7de7a302ecd731427006be5e31e9591a01aa3f4141f3eb3a6bce3308</sum>
        </package>
        <package name="qemu-kvm-common" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-common-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a826b292aa9ee0ea6e2e1ab84b4c3f4f09aaea871da393d3a7e8060e92eabcf7</sum>
        </package>
        <package name="qemu-pr-helper" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-pr-helper-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">412e866c77a12e589b362d11c3f7acce937887fab10d48e24ba3edd3a689c5f0</sum>
        </package>
        <package name="qemu-img" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-img-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c4350ce1be35b37d68aff185a95b46f50a8801dfdeeb5faf2f7c7ae5ddb0cc76</sum>
        </package>
        <package name="qemu-kvm-docs" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-docs-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a45279bf09366df8a633296d57fc440bedb8e1ab96886b246b61d3b595ec732e</sum>
        </package>
        <package name="qemu-kvm-device-usb-redirect" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">80c0c80af74776343c803ebcb64c4566f3b5ea42b1ec01bca84fdb2dce71fde8</sum>
        </package>
        <package name="qemu-kvm-tools" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-tools-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a48a3f5bba53f1715f970b194c92f06cb30d6a3c9396a0ab346f4bd4087fc022</sum>
        </package>
        <package name="qemu-guest-agent" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-guest-agent-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3c02fafff5211926b2c6568e8fa0b3aba13f73089f1541781438a24a77ea1a23</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-vga" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-device-display-virtio-vga-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">950e405c721e609c35367f8d5cf4d10658679fe6313c0e59298a395b7c81f0ec</sum>
        </package>
        <package name="qemu-kvm-device-usb-host" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-device-usb-host-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">203a397dd850bd892378d332e27ea2cf84ff22ec537068d3f85996e9cf9687a7</sum>
        </package>
        <package name="qemu-kvm" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-10.1.0-16.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d4b0ca4d0cf141a4a485248b4363d01f26eee3d4684596e3d5b3cd1a886a5f43</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18537</id>
    <title>Important: tomcat security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:18537 (https://access.redhat.com/errata/RHSA-2026:18537), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Security constraint bypass for CGI scripts (CVE-2025-46701)

* org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve (CVE-2025-55668)

* org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation (CVE-2025-55754)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46701" id="CVE-2025-46701" type="cve" title="CVE-2025-46701" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55668" id="CVE-2025-55668" type="cve" title="CVE-2025-55668" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55754" id="CVE-2025-55754" type="cve" title="CVE-2025-55754" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388226" id="2388226" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406590" id="2406590" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369253" id="2369253" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18537" id="RLSA-2026:18537" type="self" title="RLSA-2026:18537" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:18537" id="RHSA-2026:18537" type="vendor" title="Red Hat RHSA-2026:18537" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">130b16b3d6cc72f1196d44b33f8035a8c8ef32d189fedc1f0231adc06f2019e8</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-webapps-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">17866e11495a6e2d4a87717978187a86d3f5a2b3006f7960ba3d1a9551fd8125</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-lib-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">b55fa922868e1421cd14f4ed54f21bc1be43d0bfb3418f4ecc2a8a5e0a012029</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">a62eb9e00702a24823b3680d8cb92c4a5c102310f7c94b8a8244bc09b67837a8</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">3528cce63350ed624344e116de6208c251ed0dca2af72c3bcbd8b83d2f8f443d</sum>
        </package>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">012e48cf92056a36e8a62412279614fcfed9c1425917b827d49b48a3cd7b8daa</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">abf7a773524ec09c45476426470aa5ebc6cbb2cfc056d720aeb11f9ce5c742ee</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">986f2a4e5c9441329b2b337cbcd0d75f5ecac3035643eea080ad8f68b9433050</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18421</id>
    <title>Moderate: luksmeta security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:18421 (https://access.redhat.com/errata/RHSA-2026:18421), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for luksmeta.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in Rocky Linux.

Security Fix(es):

* luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11568" id="CVE-2025-11568" type="cve" title="CVE-2025-11568" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404244" id="2404244" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18421" id="RLSA-2026:18421" type="self" title="RLSA-2026:18421" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:18421" id="RHSA-2026:18421" type="vendor" title="Red Hat RHSA-2026:18421" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="luksmeta" arch="x86_64" epoch="0" version="10" release="1.el10" src="luksmeta-10-1.el10.src.rpm">
          <filename>luksmeta-10-1.el10.x86_64.rpm</filename>
          <sum type="sha256">60224fbd7cf8b481cee47c8ea901ade67986ab2918f8d21a8574cc02ce905adf</sum>
        </package>
        <package name="libluksmeta" arch="x86_64" epoch="0" version="10" release="1.el10" src="luksmeta-10-1.el10.src.rpm">
          <filename>libluksmeta-10-1.el10.x86_64.rpm</filename>
          <sum type="sha256">6d44adb3f4966ad86f5058044dee7464418a993797c07a535ddc4322c094da4a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18465</id>
    <title>Important: edk2 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:18465 (https://access.redhat.com/errata/RHSA-2026:18465), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for edk2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. 

Security Fix(es):

* edk2: EDK2: Improper Input Validation allows arbitrary command execution (CVE-2025-2296)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2296" id="CVE-2025-2296" type="cve" title="CVE-2025-2296" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420637" id="2420637" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18465" id="RLSA-2026:18465" type="self" title="RLSA-2026:18465" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:18465" id="RHSA-2026:18465" type="vendor" title="Red Hat RHSA-2026:18465" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="edk2-ovmf" arch="noarch" epoch="0" version="20251114" release="5.el10" src="edk2-20251114-5.el10.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10.noarch.rpm</filename>
          <sum type="sha256">5359ed95167aff9de81c6fe3303b207124d00363e1155055196a01d548755718</sum>
        </package>
        <package name="edk2-aarch64" arch="noarch" epoch="0" version="20251114" release="5.el10" src="edk2-20251114-5.el10.src.rpm">
          <filename>edk2-aarch64-20251114-5.el10.noarch.rpm</filename>
          <sum type="sha256">5350b11aef80978c27b88d7d7e3ff44caf66d94085b267a77be635777bb33573</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19031</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19031 (https://access.redhat.com/errata/RHSA-2026:19031), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19031" id="RLSA-2026:19031" type="self" title="RLSA-2026:19031" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19031" id="RHSA-2026:19031" type="vendor" title="Red Hat RHSA-2026:19031" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.22.2" release="1.el10_2" src="skopeo-1.22.2-1.el10_2.src.rpm">
          <filename>skopeo-tests-1.22.2-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8a418594cfca6c845799c97c202d943fac15a8860ebf3e261655c015ca280ce9</sum>
        </package>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.22.2" release="1.el10_2" src="skopeo-1.22.2-1.el10_2.src.rpm">
          <filename>skopeo-1.22.2-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">408b24df2e2cf7d6ca48cbd0f8161e2ac2c05c65e1fbfcaaefbe86784131e1f0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19024</id>
    <title>Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19024 (https://access.redhat.com/errata/RHSA-2026:19024), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-ugly-free, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

* GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)

* GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)

* GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)

* GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2920" id="CVE-2026-2920" type="cve" title="CVE-2026-2920" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2921" id="CVE-2026-2921" type="cve" title="CVE-2026-2921" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2922" id="CVE-2026-2922" type="cve" title="CVE-2026-2922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2923" id="CVE-2026-2923" type="cve" title="CVE-2026-2923" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3082" id="CVE-2026-3082" type="cve" title="CVE-2026-3082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3083" id="CVE-2026-3083" type="cve" title="CVE-2026-3083" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3085" id="CVE-2026-3085" type="cve" title="CVE-2026-3085" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447496" id="2447496" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447492" id="2447492" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447495" id="2447495" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447498" id="2447498" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447503" id="2447503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447490" id="2447490" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447500" id="2447500" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19024" id="RLSA-2026:19024" type="self" title="RLSA-2026:19024" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19024" id="RHSA-2026:19024" type="vendor" title="Red Hat RHSA-2026:19024" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-base-tools" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-tools-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">205cfc4a714f2cf26373d9e0b9373f4953c3ccfca86142752f79c28d9e35f869</sum>
        </package>
        <package name="gstreamer1-plugins-base" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">38cb8c7382c32e81b0f9f1dab3c4056a347826e546be4b161d0504e3c5f4bf45</sum>
        </package>
        <package name="gstreamer1-plugins-good" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a8631a4a02344f743e47ccd1f26f22c3170a306bf6ac1639e43277e40cbf88bb</sum>
        </package>
        <package name="gstreamer1-plugins-base-devel" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-devel-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2fa40ca03b2a2fbe56be6b3778d1fc7e45574de69418f8c523c13c585336dae7</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">017a3d4f527664b3124247b725b5a4d7fabfc74eba07cdc19576821b5d15cea9</sum>
        </package>
        <package name="gstreamer1-plugins-ugly-free" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bef7784c118cb6329d6990a3379aaf7a545adbf7bb978b62b125532e6d84f7d3</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">829e65bb76470579875defa4482b406498118df9746e7674b242807f44fb53af</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6c32863b0b62f08e893d9a07f78398c5764be6e57f5f8366aa330c64c7743470</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19013</id>
    <title>Moderate: delve security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19013 (https://access.redhat.com/errata/RHSA-2026:19013), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19013" id="RLSA-2026:19013" type="self" title="RLSA-2026:19013" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19013" id="RHSA-2026:19013" type="vendor" title="Red Hat RHSA-2026:19013" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.26.1" release="1.el10_2" src="delve-1.26.1-1.el10_2.src.rpm">
          <filename>delve-1.26.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d156edb2978a93d8e6b28edc8c52b1f45d7446879b84f65b5be80f6d73a9676f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19017</id>
    <title>Important: podman security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19017 (https://access.redhat.com/errata/RHSA-2026:19017), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455470" id="2455470" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19017" id="RLSA-2026:19017" type="self" title="RLSA-2026:19017" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19017" id="RHSA-2026:19017" type="vendor" title="Red Hat RHSA-2026:19017" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="7" version="5.8.2" release="1.el10_2" src="podman-5.8.2-1.el10_2.src.rpm">
          <filename>podman-5.8.2-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a53e80e1e91e44ac20806df57d615b088de070aa926efadf68cddbeb6b56fa45</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.8.2" release="1.el10_2" src="podman-5.8.2-1.el10_2.src.rpm">
          <filename>podman-remote-5.8.2-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9f763ef246e4c7970105ff73d25911a7a88e43e16fa66bea9175a266defe36ca</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.8.2" release="1.el10_2" src="podman-5.8.2-1.el10_2.src.rpm">
          <filename>podman-docker-5.8.2-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">78a4e72643435d42630cba7b1576eb50435d537ac11546a8c72ae3f5b5c38300</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19042</id>
    <title>Low: python-jwcrypto security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19042 (https://access.redhat.com/errata/RHSA-2026:19042), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>An update is available for python-jwcrypto.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39373" id="CVE-2026-39373" type="cve" title="CVE-2026-39373" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456187" id="2456187" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19042" id="RLSA-2026:19042" type="self" title="RLSA-2026:19042" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19042" id="RHSA-2026:19042" type="vendor" title="Red Hat RHSA-2026:19042" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-jwcrypto" arch="noarch" epoch="0" version="1.5.6" release="5.el10_2" src="python-jwcrypto-1.5.6-5.el10_2.src.rpm">
          <filename>python3-jwcrypto-1.5.6-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">78484611baf47da48010b9798934706734350c5a986e150c820ea8059583e976</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19020</id>
    <title>Moderate: crun security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19020 (https://access.redhat.com/errata/RHSA-2026:19020), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for crun.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>crun is a OCI runtime

Security Fix(es):

* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30892" id="CVE-2026-30892" type="cve" title="CVE-2026-30892" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451576" id="2451576" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19020" id="RLSA-2026:19020" type="self" title="RLSA-2026:19020" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19020" id="RHSA-2026:19020" type="vendor" title="Red Hat RHSA-2026:19020" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="crun" arch="x86_64" epoch="0" version="1.27" release="2.el10_2" src="crun-1.27-2.el10_2.src.rpm">
          <filename>crun-1.27-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7bc4bbcfc0bfd1aa4017164619a8fc89e17241252359d0b2f0e35132d753979a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19022</id>
    <title>Important: golang security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19022 (https://access.redhat.com/errata/RHSA-2026:19022), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445345" id="2445345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19022" id="RLSA-2026:19022" type="self" title="RLSA-2026:19022" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19022" id="RHSA-2026:19022" type="vendor" title="Red Hat RHSA-2026:19022" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang-src" arch="noarch" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-src-1.26.2-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">a586737a229c2a9e6d75979830228853d74741a45951c3ea388bde3c7f577996</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>go-toolset-1.26.2-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8b0d91c6ac754cced84665d5a598f7d2e811bc244c50d06fbc6db1bce9423bee</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-race-1.26.2-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cd206280ad17f069658a5e6f168f6cfbd190216aac99417bd666cbe399508902</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-tests-1.26.2-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">5be63adb0380d54c1bb05aeb4182f89325f9cec23b22a4a0b77f3a726749a5bf</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-1.26.2-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0939ca0a87cb8bf03f14bc813f8ca78344e936dfa86355100c2ae3ba09579cf5</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-docs-1.26.2-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">7e30150120c2135156d2364875a3a176c856d990acd0b29685648e3ee2635b7e</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-bin-1.26.2-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">16183f9bf1432c77964a722cb90e42500d25504dd660ce4d2e7364585029e13e</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-misc-1.26.2-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">62336b8ca69aae9f5aac73ab7bf27c2cf1c64cd361080ac3b82c9ec9c6861ae4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19054</id>
    <title>Important: tomcat security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19054 (https://access.redhat.com/errata/RHSA-2026:19054), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24734" id="CVE-2026-24734" type="cve" title="CVE-2026-24734" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440426" id="2440426" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19054" id="RLSA-2026:19054" type="self" title="RLSA-2026:19054" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19054" id="RHSA-2026:19054" type="vendor" title="Red Hat RHSA-2026:19054" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-lib-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">b55fa922868e1421cd14f4ed54f21bc1be43d0bfb3418f4ecc2a8a5e0a012029</sum>
        </package>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">012e48cf92056a36e8a62412279614fcfed9c1425917b827d49b48a3cd7b8daa</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">abf7a773524ec09c45476426470aa5ebc6cbb2cfc056d720aeb11f9ce5c742ee</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">3528cce63350ed624344e116de6208c251ed0dca2af72c3bcbd8b83d2f8f443d</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">130b16b3d6cc72f1196d44b33f8035a8c8ef32d189fedc1f0231adc06f2019e8</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">986f2a4e5c9441329b2b337cbcd0d75f5ecac3035643eea080ad8f68b9433050</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">a62eb9e00702a24823b3680d8cb92c4a5c102310f7c94b8a8244bc09b67837a8</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-webapps-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">17866e11495a6e2d4a87717978187a86d3f5a2b3006f7960ba3d1a9551fd8125</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19034</id>
    <title>Moderate: python-tornado security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19034 (https://access.redhat.com/errata/RHSA-2026:19034), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for python-tornado.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31958" id="CVE-2026-31958" type="cve" title="CVE-2026-31958" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35536" id="CVE-2026-35536" type="cve" title="CVE-2026-35536" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2454716" id="2454716" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446765" id="2446765" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19034" id="RLSA-2026:19034" type="self" title="RLSA-2026:19034" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19034" id="RHSA-2026:19034" type="vendor" title="Red Hat RHSA-2026:19034" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-tornado" arch="x86_64" epoch="0" version="6.5.5" release="1.el10_1.1" src="python-tornado-6.5.5-1.el10_1.1.src.rpm">
          <filename>python3-tornado-6.5.5-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">0dbba37952b979e3e36e80ff671a9af7c16ad7a732854526c84e0a9c5a34aa4c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19009</id>
    <title>Important: postgresql18 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19009 (https://access.redhat.com/errata/RHSA-2026:19009), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql18.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)

* postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

* postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)

* postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)

* postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2007" id="CVE-2026-2007" type="cve" title="CVE-2026-2007" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439326" id="2439326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439324" id="2439324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439320" id="2439320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439322" id="2439322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439325" id="2439325" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19009" id="RLSA-2026:19009" type="self" title="RLSA-2026:19009" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19009" id="RHSA-2026:19009" type="vendor" title="Red Hat RHSA-2026:19009" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postgresql18-server" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-server-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">eb44766e0585313b36b3407a82f708cdb2f0a5c7cc03be32b5c4e7337ceef211</sum>
        </package>
        <package name="postgresql18-upgrade" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-upgrade-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">a0b360a2a06d67e5e7e824aeb839faef6c151bc7bcb2de9177e99a8e3a2b00ee</sum>
        </package>
        <package name="postgresql18-test" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-test-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">692189c50af9cf1bb4248ed8414736b3c3e93f8bfe23143ff27ee66c7fd39577</sum>
        </package>
        <package name="postgresql18-plperl" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-plperl-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">d8ca5234d4aed8cf6a6c85506d463e7259994d0acd70e6cc8634f340394f75e4</sum>
        </package>
        <package name="postgresql18" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">83bc1169109cced630a07c36ecf6b6e75a33db803194f4822b56ee56189242b9</sum>
        </package>
        <package name="postgresql18-private-devel" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-private-devel-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">20c4c5927be318ddc7e12176a4b95e537ea81ca70eee462c8bd97b28f98fb94c</sum>
        </package>
        <package name="postgresql18-static" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-static-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">28844c855a4e39774eed66c0c8c8e9a1ed1210d6f530f5bd59cd7733512a4085</sum>
        </package>
        <package name="postgresql18-plpython3" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-plpython3-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">638f815b46952ad44d5bd804e4083a27c01d9d69a11b5ad28cd5487e39365dd5</sum>
        </package>
        <package name="postgresql18-private-libs" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-private-libs-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">d06cfda62bc2054e6157cacf22709e40a120e0c44f9080e098f7a82878bfab1a</sum>
        </package>
        <package name="postgresql18-upgrade-devel" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-upgrade-devel-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">f5709c9fc8450a7e2e936b3d2023cd97026a5564e910136bc5df437d9782e76d</sum>
        </package>
        <package name="postgresql18-server-devel" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-server-devel-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">55cce7e9165220233b179890a859f366eac4fbf159721ad9fd0de84a606737fc</sum>
        </package>
        <package name="postgresql18-contrib" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-contrib-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">70beffa9f26447e0552c1d28248e1976b74ba456dd83c57b3ca69f41ccd4e870</sum>
        </package>
        <package name="postgresql18-docs" arch="x86_64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-docs-18.3-1.el10.x86_64.rpm</filename>
          <sum type="sha256">abc143dfadd268d0789c4288c849b36866c7de2f463a4ecb2a7d564c7d701da2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19032</id>
    <title>Important: buildah security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19032 (https://access.redhat.com/errata/RHSA-2026:19032), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19032" id="RLSA-2026:19032" type="self" title="RLSA-2026:19032" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19032" id="RHSA-2026:19032" type="vendor" title="Red Hat RHSA-2026:19032" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.43.1" release="1.el10_2" src="buildah-1.43.1-1.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c8ce07787ce34f15098c4f1cd96c88a7d452fe5902c9ade48df402f978b6e36d</sum>
        </package>
        <package name="buildah" arch="x86_64" epoch="2" version="1.43.1" release="1.el10_2" src="buildah-1.43.1-1.el10_2.src.rpm">
          <filename>buildah-1.43.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">87b28f688f3a15435858e86983d168464a89484fb09337c9e4a8eccce4d76c61</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19010</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19010 (https://access.redhat.com/errata/RHSA-2026:19010), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

* postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)

* postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)

* postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439322" id="2439322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439326" id="2439326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439324" id="2439324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439325" id="2439325" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19010" id="RLSA-2026:19010" type="self" title="RLSA-2026:19010" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19010" id="RHSA-2026:19010" type="vendor" title="Red Hat RHSA-2026:19010" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postgresql-pltcl" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-pltcl-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f1148225856b3a23c615ac3353637f376dc5f722b5ffe0b55f9836097dc7248c</sum>
        </package>
        <package name="postgresql-test" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-test-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c8ff7236899a608a19742e89f157b3c954b5325ec6e98693c30fb874292ce4f1</sum>
        </package>
        <package name="postgresql-docs" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-docs-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">dc6c0ea794ef7caad8e64b534461785279963853bce3dd17aa614685ddc8143e</sum>
        </package>
        <package name="postgresql-upgrade" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">bbaa940c2772c32ab0d8f9aba06946b5b3240dd92a4465fe116791fb9464643c</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-devel-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b8e915b2f81e3d4162a0af085764f10dbf7275b34786b6b1c4a0c5f887efc655</sum>
        </package>
        <package name="postgresql-plpython3" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plpython3-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4d206b98eacba4020c3afb216f927dc9cb6a3510c90f6de3309abfbf18b927dc</sum>
        </package>
        <package name="postgresql-server-devel" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-devel-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ecc05602fbd70b728d5650dbe55ebef287e198d7e14ded1c5dea917c305e3e24</sum>
        </package>
        <package name="postgresql-private-libs" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-libs-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b7f5141db1187e4c9c3b31f6a063b767c1351750ab19b942c005177bec91ee79</sum>
        </package>
        <package name="postgresql-static" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-static-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">588f6e8ba3097e363bc170fe8fc744eaf01ddf2d1d2bd73408da34f5f48e29ff</sum>
        </package>
        <package name="postgresql-server" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d6016a2a5606030f1d91f9ca8b6f6702f01298e165f30ae80f0562b9562050f2</sum>
        </package>
        <package name="postgresql-plperl" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plperl-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b7e62f6de8b1072d727098bacc7c0821f54717e8d6edcc102750f438978ffa5e</sum>
        </package>
        <package name="postgresql" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">eb97f78910abd34961a6832e0caa67d88313db86a4061df178de114b696a905f</sum>
        </package>
        <package name="postgresql-private-devel" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-devel-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ac082bb70390f1a58feb81e556ebd34ded9b73bcffeba8e4fb7b6f346e4d1d23</sum>
        </package>
        <package name="postgresql-contrib" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-contrib-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e3db43a735eeb2dc9d338884656f564572c46054ca194bce2bebbab209feae5c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19019</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19019 (https://access.redhat.com/errata/RHSA-2026:19019), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python3.14.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)

* cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

* cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

* cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

* python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

* python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

* python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865" id="CVE-2026-0865" type="cve" title="CVE-2026-0865" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5713" id="CVE-2026-5713" type="cve" title="CVE-2026-5713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448181" id="2448181" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448168" id="2448168" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449649" id="2449649" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2444691" id="2444691" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457409" id="2457409" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458049" id="2458049" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458239" id="2458239" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431367" id="2431367" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457932" id="2457932" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19019" id="RLSA-2026:19019" type="self" title="RLSA-2026:19019" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19019" id="RHSA-2026:19019" type="vendor" title="Red Hat RHSA-2026:19019" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3.14-tkinter" arch="x86_64" epoch="0" version="3.14.4" release="2.el10_2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.4-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">690c5175ffe2c1503f009b029cb143d11392d89be9d9db9dbea6e7a63103844f</sum>
        </package>
        <package name="python3.14-devel" arch="x86_64" epoch="0" version="3.14.4" release="2.el10_2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.4-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bf1b6db613a2a46a84ab0499233ee4ea7832328556805d42e0f5303a8c799957</sum>
        </package>
        <package name="python3.14-libs" arch="x86_64" epoch="0" version="3.14.4" release="2.el10_2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.4-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9e16ec14c53ac7c344b1c1bd37d7ef6ab277d91ecd5439567fc4d9c1cb7cbcf3</sum>
        </package>
        <package name="python3.14" arch="x86_64" epoch="0" version="3.14.4" release="2.el10_2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-3.14.4-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1310d471f0a5ef839814ddf52e38b16df3b5760e48f311d63587b769f33a003e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19053</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19053 (https://access.redhat.com/errata/RHSA-2026:19053), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freeipmi.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.

Security Fix(es):

* freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33554" id="CVE-2026-33554" type="cve" title="CVE-2026-33554" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450778" id="2450778" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19053" id="RLSA-2026:19053" type="self" title="RLSA-2026:19053" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19053" id="RHSA-2026:19053" type="vendor" title="Red Hat RHSA-2026:19053" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freeipmi-ipmidetectd" arch="x86_64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-ipmidetectd-1.6.17-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4b466bba50319c478e7bededa2f5dec95050e64b4443ffe7ce009ade563c0522</sum>
        </package>
        <package name="freeipmi-bmc-watchdog" arch="x86_64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-bmc-watchdog-1.6.17-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">56fc51540800512cf3152f00a8367af46ee5eb56160abda903b6a0479740d3f5</sum>
        </package>
        <package name="freeipmi" arch="x86_64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-1.6.17-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ed8ea06e7e73615c3bf4e92edebd9dc0d7e0c9b0c8fa8bd99a8496b573975438</sum>
        </package>
        <package name="freeipmi-ipmiseld" arch="x86_64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-ipmiseld-1.6.17-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c499c00f4aaf8175ef4743a78434c524b5cf77d1eff09e87a58fa52f086752ac</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19021</id>
    <title>Moderate: galera and mariadb11.8 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19021 (https://access.redhat.com/errata/RHSA-2026:19021), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mariadb11.8, galera.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* MariaDB: MariaDB: Remote Code Execution or Denial of Service via JSON_SCHEMA_VALID() function vulnerability (CVE-2026-32710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32710" id="CVE-2026-32710" type="cve" title="CVE-2026-32710" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449711" id="2449711" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19021" id="RLSA-2026:19021" type="self" title="RLSA-2026:19021" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19021" id="RHSA-2026:19021" type="vendor" title="Red Hat RHSA-2026:19021" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mariadb11.8-pam" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-pam-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b0f6381302f5536c8a8074d5a59edae3c6975d448385b8829167ba17e2033a49</sum>
        </package>
        <package name="mariadb11.8-client-utils" arch="noarch" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-client-utils-11.8.6-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">818c4014e34ab211f5634a1cd33e8d7c2c18e7cad7be2d79c110dbef25aa27ad</sum>
        </package>
        <package name="mariadb11.8-errmsg" arch="noarch" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-errmsg-11.8.6-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">fba9d75ce9e6a21ed337fddb5c1a6aa8a34eb0380e7fe299f66e1f6fe224fbbd</sum>
        </package>
        <package name="mariadb11.8-common" arch="noarch" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-common-11.8.6-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">4bcb9f412c29f9f64f6e7e3aa54094e5f8ee52398a212ff5b21c1c17422df063</sum>
        </package>
        <package name="mariadb11.8-server" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-server-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9048c43a5f87dbfeda2983f0a26311ad787d1ad042b62b05768ec86775adf4ae</sum>
        </package>
        <package name="mariadb11.8-backup" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-backup-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">52b310da20d8c3bc4e4b46b97a2e23169fa2a3014bde645937442aab9b31d69e</sum>
        </package>
        <package name="mariadb11.8-devel" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-devel-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2a198604683ac4423deaeb05fb3c92492df266c2c4d8373580ce65f47232917a</sum>
        </package>
        <package name="galera" arch="x86_64" epoch="0" version="26.4.25" release="1.el10_2" src="galera-26.4.25-1.el10_2.src.rpm">
          <filename>galera-26.4.25-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">565f754048cc0d6f85352fa17c08d9f153c4b52e8fee236660df623195bb8a21</sum>
        </package>
        <package name="mariadb11.8-embedded-devel" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-embedded-devel-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4641189f158bb4024899cf6d1f462f181657a53e1af2d573a260650f275464fb</sum>
        </package>
        <package name="mariadb11.8-server-utils" arch="noarch" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-server-utils-11.8.6-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">7fd435b14cbc5eabc874af156f7b0d4729778d22677f06a873e22aa402b280d2</sum>
        </package>
        <package name="mariadb11.8-server-galera" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-server-galera-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c042817deca7a8722db70974687161061127bfd642dc5afc0d047b05b9cebae5</sum>
        </package>
        <package name="mariadb11.8" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">761148d2297a1aea9b2a58e05a656554de3dd118983beebd2ab954623cd3d322</sum>
        </package>
        <package name="mariadb11.8-embedded" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-embedded-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cecc4d19ed694298726eb6c36d73be978f13377c6b98f5dec234c46c99c8e7c5</sum>
        </package>
        <package name="mariadb11.8-test" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-test-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2e91d17647f9b17834a31ee9c723fa639a6b84be437a072f0809ac82665b52fa</sum>
        </package>
        <package name="mariadb11.8-oqgraph-engine" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-oqgraph-engine-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6ec6320f4f58728ff2bd7029996d47c361ae466910af9928eead2be33b708a62</sum>
        </package>
        <package name="mariadb11.8-gssapi-server" arch="x86_64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-gssapi-server-11.8.6-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">96f8f0fecd20ddd1b6493032c8d13c5119ae783b83c7ebe3d5a1d9a0ebd61cd9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19043</id>
    <title>Moderate: corosync security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19043 (https://access.redhat.com/errata/RHSA-2026:19043), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for corosync.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.

Security Fix(es):

* corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)

* corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35091" id="CVE-2026-35091" type="cve" title="CVE-2026-35091" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35092" id="CVE-2026-35092" type="cve" title="CVE-2026-35092" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453814" id="2453814" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453813" id="2453813" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19043" id="RLSA-2026:19043" type="self" title="RLSA-2026:19043" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19043" id="RHSA-2026:19043" type="vendor" title="Red Hat RHSA-2026:19043" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="corosynclib" arch="x86_64" epoch="0" version="3.1.10" release="1.el10_2.1" src="corosync-3.1.10-1.el10_2.1.src.rpm">
          <filename>corosynclib-3.1.10-1.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">dd0d1248d70f34f4932babe5c36c5b0f9b3774420d43375c46a357c381c4fea8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19137</id>
    <title>Important: go-fdo-server security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19137 (https://access.redhat.com/errata/RHSA-2026:19137), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-fdo-server.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.

Security Fix(es):

* github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33816" id="CVE-2026-33816" type="cve" title="CVE-2026-33816" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455972" id="2455972" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19137" id="RLSA-2026:19137" type="self" title="RLSA-2026:19137" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19137" id="RHSA-2026:19137" type="vendor" title="Red Hat RHSA-2026:19137" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-fdo-server-rendezvous" arch="noarch" epoch="0" version="1.0.1" release="1.el10_2" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1c12d91cf1a66cecad349cf5cd56929fcaad8b9040c2e3bcd1bcec0e1280da9e</sum>
        </package>
        <package name="go-fdo-server" arch="x86_64" epoch="0" version="1.0.1" release="1.el10_2" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-1.0.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e4d733a2644f510bac6203d20a46d38d32f9d78075a81897fbcd8159d2cd8a67</sum>
        </package>
        <package name="go-fdo-server-owner" arch="noarch" epoch="0" version="1.0.1" release="1.el10_2" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">d7b6a4b8e44383771a8b9dcdd5015773c1565d780d2db22f0b840b56fa733fe9</sum>
        </package>
        <package name="go-fdo-server-manufacturer" arch="noarch" epoch="0" version="1.0.1" release="1.el10_2" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">e96f54ca7abcda1e02fcb3f7c4282cf6748696902730abed8513027ad6218bc7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19139</id>
    <title>Important: go-fdo-client security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19139 (https://access.redhat.com/errata/RHSA-2026:19139), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-fdo-client.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.

Security Fix(es):

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19139" id="RLSA-2026:19139" type="self" title="RLSA-2026:19139" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19139" id="RHSA-2026:19139" type="vendor" title="Red Hat RHSA-2026:19139" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-fdo-client" arch="x86_64" epoch="0" version="1.0.0" release="3.el10_2" src="go-fdo-client-1.0.0-3.el10_2.src.rpm">
          <filename>go-fdo-client-1.0.0-3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bfe02315c6e2d912454e7fc71094fd900f94d3f55f29dd22d78b005a1362c124</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19135</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19135 (https://access.redhat.com/errata/RHSA-2026:19135), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186" id="CVE-2026-33186" type="cve" title="CVE-2026-33186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810" id="CVE-2026-33810" type="cve" title="CVE-2026-33810" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449833" id="2449833" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456335" id="2456335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455470" id="2455470" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19135" id="RLSA-2026:19135" type="self" title="RLSA-2026:19135" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19135" id="RHSA-2026:19135" type="vendor" title="Red Hat RHSA-2026:19135" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.144.0" release="2.el10_2" src="opentelemetry-collector-0.144.0-2.el10_2.src.rpm">
          <filename>opentelemetry-collector-0.144.0-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">afa2423c77ddbda0edad5c477c28ec43df0b6007e7c26cf42fefb9688ea5cb3e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19136</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19136 (https://access.redhat.com/errata/RHSA-2026:19136), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19136" id="RLSA-2026:19136" type="self" title="RLSA-2026:19136" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19136" id="RHSA-2026:19136" type="vendor" title="Red Hat RHSA-2026:19136" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-pcp" arch="x86_64" epoch="0" version="5.3.0" release="5.el10_2" src="grafana-pcp-5.3.0-5.el10_2.src.rpm">
          <filename>grafana-pcp-5.3.0-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5abd789e7a45d2f7aca993f0963796f056fe3471f613db7eba697c0a441b9107</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19160</id>
    <title>Important: firefox security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19160 (https://access.redhat.com/errata/RHSA-2026:19160), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Other issue in the WebRTC component (CVE-2026-8094)

* firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092)

* firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8090" id="CVE-2026-8090" type="cve" title="CVE-2026-8090" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8092" id="CVE-2026-8092" type="cve" title="CVE-2026-8092" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8094" id="CVE-2026-8094" type="cve" title="CVE-2026-8094" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467708" id="2467708" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467706" id="2467706" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467709" id="2467709" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19160" id="RLSA-2026:19160" type="self" title="RLSA-2026:19160" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19160" id="RHSA-2026:19160" type="vendor" title="Red Hat RHSA-2026:19160" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.10.2" release="1.el10_2" src="firefox-140.10.2-1.el10_2.src.rpm">
          <filename>firefox-140.10.2-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4c9427b2082e0905eef39c58b23d511251ebfbc7e1259ab75cfd2f2a5fa29810</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19158</id>
    <title>Important: dnsmasq security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19158 (https://access.redhat.com/errata/RHSA-2026:19158), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dnsmasq.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.

Security Fix(es):

* dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)

* dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)

* dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)

* dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)

* dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

* dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2291" id="CVE-2026-2291" type="cve" title="CVE-2026-2291" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4890" id="CVE-2026-4890" type="cve" title="CVE-2026-4890" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4891" id="CVE-2026-4891" type="cve" title="CVE-2026-4891" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4892" id="CVE-2026-4892" type="cve" title="CVE-2026-4892" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4893" id="CVE-2026-4893" type="cve" title="CVE-2026-4893" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5172" id="CVE-2026-5172" type="cve" title="CVE-2026-5172" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458517" id="2458517" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439088" id="2439088" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458521" id="2458521" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458516" id="2458516" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458519" id="2458519" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458518" id="2458518" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19158" id="RLSA-2026:19158" type="self" title="RLSA-2026:19158" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19158" id="RHSA-2026:19158" type="vendor" title="Red Hat RHSA-2026:19158" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dnsmasq" arch="x86_64" epoch="0" version="2.90" release="7.el10_2" src="dnsmasq-2.90-7.el10_2.src.rpm">
          <filename>dnsmasq-2.90-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ceee77e73cb1cd643f16ddf68e6e12beab7c898271fe3d89015eeddf7671f1f9</sum>
        </package>
        <package name="dnsmasq-utils" arch="x86_64" epoch="0" version="2.90" release="7.el10_2" src="dnsmasq-2.90-7.el10_2.src.rpm">
          <filename>dnsmasq-utils-2.90-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ae6ff2c8ce36cbb6bf19a53f942e650731a734741e8679c5bc93d97c834efb80</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19128</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19128 (https://access.redhat.com/errata/RHSA-2026:19128), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19128" id="RLSA-2026:19128" type="self" title="RLSA-2026:19128" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19128" id="RHSA-2026:19128" type="vendor" title="Red Hat RHSA-2026:19128" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="x86_64" epoch="0" version="0.2.3" release="6.el10_2" src="yggdrasil-worker-package-manager-0.2.3-6.el10_2.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-6.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a210a1b334df6558a86bfc07ccd4962fc0b7473e7694ece6c04d26c285105a7c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19134</id>
    <title>Important: grafana security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19134 (https://access.redhat.com/errata/RHSA-2026:19134), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27877" id="CVE-2026-27877" type="cve" title="CVE-2026-27877" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452293" id="2452293" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19134" id="RLSA-2026:19134" type="self" title="RLSA-2026:19134" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19134" id="RHSA-2026:19134" type="vendor" title="Red Hat RHSA-2026:19134" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="26.el10_2" src="grafana-10.2.6-26.el10_2.src.rpm">
          <filename>grafana-selinux-10.2.6-26.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1e237e4af1522bd832bb9c943c217922f93f3ad7bb44acdf70520abb52947d96</sum>
        </package>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="26.el10_2" src="grafana-10.2.6-26.el10_2.src.rpm">
          <filename>grafana-10.2.6-26.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8bd8e0347da5696ce67c4a94d604a7fc6132bc67828e087afd8ce1e3d24721ce</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19125</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19125 (https://access.redhat.com/errata/RHSA-2026:19125), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)

* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)

* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999" id="CVE-2026-33999" type="cve" title="CVE-2026-33999" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001" id="CVE-2026-34001" type="cve" title="CVE-2026-34001" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003" id="CVE-2026-34003" type="cve" title="CVE-2026-34003" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451106" id="2451106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451109" id="2451109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451113" id="2451113" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19125" id="RLSA-2026:19125" type="self" title="RLSA-2026:19125" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19125" id="RHSA-2026:19125" type="vendor" title="Red Hat RHSA-2026:19125" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="x86_64" epoch="0" version="24.1.9" release="4.el10_2" src="xorg-x11-server-Xwayland-24.1.9-4.el10_2.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.9-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">91956fba79cb6ac7bc4ebeab188c792162e0936259d552254dd1bca4e6c6ee02</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19126</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19126 (https://access.redhat.com/errata/RHSA-2026:19126), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19126" id="RLSA-2026:19126" type="self" title="RLSA-2026:19126" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19126" id="RHSA-2026:19126" type="vendor" title="Red Hat RHSA-2026:19126" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.9" release="4.el10_2" src="yggdrasil-0.4.9-4.el10_2.src.rpm">
          <filename>yggdrasil-0.4.9-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b43b323e42d834b5d340e90ce9ab9b3ce8371ed577a9514d0a091a15a74d4ee9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19141</id>
    <title>Important: PackageKit security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19141 (https://access.redhat.com/errata/RHSA-2026:19141), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for PackageKit.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.

Security Fix(es):

* PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41651" id="CVE-2026-41651" type="cve" title="CVE-2026-41651" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460604" id="2460604" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19141" id="RLSA-2026:19141" type="self" title="RLSA-2026:19141" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19141" id="RHSA-2026:19141" type="vendor" title="Red Hat RHSA-2026:19141" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="PackageKit-glib" arch="x86_64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-glib-1.2.8-8.el10.x86_64.rpm</filename>
          <sum type="sha256">b3731bfcfd51daf33b671edae26010c9a78554e6fe00f463ee473b8ac967cd09</sum>
        </package>
        <package name="PackageKit-command-not-found" arch="x86_64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-command-not-found-1.2.8-8.el10.x86_64.rpm</filename>
          <sum type="sha256">e06c410ea229db1620a0e3d7e2058c519024c8971c900118def917315d2c4e44</sum>
        </package>
        <package name="PackageKit-gstreamer-plugin" arch="x86_64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-gstreamer-plugin-1.2.8-8.el10.x86_64.rpm</filename>
          <sum type="sha256">a3fa0d864f0575f2143ba9dfc0c48faa2b53a1b36ee2c594e5bd0ddbb00f0d16</sum>
        </package>
        <package name="PackageKit-gtk3-module" arch="x86_64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-gtk3-module-1.2.8-8.el10.x86_64.rpm</filename>
          <sum type="sha256">925f47072301c302fa507c627cdc504dbcae2cdc734b0e357e2286b20cb0a8d6</sum>
        </package>
        <package name="PackageKit" arch="x86_64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-1.2.8-8.el10.x86_64.rpm</filename>
          <sum type="sha256">9257d5f8b6dea2d00f7b168b8ba4d82bc4c618d72a6488d20506ebd36f0f61fb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19149</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19149 (https://access.redhat.com/errata/RHSA-2026:19149), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dovecot.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. 

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)

* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59032" id="CVE-2025-59032" type="cve" title="CVE-2025-59032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27857" id="CVE-2026-27857" type="cve" title="CVE-2026-27857" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27858" id="CVE-2026-27858" type="cve" title="CVE-2026-27858" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452175" id="2452175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452179" id="2452179" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452172" id="2452172" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19149" id="RLSA-2026:19149" type="self" title="RLSA-2026:19149" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19149" id="RHSA-2026:19149" type="vendor" title="Red Hat RHSA-2026:19149" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dovecot-mysql" arch="x86_64" epoch="1" version="2.3.21" release="19.el10_2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-mysql-2.3.21-19.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d2459223cd4898966c1f91e908006ea88dae7231f142b5982eca1cd91d126a79</sum>
        </package>
        <package name="dovecot-pigeonhole" arch="x86_64" epoch="1" version="2.3.21" release="19.el10_2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-pigeonhole-2.3.21-19.el10_2.x86_64.rpm</filename>
          <sum type="sha256">10e387abe7d61c5d38d719fbab4d91a65c641708b02ce297dd6ceca3a063138f</sum>
        </package>
        <package name="dovecot" arch="x86_64" epoch="1" version="2.3.21" release="19.el10_2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-2.3.21-19.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e40ac34efd7d43112775297a3f3ef1816eab220d0ec04899b536598e0b02766c</sum>
        </package>
        <package name="dovecot-pgsql" arch="x86_64" epoch="1" version="2.3.21" release="19.el10_2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-pgsql-2.3.21-19.el10_2.x86_64.rpm</filename>
          <sum type="sha256">372622adb0ea182177405f70d91b6716f9a22f48f90c4e8b73069df292884b1f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19144</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19144 (https://access.redhat.com/errata/RHSA-2026:19144), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810" id="CVE-2026-33810" type="cve" title="CVE-2026-33810" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456335" id="2456335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19144" id="RLSA-2026:19144" type="self" title="RLSA-2026:19144" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19144" id="RHSA-2026:19144" type="vendor" title="Red Hat RHSA-2026:19144" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="7.el10_2" src="golang-github-openprinting-ipp-usb-0.9.27-7.el10_2.src.rpm">
          <filename>ipp-usb-0.9.27-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fedf4900b840a0fe252e4ec1a5fa009264f95326fb284e3f5f13ed496b29f91a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19133</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19133 (https://access.redhat.com/errata/RHSA-2026:19133), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19133" id="RLSA-2026:19133" type="self" title="RLSA-2026:19133" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19133" id="RHSA-2026:19133" type="vendor" title="Red Hat RHSA-2026:19133" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git-lfs" arch="x86_64" epoch="0" version="3.7.1" release="4.el10_2" src="git-lfs-3.7.1-4.el10_2.src.rpm">
          <filename>git-lfs-3.7.1-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">996bc245a9039a0e1a4422f64a95474cef33f9ee5e486520c671e3bf9f3b83fd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19159</id>
    <title>Critical: nginx security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19159 (https://access.redhat.com/errata/RHSA-2026:19159), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42945" id="CVE-2026-42945" type="cve" title="CVE-2026-42945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477116" id="2477116" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19159" id="RLSA-2026:19159" type="self" title="RLSA-2026:19159" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19159" id="RHSA-2026:19159" type="vendor" title="Red Hat RHSA-2026:19159" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nginx-mod-http-perl" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">e61a025936fb210bba05ffaf150de934b3e376398adbf0d30c0b8341bb5cbc27</sum>
        </package>
        <package name="nginx-mod-stream" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">225ad82b621813be01e575c8644accdd922f6055a7abe871f2fe786275811e65</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">d1518dceb4603016ead01c97ad7c608bb12b7ebffc536db748331623ef529601</sum>
        </package>
        <package name="nginx-mod-mail" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">ae016ca190fe5d93ef5b79ad16bebcd98f04e85d24dd4e02e621e0a5e3e31a0c</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">d63033225eb23863fc09ed95f2e44b83a81f485f5e7509adc268ea9c520aa5c0</sum>
        </package>
        <package name="nginx" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">61acb1f6f09d8cf88467c566ccc50750f73c5f868e2a96eacfd71b274ef38e6e</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">2d31fb6a91b7d7603688af003856a3e67a6399fb353ed08c1d368fef40f37a52</sum>
        </package>
        <package name="nginx-core" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">39055792f6e220d407fda486aa667fa3362ed6ff72d4b4c70376221739512290</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">9f55e111b0ab84ca6b9651a282d88c4ecaaa74197e0539f87d4e52786530abc1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19146</id>
    <title>Important: openexr security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19146 (https://access.redhat.com/errata/RHSA-2026:19146), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openexr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.

Security Fix(es):

* OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34588" id="CVE-2026-34588" type="cve" title="CVE-2026-34588" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455408" id="2455408" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19146" id="RLSA-2026:19146" type="self" title="RLSA-2026:19146" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19146" id="RHSA-2026:19146" type="vendor" title="Red Hat RHSA-2026:19146" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="openexr" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_2.2" src="openexr-3.1.10-8.el10_2.2.src.rpm">
          <filename>openexr-3.1.10-8.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">65fc211ea0672891acec068d7285bfa00a0616c52f23df31bb3a8a09ce5d0d5d</sum>
        </package>
        <package name="openexr-libs" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_2.2" src="openexr-3.1.10-8.el10_2.2.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">a10e2397406a7f1727667de6b72a25d2ba53265febfe6a96029118cc186836d7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19142</id>
    <title>Moderate: freerdp security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19142 (https://access.redhat.com/errata/RHSA-2026:19142), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)

* freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

* freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

* freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

* freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

* freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

* freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

* FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

* FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982)

* FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25952" id="CVE-2026-25952" type="cve" title="CVE-2026-25952" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25997" id="CVE-2026-25997" type="cve" title="CVE-2026-25997" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26986" id="CVE-2026-26986" type="cve" title="CVE-2026-26986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29775" id="CVE-2026-29775" type="cve" title="CVE-2026-29775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31883" id="CVE-2026-31883" type="cve" title="CVE-2026-31883" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31884" id="CVE-2026-31884" type="cve" title="CVE-2026-31884" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31885" id="CVE-2026-31885" type="cve" title="CVE-2026-31885" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33982" id="CVE-2026-33982" type="cve" title="CVE-2026-33982" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33985" id="CVE-2026-33985" type="cve" title="CVE-2026-33985" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33987" id="CVE-2026-33987" type="cve" title="CVE-2026-33987" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442782" id="2442782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442768" id="2442768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453226" id="2453226" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447383" id="2447383" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442764" id="2442764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453217" id="2453217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447386" id="2447386" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447385" id="2447385" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447379" id="2447379" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453218" id="2453218" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19142" id="RLSA-2026:19142" type="self" title="RLSA-2026:19142" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19142" id="RHSA-2026:19142" type="vendor" title="Red Hat RHSA-2026:19142" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.5" src="freerdp-3.10.3-12.el10_2.5.src.rpm">
          <filename>libwinpr-3.10.3-12.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">d59105eff976986b2e529971bd07eb02de49b59ebd34f9eefa198213e1aad97c</sum>
        </package>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.5" src="freerdp-3.10.3-12.el10_2.5.src.rpm">
          <filename>freerdp-3.10.3-12.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">39fd0af2add9db20f34ee4e1df2e5530515173dd0e99ea4b0d30bd6750fc9841</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.5" src="freerdp-3.10.3-12.el10_2.5.src.rpm">
          <filename>freerdp-libs-3.10.3-12.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">4958996b53a76f6c96b94a8c094fd00a3d81fc3dd438973151c90fd40b1a868b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19138</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19138 (https://access.redhat.com/errata/RHSA-2026:19138), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

* pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30922" id="CVE-2026-30922" type="cve" title="CVE-2026-30922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32597" id="CVE-2026-32597" type="cve" title="CVE-2026-32597" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448553" id="2448553" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447194" id="2447194" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19138" id="RLSA-2026:19138" type="self" title="RLSA-2026:19138" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19138" id="RHSA-2026:19138" type="vendor" title="Red Hat RHSA-2026:19138" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e313ae76fb6cca6044434a05c706606664e2d6c4f1de77db499fc7d76f490b04</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">eb71027624d94c6d4e9035a77cf79591a237785ac7c92e6a368eeb0fb84e50dd</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">eb417f3f391c9f5819c3c544fc829f18f2c9db5192f1709a49c0d259acef4d1c</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-sbd-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">cf8e151e7383dedfed17e855b7b3127c7a501f86c55a952bf476eb241793def7</sum>
        </package>
        <package name="fence-agents-common" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-common-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">6fddb7721133102847b29174ce2faed60f95653d4d86d74da02980e9c0bfd822</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">8dd59bb28a870bc7cf2538ba05b0218e009bd791cb8cfe8f99c12f0fb8fc659f</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-brocade-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">8e4fa97fe5d874c338208294d8fa1048ab001800de29771a3c2cabcccfa594ff</sum>
        </package>
        <package name="fence-virtd-tcp" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-virtd-tcp-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">f0a2fc48caf380d9958fc6749fbfb4f984fc0c466b42c79549e59055a59dcd8d</sum>
        </package>
        <package name="fence-agents-aliyun" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-aliyun-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">301421833879b1c5a2fd94bd0b95152017762d076ceaf2db7d8f812ee329ee7b</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-apc-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">f18807196e8d5904ea18f6fe1f18db55ca016ade12f9e391c08e8732d3fe6e97</sum>
        </package>
        <package name="fence-agents-azure-arm" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-azure-arm-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">5b8275ad18af32cb2882c6a71e36d5fcc6c69bb89053bf67069ab2ae5d68c65c</sum>
        </package>
        <package name="fence-agents-aws" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-aws-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">0903731299198a17cdcd523cac313d79d021996447c729352850a0afa7e9aed7</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">7248b363a84091368eb6305abce6f1c8e2e2e98aaa5e625d5a7dd2ac3af325fd</sum>
        </package>
        <package name="fence-virtd-cpg" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-virtd-cpg-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">c01da8fe524905acf42a2fde11a24e25b2f5b9550f5debcf177c253cde658d7a</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-drac5-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e6623dfaf57cddcfe844180fd57ebd8b47e62191adbd6ee2665541ee127dc77e</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6f1579857dae4eef545f855dabb98bb4a6d67f7267581daac3c580fd902a85e8</sum>
        </package>
        <package name="fence-virtd-libvirt" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-virtd-libvirt-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">581e7b02864b4ef0255dfc257523b0b415a9a5ead105c4ab2cecf58be1656fb2</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6b2026aebecd13fd7563ec67616f51d7452bd4443663172ddcc76d103b9a3c0d</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-virsh-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">087f1f81fcb50f1de534ff6308dfd11f67104ded8de1f847075163061b1c3cf4</sum>
        </package>
        <package name="fence-agents-all" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-all-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">49c73db06f12b51a5a9e6e630ef3d96272ec1d6caee8f3d8ac6ee77eeddc8723</sum>
        </package>
        <package name="fence-agents-kdump" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-kdump-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">c9b6e5603d98ba15bea9455c34886c2a31ee28df2fcb18f8c33b77b59db3fff3</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">93dd4f6c42a5163d0b0ab3e9c7f0efa3908bc448cada2cc2aa65553722425533</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">09803b5e0f4a072a8570b994fe778463d20191f9652abd3609662e21d564b448</sum>
        </package>
        <package name="ha-cloud-support" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>ha-cloud-support-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">380dc557159d2ff3be7eaea6e8dfe5fca55516fab41af4e94ba993dfab49f09f</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">97dade5d762a9a66c52c8b27296d4c72a656f3b1e4c6ca966a0de3277a17d27e</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-rsb-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6c40740e4b3302416d7331fdce5a2967412d6a8d72bae94501faed33b61f6245</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">0f0042a54c972ff0c5098925a8b21dc3ae863a569b2e640d83da14095a0eab86</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">7b09b8e17314d5e0f86ca83535057a0e66ec708e0f51fb4afe90d0467470096f</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">5d59b9a4a44d559842ae1e8603da2059c2c009a20074177a8bc9caa5a6d61ca0</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">97f7504c710ee2a7167a655bd952fd34ed4620a0d859b3d7fc0f057fc934a3ac</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-rsa-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">435b24d9fc09de1029567e5332592e7843d73ecc779c4401804769b304a57edf</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-emerson-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6a665963f998e86c6de70eb27f84f4e0df0eba68ef8274533172559c0c435b79</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">0405b53d9c8814aa1a7e4e2c10d7ffa723bff98f47bfbf22780b7e8bed8afd87</sum>
        </package>
        <package name="fence-agents-openstack" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-openstack-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">83b439c0cbd3c00b27bc8d4bf999ebb643eca0341e8fafd2a567ed100f8723cb</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">7290f1a1b3add3d5cd6d87bdc403e8124bff5f53384e4106e1f81c2b72427587</sum>
        </package>
        <package name="fence-virtd" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-virtd-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">d55f5c3b980ebebeff9063c59c7176cb396eddd9437b6f614515a728f6608077</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">85d369f63f858e394f14ac9ffd86ab7612bb11793c2738c6c10760dad380f3f8</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-eps-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">7f77d3f655424098372cde5f06c753389f79b3b49cadb8da10feb9a1380b80f5</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6c5aa019be07f43d9930f3175bfc84b0d9e6b47c00e037b74454decaa0b4e38f</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-scsi-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">5d4dee6a654eaca81c146a27aa22564a256570027f9f92cd4d8d4b8a4ee4382c</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">8aa2e8862cda55e507a8f04bafea483e8915fa857e68984a9c5e0ede6aba2653</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-wti-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">472ab4e4f241fefa16ed42e8502cbc3a84dbf71b20650dda2a29ef4cbb11808b</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">dfed46d93e17ce7bb3982962e3cf70117ed35da32ef02b3c35c8faa6449291c2</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">22b7b0b4d7da4260c8ccc3047be464f596ee83a02e9d6c610661c20401adaabe</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">7e891ac7bb4361a3c733157c9bacba0d4c5c26eae6346df10b017c3b4ebfaa2c</sum>
        </package>
        <package name="fence-agents-redfish" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-redfish-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">66d95336b4ca96a5a0c55e04464c37fe64ec3b7eaafa71e6411e3b0c8a44b229</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-lpar-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">74cc0b85b794d1dd22ad67291d073cfbb0bcebe1708fd6dbc1cd8a9f8de632da</sum>
        </package>
        <package name="fence-virtd-serial" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-virtd-serial-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">e51f008d32a7d9982084b4ee2a00aa562b9eb71e06a5678da59615c306be4acb</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-mpath-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6f23c4a2f8affb83ab9877768d5b75244949eee12184e209ed0d14e398e73853</sum>
        </package>
        <package name="fence-virtd-multicast" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-virtd-multicast-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">d18ed97eb3bd3c26072a93106761325f4fa95da5e4b0d88c7122b01b63335da5</sum>
        </package>
        <package name="fence-virt" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-virt-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">c077ecfd66fd5c8c2f1c4377ff5e5b73d89c5332b5f5c88b77b3931c7edfe5cd</sum>
        </package>
        <package name="fence-agents-nutanix-ahv" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-nutanix-ahv-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">2467d6ee4c601d1d7e5e02b3bdea56d95ec3c8ad414cbb58d7da81333502e9c1</sum>
        </package>
        <package name="fence-agents-gce" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-gce-4.16.0-21.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">5301b979dea215365574c75301b2ebb8fcdd1f88d57b7a578ced41dec3efe832</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">13707c8f341986d0ec1deabfdd9d7afc0a62152a547f15cd18de19b2772fb06e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19153</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19153 (https://access.redhat.com/errata/RHSA-2026:19153), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)

* firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)

* firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)

* firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7320" id="CVE-2026-7320" type="cve" title="CVE-2026-7320" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7321" id="CVE-2026-7321" type="cve" title="CVE-2026-7321" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7322" id="CVE-2026-7322" type="cve" title="CVE-2026-7322" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7323" id="CVE-2026-7323" type="cve" title="CVE-2026-7323" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463485" id="2463485" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463484" id="2463484" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463483" id="2463483" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463481" id="2463481" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19153" id="RLSA-2026:19153" type="self" title="RLSA-2026:19153" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19153" id="RHSA-2026:19153" type="vendor" title="Red Hat RHSA-2026:19153" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.10.1" release="1.el10_2" src="thunderbird-140.10.1-1.el10_2.src.rpm">
          <filename>thunderbird-140.10.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">77b583e52c5acdaac4224600bd89df34d6c0d9c6f41ed968e2b462500e689199</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19127</id>
    <title>Important: gdk-pixbuf2 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19127 (https://access.redhat.com/errata/RHSA-2026:19127), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gdk-pixbuf2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.

Security Fix(es):

* gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5201" id="CVE-2026-5201" type="cve" title="CVE-2026-5201" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453291" id="2453291" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19127" id="RLSA-2026:19127" type="self" title="RLSA-2026:19127" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19127" id="RHSA-2026:19127" type="vendor" title="Red Hat RHSA-2026:19127" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gdk-pixbuf2-modules" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">de5a7450e05a6ac80992886ef49a286abe72c5ac2df44a62b236faed2052c073</sum>
        </package>
        <package name="gdk-pixbuf2" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">0f10e2b54827459dc8d4d0c0a5b693c99f30fe993618d13fc9f6c1c49aa29204</sum>
        </package>
        <package name="gdk-pixbuf2-devel" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">ec62d18124f5b9275b7439732fc4088d82d0b7a90e38003089c482403315cdd2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19154</id>
    <title>Important: giflib security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19154 (https://access.redhat.com/errata/RHSA-2026:19154), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for giflib.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>giflib is a library for reading and writing gif images.

Security Fix(es):

* giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23868" id="CVE-2026-23868" type="cve" title="CVE-2026-23868" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446207" id="2446207" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19154" id="RLSA-2026:19154" type="self" title="RLSA-2026:19154" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19154" id="RHSA-2026:19154" type="vendor" title="Red Hat RHSA-2026:19154" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="giflib" arch="x86_64" epoch="0" version="5.2.1" release="24.el10_2" src="giflib-5.2.1-24.el10_2.src.rpm">
          <filename>giflib-5.2.1-24.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5cc587525933d1ff8e57e4c5816405822c43aa4155e47e52942258335a9f6952</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19150</id>
    <title>Important: libtiff security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19150 (https://access.redhat.com/errata/RHSA-2026:19150), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4775" id="CVE-2026-4775" type="cve" title="CVE-2026-4775" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450768" id="2450768" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19150" id="RLSA-2026:19150" type="self" title="RLSA-2026:19150" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19150" id="RHSA-2026:19150" type="vendor" title="Red Hat RHSA-2026:19150" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libtiff" arch="x86_64" epoch="0" version="4.6.0" release="8.el10_2.1" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-4.6.0-8.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">2ccff9b841055c6f490672689659214a25d13d49ac2c5c0410f0e1dae30fa33f</sum>
        </package>
        <package name="libtiff-devel" arch="x86_64" epoch="0" version="4.6.0" release="8.el10_2.1" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-devel-4.6.0-8.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">7dc1462de38a119ebc9146209c13255b908753acfc7fa2da978483ab4dd980d8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19560</id>
    <title>Important: libsndfile security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:19560 (https://access.redhat.com/errata/RHSA-2026:19560), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsndfile.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. 

Security Fix(es):

* libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-37555" id="CVE-2026-37555" type="cve" title="CVE-2026-37555" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463856" id="2463856" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19560" id="RLSA-2026:19560" type="self" title="RLSA-2026:19560" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:19560" id="RHSA-2026:19560" type="vendor" title="Red Hat RHSA-2026:19560" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsndfile-utils" arch="x86_64" epoch="0" version="1.2.2" release="6.el10_2.1" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-utils-1.2.2-6.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">5d030a6fe4fa55398dca208ac6118df5d9a5abadce90ce72017ada23a469d9c9</sum>
        </package>
        <package name="libsndfile" arch="x86_64" epoch="0" version="1.2.2" release="6.el10_2.1" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-1.2.2-6.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">cd16a2bd3a1fa2ec55df8f1e6b8fa75c84a9574bee122334ae22aef27f27c346</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18480</id>
    <title>Important: linux-sgx security update</title>
    <issued date="2026-05-29 16:03:45" />
    <updated date="2026-06-12 12:06:19" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:18480 (https://access.redhat.com/errata/RHSA-2026:18480), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for linux-sgx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.

Security Fix(es):

* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)

* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)

* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13465" id="CVE-2025-13465" type="cve" title="CVE-2025-13465" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15284" id="CVE-2025-15284" type="cve" title="CVE-2025-15284" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23745" id="CVE-2026-23745" type="cve" title="CVE-2026-23745" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23950" id="CVE-2026-23950" type="cve" title="CVE-2026-23950" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24842" id="CVE-2026-24842" type="cve" title="CVE-2026-24842" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430538" id="2430538" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431036" id="2431036" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433645" id="2433645" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431740" id="2431740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425946" id="2425946" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18480" id="RLSA-2026:18480" type="self" title="RLSA-2026:18480" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:18480" id="RHSA-2026:18480" type="vendor" title="Red Hat RHSA-2026:18480" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="sgx-pccs" arch="x86_64" epoch="0" version="2.26" release="7.el10" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-pccs-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">85b45db5b5a3bb56fc76ab0ee4c763c14edb925d79564ee03dcf77075a407570</sum>
        </package>
        <package name="sgx-pckid-tool" arch="x86_64" epoch="0" version="2.26" release="7.el10" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-pckid-tool-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">ef3658cfd280cef8f807d49d6431cbb7f8a3b046e815336840bf9a4d074e2861</sum>
        </package>
        <package name="sgx-mpa" arch="x86_64" epoch="0" version="2.26" release="7.el10" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-mpa-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">1042a39296285dfe3c318ff9abfa5e182a4a9a3f10f33f2caa76618478c4da33</sum>
        </package>
        <package name="sgx-pccs-admin" arch="x86_64" epoch="0" version="2.26" release="7.el10" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-pccs-admin-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">7b02ab838f1a8b523a014df9e4702fde7b9d320ef6f9f8ef65e11368e13b425f</sum>
        </package>
        <package name="tdx-qgs" arch="x86_64" epoch="0" version="2.26" release="7.el10" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>tdx-qgs-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">a17e1a6766f0b96d13469042d61cf4135891d3b6549983a34e5a2ea114cbde1b</sum>
        </package>
        <package name="sgx-common" arch="x86_64" epoch="0" version="2.26" release="7.el10" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-common-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">eedafbe670794ab3c8888e3e438fe7bda8757f587f25b6c24a32cce78b192007</sum>
        </package>
        <package name="sgx-libs" arch="x86_64" epoch="0" version="2.26" release="7.el10" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-libs-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">67a3e506e13c87cf8ffe28d3543583158236051629aef6900faae7fee4b5a8d8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:20693</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:20693 (https://access.redhat.com/errata/RHSA-2026:20693), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004)

* mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001)

* mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238)

* mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236)

* mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304)

* mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015)

* mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276)

* mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21998" id="CVE-2026-21998" type="cve" title="CVE-2026-21998" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22001" id="CVE-2026-22001" type="cve" title="CVE-2026-22001" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22002" id="CVE-2026-22002" type="cve" title="CVE-2026-22002" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22004" id="CVE-2026-22004" type="cve" title="CVE-2026-22004" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22005" id="CVE-2026-22005" type="cve" title="CVE-2026-22005" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22009" id="CVE-2026-22009" type="cve" title="CVE-2026-22009" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22015" id="CVE-2026-22015" type="cve" title="CVE-2026-22015" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22017" id="CVE-2026-22017" type="cve" title="CVE-2026-22017" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34270" id="CVE-2026-34270" type="cve" title="CVE-2026-34270" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34271" id="CVE-2026-34271" type="cve" title="CVE-2026-34271" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34276" id="CVE-2026-34276" type="cve" title="CVE-2026-34276" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34303" id="CVE-2026-34303" type="cve" title="CVE-2026-34303" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34304" id="CVE-2026-34304" type="cve" title="CVE-2026-34304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34308" id="CVE-2026-34308" type="cve" title="CVE-2026-34308" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35236" id="CVE-2026-35236" type="cve" title="CVE-2026-35236" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35237" id="CVE-2026-35237" type="cve" title="CVE-2026-35237" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35238" id="CVE-2026-35238" type="cve" title="CVE-2026-35238" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35239" id="CVE-2026-35239" type="cve" title="CVE-2026-35239" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35240" id="CVE-2026-35240" type="cve" title="CVE-2026-35240" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460348" id="2460348" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460275" id="2460275" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460326" id="2460326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460324" id="2460324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460325" id="2460325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460279" id="2460279" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460329" id="2460329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460316" id="2460316" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460274" id="2460274" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460358" id="2460358" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460312" id="2460312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460315" id="2460315" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460342" id="2460342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460276" id="2460276" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460323" id="2460323" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460295" id="2460295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460344" id="2460344" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460356" id="2460356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460335" id="2460335" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:20693" id="RLSA-2026:20693" type="self" title="RLSA-2026:20693" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:20693" id="RHSA-2026:20693" type="vendor" title="Red Hat RHSA-2026:20693" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.9" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.9-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-common-8.4.9-1.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">49a7cb60b8643ac1320705e9aaeb27ec457b20b459fd26e15a56a7ba8367cfa8</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.9" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.9-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.9-1.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">c81dc1ecc70ef153aa6533294a7cb062200cf6cac283deedcdb243c69fd63e6d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:21433</id>
    <title>Important: httpd security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:21433 (https://access.redhat.com/errata/RHSA-2026:21433), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)

* httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)

* httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)

* httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)

* Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28780" id="CVE-2026-28780" type="cve" title="CVE-2026-28780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33007" id="CVE-2026-33007" type="cve" title="CVE-2026-33007" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33857" id="CVE-2026-33857" type="cve" title="CVE-2026-33857" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34032" id="CVE-2026-34032" type="cve" title="CVE-2026-34032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34059" id="CVE-2026-34059" type="cve" title="CVE-2026-34059" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464940" id="2464940" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464953" id="2464953" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466913" id="2466913" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464952" id="2464952" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2465299" id="2465299" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:21433" id="RLSA-2026:21433" type="self" title="RLSA-2026:21433" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:21433" id="RHSA-2026:21433" type="vendor" title="Red Hat RHSA-2026:21433" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_lua" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_lua-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">97460698e8fdebcdce363964de07c3a41ec74acf0582437c4ba3d76e7c8199f1</sum>
        </package>
        <package name="httpd-core" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-core-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">6591788f13efd62d4780bcb5ae916bf24088958cbcbb2697182af1dffa14812b</sum>
        </package>
        <package name="mod_ssl" arch="x86_64" epoch="1" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_ssl-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">12069f2a90bf7a26ff535bc9f4b1665dffd6d1e05c8a1678fbbeb6af91cf9864</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">12f3d622e66025e8b1f93324994cf9d6f15b9ef297208d7299b58c2c25d70d84</sum>
        </package>
        <package name="httpd-tools" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-tools-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">3296c4ecc6fcadd7b014cdb6c2ee69ffe8a29524bd2aa25cceaa3fd1c685cc4f</sum>
        </package>
        <package name="httpd" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">698b5be10ab17db8061c755e2a146626b5794dff1cf838f53f4aae3496305b86</sum>
        </package>
        <package name="mod_proxy_html" arch="x86_64" epoch="1" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_proxy_html-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">d90675d6c16b6878485bbde0be9a78c6207f06c042ab58e315b8cb87d92d1a7c</sum>
        </package>
        <package name="mod_session" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_session-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">3c02c531402760505c6e279b02effe8704841e55c9f651d66edd40fbe80a694f</sum>
        </package>
        <package name="mod_ldap" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_ldap-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">e037178bc3e47340e72cfc4b919e5b735ada6dfbadc1bae1827c26856ea2ef57</sum>
        </package>
        <package name="httpd-devel" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-devel-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">5418f52c3fc086e8d661d836ed28956d8d120502e987cbffe7ad191e7175437a</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">720cb79416a3b763521c882b2e5c36923f8e9d8a05fbf06354abaa376556ba4a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:21754</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:21754 (https://access.redhat.com/errata/RHSA-2026:21754), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es):

* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476605" id="2476605" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:21754" id="RLSA-2026:21754" type="self" title="RLSA-2026:21754" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:21754" id="RHSA-2026:21754" type="vendor" title="Red Hat RHSA-2026:21754" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2f730ae740cc3a004d9197d06f0005ae3f3663986a144270153fae7ffa777ecf</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8a22e1cd5203222e34c36e0b926d46ae98fed7c0873d03611eff58a3a1f84e80</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">79a0f4949a37c438ce59446f8eae329e97d5ee14b875fbf80d11e11cb92da67b</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a0ab21285ae4e1f5e83df875aa45e13937d6ab94fb4583301f129e35c1f6d088</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">637c58093f8fd3c7e4a7eae6edb0fd46c9b7ca8fb6d3df56ba6c2a002c14b6f0</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">66a800d559bcf112df773795b919f222e6cae22ec4d8f2783ae7291f979f332a</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8ba17e66f26f6790f387827f42d4bd68ef310592799592bb101619d0e63d2e3a</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">08afea8cf5d3d227f2828b6586c3e2f1166944e84d7741a521372149ce8c9869</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1ca87551a13dcb1e6e2b018e07ab208a21bed4c3f46bfc2e6b96f3daaa52d717</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">71f4c5b1dda6c858e071dd59103bae0fd3ade23901254395c188bebffc13a933</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1f95e4403f5364b7cd4aed92e529d9927aac9df89905ed0598086bcd6270561f</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d9425ff0644590e579efb93efe8756c2d291f992739ce24d0a0938d770b1077d</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3fd8931a02d3db14951bfc7e98b93104e649e56c7366e7b06ba69b0248093cd1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:21757</id>
    <title>Important: flatpak security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:21757 (https://access.redhat.com/errata/RHSA-2026:21757), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for flatpak.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

* flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)

* flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34078" id="CVE-2026-34078" type="cve" title="CVE-2026-34078" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34079" id="CVE-2026-34079" type="cve" title="CVE-2026-34079" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456284" id="2456284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456276" id="2456276" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:21757" id="RLSA-2026:21757" type="self" title="RLSA-2026:21757" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:21757" id="RHSA-2026:21757" type="vendor" title="Red Hat RHSA-2026:21757" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="flatpak" arch="x86_64" epoch="0" version="1.16.0" release="9.el10_2.1" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-1.16.0-9.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">398e79615ba2de8dd59e7449a3884ad7e780c42a92fb11c757ef83697b8a5d70</sum>
        </package>
        <package name="flatpak-session-helper" arch="x86_64" epoch="0" version="1.16.0" release="9.el10_2.1" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-session-helper-1.16.0-9.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">03ea8f5a21b47df3f3c49a5bcde80ef0b7de824f46774377010f8b4dc2045b78</sum>
        </package>
        <package name="flatpak-selinux" arch="noarch" epoch="0" version="1.16.0" release="9.el10_2.1" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">8e8051ccca5bc1ed0f8e0434a9279d799f68b5537c3c0a924f91bac9f4b1896e</sum>
        </package>
        <package name="flatpak-libs" arch="x86_64" epoch="0" version="1.16.0" release="9.el10_2.1" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-libs-1.16.0-9.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">490da8ad2e24cda603e87423891614e3ae0b0b51928886136b575bdcaeb3027d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22141</id>
    <title>Moderate: go-fdo-client and go-fdo-server security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:22141 (https://access.redhat.com/errata/RHSA-2026:22141), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for go-fdo-server, go-fdo-client.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.

Security Fix(es):

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22141" id="RLSA-2026:22141" type="self" title="RLSA-2026:22141" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:22141" id="RHSA-2026:22141" type="vendor" title="Red Hat RHSA-2026:22141" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-fdo-server-manufacturer" arch="noarch" epoch="0" version="1.0.1" release="2.el10_2" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">5ccda77fae009861babf98ed74294b8b0972a70e6e0137b7cbfcbe98a9a33d71</sum>
        </package>
        <package name="go-fdo-client" arch="x86_64" epoch="0" version="1.0.0" release="4.el10_2" src="go-fdo-client-1.0.0-4.el10_2.src.rpm">
          <filename>go-fdo-client-1.0.0-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5f9734c8593a2eef5ab71cdedaca86effd5b112072b90d7412e41403b252b61c</sum>
        </package>
        <package name="go-fdo-server-rendezvous" arch="noarch" epoch="0" version="1.0.1" release="2.el10_2" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">0de29160e7a14baffc3b6c08b83ec8bdc85d745f0739374ea66ae9cff5630789</sum>
        </package>
        <package name="go-fdo-server-owner" arch="noarch" epoch="0" version="1.0.1" release="2.el10_2" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">5a79bbadc989598ed366bad7891eaac725b61f2de54f5892714727c3b480f6c0</sum>
        </package>
        <package name="go-fdo-server" arch="x86_64" epoch="0" version="1.0.1" release="2.el10_2" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-1.0.1-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">333b2e7be8b61ec8fd8a51b11075895867d1e341380ec6618e7a5742ca883217</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22145</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:22145 (https://access.redhat.com/errata/RHSA-2026:22145), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es):

* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476605" id="2476605" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22145" id="RLSA-2026:22145" type="self" title="RLSA-2026:22145" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:22145" id="RHSA-2026:22145" type="vendor" title="Red Hat RHSA-2026:22145" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-sdk-dbg-10.0" arch="x86_64" epoch="0" version="10.0.108" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.108-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">facc4944a4a693c4a577f69ab97a536df1b750091725f5496daed000a9f77f35</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="x86_64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0e7af7dcabe09cac0fe3709de1aaf2ed21a348192c3a16b8f56e8fae37f68cbf</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="x86_64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">438618b52418991ce91bdca743698bda68c353e0609306fe33ef18519250c47a</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="x86_64" epoch="0" version="10.0.108" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.108-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f2c92e92e45c2832eab4fbb63316093042abe57151a976cef7b1dde47bea66d2</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="x86_64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a57cb0b4151d3bf3f03a0cbe6ce36bcb086e92cf9124248a691b239af8c162d4</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">aa53f386dd4163c556ca5ce4db3edce111f191fa432a0775c99ef9245cad49e2</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="x86_64" epoch="0" version="10.0.108" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.108-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">35fa9192a410c440c72375b89e898f201d8844bb9f901eca67ff3c841c055bf3</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7fe9fca26c08fd034a55fa00b73792b5a1d38fffc101aa572205dcf0414e9836</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9829e7da71aed9d64d525c64c6e2e48507fec035c056585e5d996cb5f9a0c8ba</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="x86_64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9c7877512c538152d13ec95ed9a2b4c0fdde6a0649cd3c0876a9916dc87f5728</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">aa53c036a0bdf5e83bbd7643b73aaf8784e335d358ff178cba35b141bb51fd86</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="x86_64" epoch="0" version="10.0.108" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.108-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">891ea022ddb383307f2921231716d256d24e3f35a38394a9bc7a580123dfa47e</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8a110d50f229c673f89d9ace72d2c7e39110223a17521e3d148eac16943ead84</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22325</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:22325 (https://access.redhat.com/errata/RHSA-2026:22325), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)

* firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)

* firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)

* firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)

* firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975)

* firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)

* firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968)

* firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)

* firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958)

* firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)

* firefox: Privilege escalation in the Security component (CVE-2026-8970)

* firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)

* firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)

* firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)

* firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959)

* firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)

* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)

* firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8388" id="CVE-2026-8388" type="cve" title="CVE-2026-8388" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8391" id="CVE-2026-8391" type="cve" title="CVE-2026-8391" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8401" id="CVE-2026-8401" type="cve" title="CVE-2026-8401" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8946" id="CVE-2026-8946" type="cve" title="CVE-2026-8946" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8947" id="CVE-2026-8947" type="cve" title="CVE-2026-8947" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8950" id="CVE-2026-8950" type="cve" title="CVE-2026-8950" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8953" id="CVE-2026-8953" type="cve" title="CVE-2026-8953" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8954" id="CVE-2026-8954" type="cve" title="CVE-2026-8954" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8955" id="CVE-2026-8955" type="cve" title="CVE-2026-8955" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8956" id="CVE-2026-8956" type="cve" title="CVE-2026-8956" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8957" id="CVE-2026-8957" type="cve" title="CVE-2026-8957" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8958" id="CVE-2026-8958" type="cve" title="CVE-2026-8958" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8959" id="CVE-2026-8959" type="cve" title="CVE-2026-8959" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8961" id="CVE-2026-8961" type="cve" title="CVE-2026-8961" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8962" id="CVE-2026-8962" type="cve" title="CVE-2026-8962" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8968" id="CVE-2026-8968" type="cve" title="CVE-2026-8968" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8970" id="CVE-2026-8970" type="cve" title="CVE-2026-8970" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8974" id="CVE-2026-8974" type="cve" title="CVE-2026-8974" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8975" id="CVE-2026-8975" type="cve" title="CVE-2026-8975" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479873" id="2479873" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479876" id="2479876" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479842" id="2479842" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476469" id="2476469" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479846" id="2479846" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479871" id="2479871" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479853" id="2479853" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479839" id="2479839" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476475" id="2476475" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479855" id="2479855" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479860" id="2479860" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479852" id="2479852" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479880" id="2479880" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479849" id="2479849" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479861" id="2479861" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479847" id="2479847" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479848" id="2479848" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479840" id="2479840" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476492" id="2476492" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22325" id="RLSA-2026:22325" type="self" title="RLSA-2026:22325" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:22325" id="RHSA-2026:22325" type="vendor" title="Red Hat RHSA-2026:22325" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.11.0" release="1.el10_2" src="thunderbird-140.11.0-1.el10_2.src.rpm">
          <filename>thunderbird-140.11.0-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4d0b712ce67476e5bdb9b7c503245e9e4c3df7d7745ae0d417ecc5a774865d80</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22450</id>
    <title>Important: osbuild-composer security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:22450 (https://access.redhat.com/errata/RHSA-2026:22450), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for osbuild-composer.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32286" id="CVE-2026-32286" type="cve" title="CVE-2026-32286" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186" id="CVE-2026-33186" type="cve" title="CVE-2026-33186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4427" id="CVE-2026-4427" type="cve" title="CVE-2026-4427" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449833" id="2449833" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455470" id="2455470" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445345" id="2445345" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451847" id="2451847" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22450" id="RLSA-2026:22450" type="self" title="RLSA-2026:22450" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:22450" id="RHSA-2026:22450" type="vendor" title="Red Hat RHSA-2026:22450" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="osbuild-composer-worker" arch="x86_64" epoch="0" version="165.1" release="2.el10_2.rocky.0.1" src="osbuild-composer-165.1-2.el10_2.rocky.0.1.src.rpm">
          <filename>osbuild-composer-worker-165.1-2.el10_2.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">e29b255ccf0e7dd57c1e1478d5a7ae0c64e61df3f4a6c4fbb2878836a0cc9459</sum>
        </package>
        <package name="osbuild-composer-core" arch="x86_64" epoch="0" version="165.1" release="2.el10_2.rocky.0.1" src="osbuild-composer-165.1-2.el10_2.rocky.0.1.src.rpm">
          <filename>osbuild-composer-core-165.1-2.el10_2.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">f46606a679cc7982eb2b5bc4b82383913eb20c689a50d52b9ab535cd179af8f0</sum>
        </package>
        <package name="osbuild-composer" arch="x86_64" epoch="0" version="165.1" release="2.el10_2.rocky.0.1" src="osbuild-composer-165.1-2.el10_2.rocky.0.1.src.rpm">
          <filename>osbuild-composer-165.1-2.el10_2.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">e8e05925be17848735e36526f8bd0a9495106364c72579dd10a8e8b10735a64f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22649</id>
    <title>Important: php8.4 security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:22649 (https://access.redhat.com/errata/RHSA-2026:22649), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

* PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)

* PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

* php: NULL pointer dereference in SOAP apache:Map decoder with missing &lt;value&gt; (CVE-2026-7262)

* php: signed integer overflow in metaphone() (CVE-2026-7568)

* php: denial of service via DOMNode::C14N() (CVE-2026-7263)

* php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6104" id="CVE-2026-6104" type="cve" title="CVE-2026-6104" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6735" id="CVE-2026-6735" type="cve" title="CVE-2026-6735" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7258" id="CVE-2026-7258" type="cve" title="CVE-2026-7258" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7262" id="CVE-2026-7262" type="cve" title="CVE-2026-7262" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7263" id="CVE-2026-7263" type="cve" title="CVE-2026-7263" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7568" id="CVE-2026-7568" type="cve" title="CVE-2026-7568" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468561" id="2468561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468566" id="2468566" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468562" id="2468562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468573" id="2468573" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468572" id="2468572" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468565" id="2468565" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22649" id="RLSA-2026:22649" type="self" title="RLSA-2026:22649" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:22649" id="RHSA-2026:22649" type="vendor" title="Red Hat RHSA-2026:22649" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="php8.4-soap" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-soap-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">93921d8614552c4aab6a67d3e79e686c55cd3ada1f52047508bb66cd2f3b0eef</sum>
        </package>
        <package name="php8.4-devel" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-devel-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">77ee9a22b0e300c998a7399d5baccbeb05a73561247f62eb472e3fd8aca30438</sum>
        </package>
        <package name="php8.4-dba" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-dba-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4586d5c7e498f0c9fe92683df777a8f96aaef211b20bf92eeb58310640e24b70</sum>
        </package>
        <package name="php8.4-mysqlnd" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-mysqlnd-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ef32627b10d626026321ebb184fd5d5cab25644cad25589f6c4e9c6c1396bd2e</sum>
        </package>
        <package name="php8.4-opcache" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-opcache-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">519d936dc10901e32208013bbe3cfbd98f344f1f815090b9c9263f71d74b7437</sum>
        </package>
        <package name="php8.4" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">30cd08698b7c9324aad76fae254f45182a7f825fe538e049a4f5cd3f14867a23</sum>
        </package>
        <package name="php8.4-ffi" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-ffi-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9f9a4d2ddc6cf627ba6237c718f6472ebf1388e2d9aafe638d0a38dd2edb12ed</sum>
        </package>
        <package name="php8.4-gd" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-gd-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fd83015a397293b69f833b3e09ca07c7d6e985ca9cf51b6fe56fad3e897045f7</sum>
        </package>
        <package name="php8.4-embedded" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-embedded-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7cee0649381e2a1187a53d2fe85e2245d6c5906716e45d5cb76981db1a04f03f</sum>
        </package>
        <package name="php8.4-process" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-process-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5f3635f396d32d13ea776621ee9c1057207cf580ae690480f40f19292d983db9</sum>
        </package>
        <package name="php8.4-mbstring" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-mbstring-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2eaccbe2df3f8753ceaf743f64cb9b4ec9b2fd6b45ada8b99284095a25b13525</sum>
        </package>
        <package name="php8.4-pdo" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-pdo-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9c9da69b972584b317b8d4802ed4c4e6b9e5c184d7eefd7d651e5572433d5bf8</sum>
        </package>
        <package name="php8.4-xml" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-xml-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a1234c3aa805bbcc028067d6173c9d43843bbe1f94eb322232dac1d8583e99fa</sum>
        </package>
        <package name="php8.4-fpm" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-fpm-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">41d528ec9cb7103e65795b1d38c6ad474a669de21d292f9931942b55e6bc006f</sum>
        </package>
        <package name="php8.4-pgsql" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-pgsql-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0fc78b6687ff5166c38cbea38b20eb28e471ed5168fbf1238218e886a959bdd1</sum>
        </package>
        <package name="php8.4-bcmath" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-bcmath-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">dcaa303c18c72fda32c3a7f5e905b9f86cf32ce5365ae7765a5bb3c59bda7165</sum>
        </package>
        <package name="php8.4-ldap" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-ldap-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">eb221a2d4944325b2774df99e7c8083c2121d5aad5a209216819b9f546030443</sum>
        </package>
        <package name="php8.4-odbc" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-odbc-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4dbb16f20d28b4255c9f95e17007783b5318a92a1dccc6f9a309ce74aa83b3da</sum>
        </package>
        <package name="php8.4-intl" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-intl-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">75313c3a056170add90d234f373def3232daa1c69ee36db6199786e407596b96</sum>
        </package>
        <package name="php8.4-enchant" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-enchant-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">550f205fa20de981f997f4667c05986a8ff489435523d6944b08aa256716139b</sum>
        </package>
        <package name="php8.4-cli" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-cli-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4e6890d42729db0625c98c10873449506863c12d7213888246620298362e44ce</sum>
        </package>
        <package name="php8.4-snmp" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-snmp-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8b7c9579a9a2ec8925493a0f19c414b434b402dca6b95260a88843309e07bb46</sum>
        </package>
        <package name="php8.4-common" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-common-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8cf7b8dc8f90d0607cbaf36d0608b403b516a26370523ff065a3a74ad5621135</sum>
        </package>
        <package name="php8.4-dbg" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-dbg-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bbf8f2d2b713f9cd6b4d97319632e6069b2120534fb92c9aff54fdf642f8f435</sum>
        </package>
        <package name="php8.4-gmp" arch="x86_64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-gmp-8.4.21-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c99a3e85aa569bae20827833794ca39d4e12f4b0003f8417a2d68040b04d8339</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22528</id>
    <title>Moderate: mod_http2 security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:22528 (https://access.redhat.com/errata/RHSA-2026:22528), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_http2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53020" id="CVE-2025-53020" type="cve" title="CVE-2025-53020" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379343" id="2379343" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22528" id="RLSA-2026:22528" type="self" title="RLSA-2026:22528" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:22528" id="RHSA-2026:22528" type="vendor" title="Red Hat RHSA-2026:22528" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_http2" arch="x86_64" epoch="0" version="2.0.29" release="4.el10_2" src="mod_http2-2.0.29-4.el10_2.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b0727d4ce54449b9e87689c8f06022f4bc8aa793b56bb537c4c6713bf47c4d2d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22529</id>
    <title>Moderate: libexif security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:22529 (https://access.redhat.com/errata/RHSA-2026:22529), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libexif.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libexif packages provide a library for extracting extra information from image files.

Security Fix(es):

* libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40386" id="CVE-2026-40386" type="cve" title="CVE-2026-40386" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457689" id="2457689" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22529" id="RLSA-2026:22529" type="self" title="RLSA-2026:22529" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:22529" id="RHSA-2026:22529" type="vendor" title="Red Hat RHSA-2026:22529" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libexif" arch="x86_64" epoch="0" version="0.6.24" release="9.el10_2.1" src="libexif-0.6.24-9.el10_2.1.src.rpm">
          <filename>libexif-0.6.24-9.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">e1fd08d6c0cf0d8678dfc596acef2781e8317c5ee2573b79e72aef1b847143cb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22937</id>
    <title>Important: image-builder security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:22937 (https://access.redhat.com/errata/RHSA-2026:22937), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186" id="CVE-2026-33186" type="cve" title="CVE-2026-33186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449833" id="2449833" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455470" id="2455470" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445345" id="2445345" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22937" id="RLSA-2026:22937" type="self" title="RLSA-2026:22937" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:22937" id="RHSA-2026:22937" type="vendor" title="Red Hat RHSA-2026:22937" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="image-builder" arch="x86_64" epoch="0" version="52.1" release="1.el10_2.rocky.0.1" src="image-builder-52.1-1.el10_2.rocky.0.1.src.rpm">
          <filename>image-builder-52.1-1.el10_2.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">1fb72d9a5931e59c5de5def3cd2dfb20b95c293ecbe4f957746e2b4aca37e5de</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:23102</id>
    <title>Important: delve security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:23102 (https://access.redhat.com/errata/RHSA-2026:23102), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:23102" id="RLSA-2026:23102" type="self" title="RLSA-2026:23102" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:23102" id="RHSA-2026:23102" type="vendor" title="Red Hat RHSA-2026:23102" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.26.1" release="2.el10_2" src="delve-1.26.1-2.el10_2.src.rpm">
          <filename>delve-1.26.1-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">54706ab5ac0593d190bed5e4eb8347931626ce097714eda07b81a31b6dcd4e13</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:23231</id>
    <title>Important: unbound security update</title>
    <issued date="2026-06-06 12:04:50" />
    <updated date="2026-06-20 12:05:47" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:23231 (https://access.redhat.com/errata/RHSA-2026:23231), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)

* unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959)

* unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33278" id="CVE-2026-33278" type="cve" title="CVE-2026-33278" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42944" id="CVE-2026-42944" type="cve" title="CVE-2026-42944" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42959" id="CVE-2026-42959" type="cve" title="CVE-2026-42959" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479808" id="2479808" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479806" id="2479806" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479774" id="2479774" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:23231" id="RLSA-2026:23231" type="self" title="RLSA-2026:23231" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:23231" id="RHSA-2026:23231" type="vendor" title="Red Hat RHSA-2026:23231" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="unbound-anchor" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">b24bf1115ac08d039bc3ece7e678f60ccb8a34832b24f55949f4e45ac4b47c03</sum>
        </package>
        <package name="unbound-dracut" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">6ba378cb70ebb8b41b2f82b3ee778cd59fd4362aa2c2036257a3d5cf75dea2d7</sum>
        </package>
        <package name="unbound" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">b0829bf92becbaa8bc55a66b6ba2d4350ffc8f7bf5dfa7dafa4bbde44965faa7</sum>
        </package>
        <package name="python3-unbound" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">56d8372c8adb89f75b8e26824fa82784fad601dedfca0fa390340f71f4f44a6d</sum>
        </package>
        <package name="unbound-utils" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">146ac82f762b1dd556a5d189d9bcfcbd54063eecc93a4fbee711bfc1c4af7837</sum>
        </package>
        <package name="unbound-libs" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">a8eeba8af6546360654ded3ab72d00e9f7498b8e102201c74ed967ebc350f76c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:23388</id>
    <title>Important: php security update</title>
    <issued date="2026-06-06 12:04:50" />
    <updated date="2026-06-20 12:05:47" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:23388 (https://access.redhat.com/errata/RHSA-2026:23388), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)

* PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

* php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

* php: NULL pointer dereference in SOAP apache:Map decoder with missing &lt;value&gt; (CVE-2026-7262)

* php: signed integer overflow in metaphone() (CVE-2026-7568)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6735" id="CVE-2026-6735" type="cve" title="CVE-2026-6735" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7258" id="CVE-2026-7258" type="cve" title="CVE-2026-7258" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7259" id="CVE-2026-7259" type="cve" title="CVE-2026-7259" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7262" id="CVE-2026-7262" type="cve" title="CVE-2026-7262" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7568" id="CVE-2026-7568" type="cve" title="CVE-2026-7568" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468564" id="2468564" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468561" id="2468561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468566" id="2468566" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468562" id="2468562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468565" id="2468565" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:23388" id="RLSA-2026:23388" type="self" title="RLSA-2026:23388" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:23388" id="RHSA-2026:23388" type="vendor" title="Red Hat RHSA-2026:23388" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="php-process" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-process-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7fcb22ca9d7c051e710337c8415d54dec1d621f2d1c9905dfa64a65c27c2f80e</sum>
        </package>
        <package name="php-opcache" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-opcache-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">88912549bf78999c7f66a3c471180bed655c73e62107d17839af2477a00d5d85</sum>
        </package>
        <package name="php-pgsql" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-pgsql-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6f7ec3af69ef58dca3953da04bf54f3273264bcd4a03596b15c3ac6c6425acb7</sum>
        </package>
        <package name="php-gmp" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-gmp-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c7093fdfdcbe93b857d3a470c43b2e649c9a1529b932c5923ada683873f12b22</sum>
        </package>
        <package name="php-ffi" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-ffi-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1ee84f0371aaa21828ee292adcd97a13834f1116f60c264e1902814b5818f578</sum>
        </package>
        <package name="php-intl" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-intl-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cdb6b6e382729a3bc937d67b35e95f5d12eebaa799ed7d8032a7659b6981be80</sum>
        </package>
        <package name="php-cli" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-cli-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">39a3f0ca9e6079d08dddfbf3e78e9d897fe179cde5321af26edc25607d2d9d39</sum>
        </package>
        <package name="php-mysqlnd" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-mysqlnd-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c91fd3cb6a6da135364fa8e6c91c2f07343b5b94a2c3f1b8d0f32940ac65eee7</sum>
        </package>
        <package name="php-embedded" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-embedded-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">679162acc9b7a85b4ed2fd30b8209cc3aa3f732d199ff1c4274c8dcb48503944</sum>
        </package>
        <package name="php-ldap" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-ldap-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6019567bc9cf49c52125e362c38093a71d0ce6f6763ace6aa77c6803bfd425de</sum>
        </package>
        <package name="php-mbstring" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-mbstring-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">81f5c5cf62d498b460745fc5d084c4ca3f83ab40639cf79b03381b5c2146c9a4</sum>
        </package>
        <package name="php-soap" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-soap-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0043c540adbd9e70a8a4e4b7195387f0b0eec8bea8938bc6a33f418b059fe4e0</sum>
        </package>
        <package name="php-enchant" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-enchant-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">db1357544c0d4f61b84648d503aea4e326ed95ddacfbb650e6d46416f4a9bdda</sum>
        </package>
        <package name="php-snmp" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-snmp-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b1f2c2d36ab1b7613eeb73456cc4728d08aa3b158f2c0fc5bc5508ff432578a0</sum>
        </package>
        <package name="php-pdo" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-pdo-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2680fdb64254e006f8521bf63bdd2e058fc6413f02a22d03ad1ea176b7518a3c</sum>
        </package>
        <package name="php-dba" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-dba-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">dd46c5d782a039e6f7a9ba0a4bfd1f9ff4a48aaed4d6869166996502784b5e64</sum>
        </package>
        <package name="php-xml" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-xml-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">308ca26682103f7036508b03edd8fd0419039745d86b430726a64644ce6c6965</sum>
        </package>
        <package name="php-gd" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-gd-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fd7cc5f1adf3d6ed23bf16fae243aaa2aa44a7a19c67f50dd314938725cc2620</sum>
        </package>
        <package name="php" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2eda1a3be2ab2e7abafe99983c3fe394ca3510f9574f94df824e02c4303b03ca</sum>
        </package>
        <package name="php-fpm" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-fpm-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a06d5c3f8500eed555ae30e27f7f3e771d972ae381d2c64b0ecd8ae00bd72906</sum>
        </package>
        <package name="php-bcmath" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-bcmath-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7d313db382c65e44cee5adf82d72122c41f53166b58b10c0f17e0d2529dc77cb</sum>
        </package>
        <package name="php-dbg" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-dbg-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1e625cbf2d27d1fea41190ef3d482fa686731a24aca74f3f9cb462e8ec3366cd</sum>
        </package>
        <package name="php-common" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-common-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6dea5d0c48e4e61164b33e0e6aa30efc0fee67595498207dc49f70e02f90194e</sum>
        </package>
        <package name="php-devel" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-devel-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f3b2b0d4abc6fe96fb1ce72e58f54d82409c8465f5f0ec0250f3d32dfa54299e</sum>
        </package>
        <package name="php-odbc" arch="x86_64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-odbc-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">95835e1e3a3c59545482701ced5280fd5ef3d849bf3da7886f2873b122248b64</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24331</id>
    <title>Important: cockpit-image-builder security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:24331 (https://access.redhat.com/errata/RHSA-2026:24331), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for cockpit-image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.

Security Fix(es):

* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

* lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13465" id="CVE-2025-13465" type="cve" title="CVE-2025-13465" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4800" id="CVE-2026-4800" type="cve" title="CVE-2026-4800" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453496" id="2453496" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431740" id="2431740" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24331" id="RLSA-2026:24331" type="self" title="RLSA-2026:24331" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:24331" id="RHSA-2026:24331" type="vendor" title="Red Hat RHSA-2026:24331" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="cockpit-image-builder" arch="noarch" epoch="0" version="94.3" release="1.el10_2" src="cockpit-image-builder-94.3-1.el10_2.src.rpm">
          <filename>cockpit-image-builder-94.3-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">86763aada9ca1c83e778b94f0cce0ae1fa27943d9b665aee57ba4b6e4bc6cc2b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24348</id>
    <title>Important: postgresql-jdbc security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:24348 (https://access.redhat.com/errata/RHSA-2026:24348), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql-jdbc.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

* jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42198" id="CVE-2026-42198" type="cve" title="CVE-2026-42198" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463857" id="2463857" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24348" id="RLSA-2026:24348" type="self" title="RLSA-2026:24348" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:24348" id="RHSA-2026:24348" type="vendor" title="Red Hat RHSA-2026:24348" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postgresql-jdbc" arch="noarch" epoch="0" version="42.7.2" release="1.el10_2.2" src="postgresql-jdbc-42.7.2-1.el10_2.2.src.rpm">
          <filename>postgresql-jdbc-42.7.2-1.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">af4e552d6254c3a538384d48748435e2125ec3f92721df5c02774d08ef68520c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24338</id>
    <title>Important: bind security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:24338 (https://access.redhat.com/errata/RHSA-2026:24338), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for bind.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3039" id="CVE-2026-3039" type="cve" title="CVE-2026-3039" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5946" id="CVE-2026-5946" type="cve" title="CVE-2026-5946" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479767" id="2479767" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479771" id="2479771" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24338" id="RLSA-2026:24338" type="self" title="RLSA-2026:24338" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:24338" id="RHSA-2026:24338" type="vendor" title="Red Hat RHSA-2026:24338" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="bind-chroot" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-chroot-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">328d8eebaeed1af3a1f36eb6ed88cbc59cc469d00c392a0d43e310b22eb1a4e6</sum>
        </package>
        <package name="bind-libs" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-libs-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">0a1ab103e538d7e2d6f433990e4792d9621fbb5f8cdd44ee2093a15cff26de54</sum>
        </package>
        <package name="bind-utils" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-utils-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">fd5f29b7054557bebe26e21eadaa6139925f5997158b8b82f012ca2d4d1f7bf3</sum>
        </package>
        <package name="bind-license" arch="noarch" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-license-9.18.33-15.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">fed371a3681da536e0778643a4b6d9543a2ca15b218fa97d11c331074e4f2c1a</sum>
        </package>
        <package name="bind" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">b2ba776552b028fe17b4a0fa1b5d76351bfe35b45ab5ce10bd400554c58cc63b</sum>
        </package>
        <package name="bind-dnssec-utils" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">f0daa7244f777c746a6b26cbacaa0cfb565256c473312be826bb87ffda712943</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24347</id>
    <title>Important: frr security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:24347 (https://access.redhat.com/errata/RHSA-2026:24347), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for frr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. 

Security Fix(es):

* frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

* frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-37457" id="CVE-2026-37457" type="cve" title="CVE-2026-37457" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-37459" id="CVE-2026-37459" type="cve" title="CVE-2026-37459" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466513" id="2466513" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464548" id="2464548" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24347" id="RLSA-2026:24347" type="self" title="RLSA-2026:24347" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:24347" id="RHSA-2026:24347" type="vendor" title="Red Hat RHSA-2026:24347" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="frr" arch="x86_64" epoch="0" version="10.4.4" release="1.el10_2" src="frr-10.4.4-1.el10_2.src.rpm">
          <filename>frr-10.4.4-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e351cc9cbea19f59779d0b866d6155a788f3ab82496a88f7f8a1943cc97932b2</sum>
        </package>
        <package name="frr-selinux" arch="noarch" epoch="0" version="10.4.4" release="1.el10_2" src="frr-10.4.4-1.el10_2.src.rpm">
          <filename>frr-selinux-10.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b787323105ab7c24a5a87d996c9103f26f4321085d417a7035849de80a23ece2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24470</id>
    <title>Important: podman security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:24470 (https://access.redhat.com/errata/RHSA-2026:24470), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24470" id="RLSA-2026:24470" type="self" title="RLSA-2026:24470" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:24470" id="RHSA-2026:24470" type="vendor" title="Red Hat RHSA-2026:24470" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.8.2" release="3.el10_2" src="podman-5.8.2-3.el10_2.src.rpm">
          <filename>podman-docker-5.8.2-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">f56c07b3706ad63e75cce22ab620bf56342117cfd3903bc90bf5a52d06a6bc30</sum>
        </package>
        <package name="podman" arch="x86_64" epoch="7" version="5.8.2" release="3.el10_2" src="podman-5.8.2-3.el10_2.src.rpm">
          <filename>podman-5.8.2-3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">75af02bf9dcb925c5d9ef0b342f0fca71255734f918d27dabc97cca0aa4613f8</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.8.2" release="3.el10_2" src="podman-5.8.2-3.el10_2.src.rpm">
          <filename>podman-remote-5.8.2-3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4f59d3bc8a06fe327c62635cf92c366df1e2db7b2e90ab31e36735c38aa4c5ec</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24716</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:24716 (https://access.redhat.com/errata/RHSA-2026:24716), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24716" id="RLSA-2026:24716" type="self" title="RLSA-2026:24716" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:24716" id="RHSA-2026:24716" type="vendor" title="Red Hat RHSA-2026:24716" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.9" release="5.el10_2" src="yggdrasil-0.4.9-5.el10_2.src.rpm">
          <filename>yggdrasil-0.4.9-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6165e39b81d80c19662b858200004021332ea0b1dde141fb8148b96156eafccb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24758</id>
    <title>Important: libyang security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:24758 (https://access.redhat.com/errata/RHSA-2026:24758), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libyang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libyang is YANG data modeling language parser and toolkit written (and providing API) in C.

Security Fix(es):

* libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44673" id="CVE-2026-44673" type="cve" title="CVE-2026-44673" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477617" id="2477617" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24758" id="RLSA-2026:24758" type="self" title="RLSA-2026:24758" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:24758" id="RHSA-2026:24758" type="vendor" title="Red Hat RHSA-2026:24758" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libyang" arch="x86_64" epoch="0" version="2.1.148" release="4.el10_2" src="libyang-2.1.148-4.el10_2.src.rpm">
          <filename>libyang-2.1.148-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e73a0d5d8cf81b73fc044bcd9d6abaceb7da006847163bcebe6097736b6e7d8a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24985</id>
    <title>Important: poppler security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:24985 (https://access.redhat.com/errata/RHSA-2026:24985), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for poppler.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Security Fix(es):

* poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10118" id="CVE-2026-10118" type="cve" title="CVE-2026-10118" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460428" id="2460428" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24985" id="RLSA-2026:24985" type="self" title="RLSA-2026:24985" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:24985" id="RHSA-2026:24985" type="vendor" title="Red Hat RHSA-2026:24985" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="poppler-glib" arch="x86_64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-glib-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">749c3f10011c21ef5284f6871b08e02942d50ba4a4512bd889748a5ce052fd6c</sum>
        </package>
        <package name="poppler-cpp" arch="x86_64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-cpp-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">97f95ec76e09efcb1e2d8948a0a81609fbbbeeaf43b49bc9328decaf2f7cbac6</sum>
        </package>
        <package name="poppler-qt6" arch="x86_64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-qt6-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">460c99f9fe2e99400293667ab7dd6232fd96e8de2b1caea2fbe96ca745947ed8</sum>
        </package>
        <package name="poppler" arch="x86_64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">98f30de9463fc9a162437484bbdf43d39f039adb23d0b6a7208b8877cebafb76</sum>
        </package>
        <package name="poppler-utils" arch="x86_64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-utils-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">e478203a8c3ff721d9fbcd0577912622363fff484a023ddcb22f8e71f5280fe4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25111</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:25111 (https://access.redhat.com/errata/RHSA-2026:25111), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

* dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487164" id="2487164" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487224" id="2487224" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25111" id="RLSA-2026:25111" type="self" title="RLSA-2026:25111" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:25111" id="RHSA-2026:25111" type="vendor" title="Red Hat RHSA-2026:25111" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">71fe933773b589602a30da89698b83f54189142fe38c50d1723ad49f835a03c3</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.128" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.128-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c4ea3e55e836169e6f4edd17910250809121894ab409bed9aede476802907255</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e29eddc7964029e9083241c676957af027748d5bb58885ddb0492d343080fdab</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5bbf174823638d204bf62b17ee2700e61ccfa3e3b1ffb07efe5c6c5e98332ff1</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">97a5c0642c68dc48390a2ccfb1eda8af71849836c8073a92ae4218094ddc741b</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.128" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.128-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cc433461b423c543a92f4740b92d2ad1b1b8f1781dbe57f778b539cdc9286a25</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.128" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.128-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a8e63d6a9544b5f553d55f642ff169e6af5b20a7f25ac4acf8074abe09b4cf17</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4c8ea0a2221d3d93ef9658d83b8c519d27d1b32145089740d47738462375cdc8</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a393ea26e5958c92ccdf1591407bd94e45ca7a562676ca4a94f8832f84a54bf7</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1ecbcb6ce7a8236d83cde1f29946fdf353a5cb9612cb99711dddbcb7c529297f</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">939fc6ed5ac9512d7d0b5182dce3af472c83b4fd9be3c2495ef63d7e4e5007ae</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25112</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:25112 (https://access.redhat.com/errata/RHSA-2026:25112), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

* dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487164" id="2487164" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487224" id="2487224" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25112" id="RLSA-2026:25112" type="self" title="RLSA-2026:25112" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:25112" id="RHSA-2026:25112" type="vendor" title="Red Hat RHSA-2026:25112" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8a21e8a1e2e478b07f228b683f8a46bc7d4ba393706dcf6d9f228e54e5082d84</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fcfb3de07a870dcda649093a48ce024db23b73eb73656a9cf2b3e4ae581914ed</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0a8432481d3504b1bde0359ff48a7bf84b27f4102c90ba3e4992e5d7ee0dd9bf</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e0d209f8874774c8f36a566198cac79176bf6c6a91443ae1574cbed92095512a</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">78e130d90125d4c3ae15386b78ce152a3b9c0a924ef1f26bd73f16339dfaf662</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e4c54fbb3a79ca39092d1b5fdc26800e4981abcb2485e85a5a7646ae9d73776c</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">38f664d1e4c382bbfaa2c237d3a54e230fcd7a0702eccf765cabc7634f69acc5</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f2634c6cc441fc11d863dd2a4a6fed096b5cfa4475d4f9c1632478f24dde0293</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">83ac05c2d861cccae48b1ba32bf16782ddcfce58af7a084266888164ca974164</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0f181e5497194d29234c6f31a6b5702b91e5e300b1292ff6a4f31facbb276c3a</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8b1f3044855d59c9a9b7dd777884eefcf92947c02b9a14753265a0fdb8a306c4</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">23d7ccf7f4cbf5fc335cc9d4fd005d6424983e6b4d4bed3b28eb170cbc2f50aa</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ac27d7fb27f22d72da1b0d582b0de68be2b308826efc0c041442f4c2c920a6e9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25115</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:25115 (https://access.redhat.com/errata/RHSA-2026:25115), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

* dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487164" id="2487164" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487224" id="2487224" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25115" id="RLSA-2026:25115" type="self" title="RLSA-2026:25115" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:25115" id="RHSA-2026:25115" type="vendor" title="Red Hat RHSA-2026:25115" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-sdk-10.0" arch="x86_64" epoch="0" version="10.0.109" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.109-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c1f241fad5de5597af18b089f6feb9502fbd78421b83340968787c48f0833b8e</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="x86_64" epoch="0" version="10.0.109" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.109-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5c9c1f795b2638112d78c521609815537e1b17f8afda5dcc7b59392f95abb576</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d0aa2bb27e52be0641aa4af95714ec70e35b6bd81d468378a17b15821edc54fd</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="x86_64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fc2b9bbe8d5f624e578adbf55e4bbcaa125761d330c6269717e0dec3c445ec94</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">23a45ae6fd90f744eac6232bf6bcd18ea9ad62b0ec456d32c7846cebeabddccd</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="x86_64" epoch="0" version="10.0.109" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.109-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">88688451f68fd5cea8b410032d0f8ab8584bcf4b45a5d5f660ee42a0a057091a</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">36d74044bc25f1270be8fd2b00c1ea140efad68062d1fa9b30d20b5265c70225</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="x86_64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a57442386e8bd0491a0005801833be3ed5cf33657c240392dd6199d85765135b</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="x86_64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5a327c21e94372e79d46ad727eed29152ce3b13b61950cdd5be61431b63ac790</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8f9404fc09cf2085e349801ca22e23e44a71b4928b6dffbe57a8ae9511654d9e</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">610ae59f3874149d415d4e78bd33d7611ea50d1fd788194a2750a33ec93aab13</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" arch="x86_64" epoch="0" version="10.0.109" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.109-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">003cb560eaa9c9fe9055ac9127889dc02db226ebf65a77361f99b1e30345e605</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="x86_64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8c002c07ec725bcd1860d0580522f14ee95c01ef6170c5737f203f903610ddf0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25216</id>
    <title>Important: valkey security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:25216 (https://access.redhat.com/errata/RHSA-2026:25216), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)

* redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)

* redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23479" id="CVE-2026-23479" type="cve" title="CVE-2026-23479" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23631" id="CVE-2026-23631" type="cve" title="CVE-2026-23631" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25243" id="CVE-2026-25243" type="cve" title="CVE-2026-25243" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466828" id="2466828" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466788" id="2466788" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466780" id="2466780" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25216" id="RLSA-2026:25216" type="self" title="RLSA-2026:25216" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:25216" id="RHSA-2026:25216" type="vendor" title="Red Hat RHSA-2026:25216" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.9" release="1.el10_2" src="valkey-8.0.9-1.el10_2.src.rpm">
          <filename>valkey-8.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d0e23c5df88f042deb8fe63fc38d82343339ce4734944d387b9463a35c257e69</sum>
        </package>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.9" release="1.el10_2" src="valkey-8.0.9-1.el10_2.src.rpm">
          <filename>valkey-devel-8.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">42c2d07754eeac5f8ddd8d74c8ba1599fd02685dea8960ff6aac78f529053235</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25225</id>
    <title>Important: mod_http2 security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:25225 (https://access.redhat.com/errata/RHSA-2026:25225), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mod_http2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49975" id="CVE-2026-49975" type="cve" title="CVE-2026-49975" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485371" id="2485371" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25225" id="RLSA-2026:25225" type="self" title="RLSA-2026:25225" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:25225" id="RHSA-2026:25225" type="vendor" title="Red Hat RHSA-2026:25225" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_http2" arch="x86_64" epoch="0" version="2.0.29" release="4.el10_2.1" src="mod_http2-2.0.29-4.el10_2.1.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">34dd467b7ecbf0270f6a730f9dd8b76c8b994eeac7540d26fb6f4af126b0576e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25902</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-06-16 12:04:59" />
    <updated date="2026-06-30 12:06:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:25902 (https://access.redhat.com/errata/RHSA-2026:25902), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48526" id="CVE-2026-48526" type="cve" title="CVE-2026-48526" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2482734" id="2482734" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25902" id="RLSA-2026:25902" type="self" title="RLSA-2026:25902" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:25902" id="RHSA-2026:25902" type="vendor" title="Red Hat RHSA-2026:25902" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-mpath-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">96f9b2808b4760790a08847f2d155df84e343eba0c23b7f30e0c5a5aaaef7812</sum>
        </package>
        <package name="fence-agents-gce" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-gce-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">5c7a49ab56290d2cbf2ce8882c6d10dcf4374da479dde28507db54cc70c2cc11</sum>
        </package>
        <package name="ha-cloud-support" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>ha-cloud-support-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">b1f0c73add7979b6d0bf2b1806ac2359b59c9228962e5e5207afe4db5264c04b</sum>
        </package>
        <package name="fence-virtd-cpg" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-cpg-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">32613d016fed968b116896051045ca2eec7f121d980239fb61eaa68da52f06d5</sum>
        </package>
        <package name="fence-agents-nutanix-ahv" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-nutanix-ahv-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">0f83a2b48daf607f9ae0a98244e082a4326304570575b2dd4a295ef6e12ad3f4</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-virsh-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">befa344470325ca7f137105af90beab96c1750caafbf11dba82eab4ce58f8a44</sum>
        </package>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">b0d5a890be78eb8b4f6810a9b24e7e272fc78f8a9d5907ef7366aa838879422f</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-lpar-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3a7d74165230f672d9c30b4ad5660ed2208619b7be122ded1b3fe00d31eef084</sum>
        </package>
        <package name="fence-agents-aws" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-aws-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">ed1db40d4d896c6f30e70e97065aefc760e10b0da28d1692d63bebfe805be997</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">90166bf1834f577fa8084ffbc36b178df7fca43562b1b66a009eb106b7a2d580</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3601e643dc546a384f3fe041da330d5a0a54191af5d7bea51881e578f2c55e24</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">397a7c742aafd02b74abdfc2c2060801722fcb0bae789428680d01c82c72033c</sum>
        </package>
        <package name="fence-agents-common" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-common-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">f6b01bc96ac15d953a59a8381afea814a9fcade39c33b43e725a85d4a49e66d3</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-brocade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">39f0479ac0e928033d5dbc2eca282d249e08b362247b4a928e91ecdf852f21c9</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">4df4cbbf79926440db1efec7cb11b57c4e63c02f4d371bc4babb219ae6b27297</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">08a768531d320b46fe7824096bfd9a98b255bf71d6abb9ecb52fd77e72ad5e76</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">dbd04405803d021d3e60fcec2f4178d36eb02641ea256627a4e7b94363d3f210</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">650c8554bd516b004d54879cfc798768219732e816eb47465757ccfd13189747</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-apc-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">42e7496f98820e0a66d492a28be45b616d29c1909c52417e9f11cd5c9bc23067</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-scsi-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">fe2f6e28bdfb367287a4a91b0d956100d8ff4124cd56aed94dcf149d47af5011</sum>
        </package>
        <package name="fence-agents-all" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-all-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">91e41f746e4ff92f5b7f6318be7570feecc1b32dbbb9244a9a11a02c16347ce0</sum>
        </package>
        <package name="fence-virtd-libvirt" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-libvirt-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">6453c5a7e94929f63d13ccd3b238b98ff2f118a56393c5e0050c9af4926dc2c7</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">7280a79ab531d3bf1d907246bcfbbea84c19979bb8c25d0a06263bf88e6da99c</sum>
        </package>
        <package name="fence-agents-azure-arm" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-azure-arm-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">b563f6eed2b9dede5aac86384cc13314ed4a41fdd9a7805c29614ff065f4154c</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">7fde0ae738b52e154be0dbc0e8a0312c4d1fdd6c04be23f824f330ae366115d2</sum>
        </package>
        <package name="fence-virtd-serial" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-serial-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">8ad4626da1afbaf7554136203b861221f302c21f18c666a95a3c6100064a6c58</sum>
        </package>
        <package name="fence-agents-redfish" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-redfish-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">eea784bbfb97a7fb2fb8fcf9af2dd86fbfde673423eba449049c3254e2933e85</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rsa-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">df9ad371fd8f15e87b4b643e99d6475e00bbeb92aea69bad5b29d75ea3e39883</sum>
        </package>
        <package name="fence-agents-aliyun" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-aliyun-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">7df37624ff5e649c8ba745e5dc1ae2c07416add9b0c56501ea2b9680f02e1d7c</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">b4594a24614a58065a1e66e5551f3ab8e44483ddd38a4930a00b99e976444b2f</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">5cabf3e5fd13f792fa90931aacaed7815f8af215def824ce8489c7b290950346</sum>
        </package>
        <package name="fence-virt" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virt-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">060e9574ba8e7fdb2790a28d907b9ea23e79af4f5e6364c49b7e1d6333f67f85</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-eps-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">ec40d40ccd7f96facd18c9ab3b0c405f608b3532eb170e0be7bf7ef93ffcb65b</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-sbd-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d8652b7c8757c69601c9bc91ac33e822d425aefc22cea2c4cca0e60652650523</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">ce7ecc02ad1cebebad855d3ead182d11f7c5b52122e4b33355d13b5138168434</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-emerson-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3faf24842c258c8e308549157712d21e1f03cc04c96d11f412ab2adc27d21720</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-drac5-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">4d3eb3ce101fa985f24b37cf3e2c4205d6ac8ceb67a2e1223a029f052f11a64c</sum>
        </package>
        <package name="fence-virtd-tcp" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-tcp-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">4f08e119d6d69b56cfc56fbc8655447d8998ea2afd0aeed7e3662dc55dc495ce</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-wti-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">32665580179857637d1e19142389549af5a6dc17e6eb9e5a86681085d40fe21b</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">5e19ee27e91a51d6393d86248c78df1128061c8366c8a22791653b9ea5976313</sum>
        </package>
        <package name="fence-agents-openstack" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-openstack-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">2192d7129643deead7f6c0465078544150e02b4b4f9d391aed14a76440f53256</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">90b61f4b4425d2b96a9c0e47fd39536c86318cb9f4e757bec383966a867e0f31</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">6461f8ea3e4fa542446901f04688ded33d95b056a82fda36a35135cf54783eb2</sum>
        </package>
        <package name="fence-virtd-multicast" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-multicast-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">3ad8c022111b65e641966e12a3e6e30259bf04c0bca9a807acccd75a6e6fed6a</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">4f44d7f5137dd8912b12fd3948465f9b1427a4cedc6e5565e125a38fbc066477</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3e56a0b2beb70886d5d5dcdc01a59d314ca81f71bad6ba8892dcf7c6db254abc</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">9f5b7e37d1a66a11f43dcb2002a0b5fdcae06aa5c24385fd4193f96b5005c7a8</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">ac6c086f9d9631aaf77e904c57ebfeef17dad8e9c7c6db089e4d8f85de67e462</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">9fe456f72e690050b8acd2ce9d792a0589a36847221a5e14129946a3c5c91b6d</sum>
        </package>
        <package name="fence-virtd" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-virtd-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">3bbcb03a14a42f84ac979ce866dde7adc5e56d477b46cb98e681b5abc38c86b4</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">99044ef89ae2b6b7bda1f94aa005074c63a00494b8534716ef9772c2c06e4df0</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rsb-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">b18b6d6fcb015c929d5ea263729eb13ec3651da16c486eaa42a0b8770a5ccc75</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">866aa56aa02a41eb21a9ad02831745b0fc69f6baa56c35bb737ace02cf9748e4</sum>
        </package>
        <package name="fence-agents-kdump" arch="x86_64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-kdump-4.16.0-21.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">e95c8e774c2627582a6d8e5a397ac6f7a5c6ff3729de95fbef95a6ab7a04760e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25930</id>
    <title>Important: postfix security update</title>
    <issued date="2026-06-19 06:04:41" />
    <updated date="2026-07-03 06:06:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:25930 (https://access.redhat.com/errata/RHSA-2026:25930), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postfix.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS.

Security Fix(es):

* postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43964" id="CVE-2026-43964" type="cve" title="CVE-2026-43964" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466488" id="2466488" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25930" id="RLSA-2026:25930" type="self" title="RLSA-2026:25930" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:25930" id="RHSA-2026:25930" type="vendor" title="Red Hat RHSA-2026:25930" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postfix-mysql" arch="x86_64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-mysql-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">db3a6c25973d98f133966b62232d8f11d2c5715bef56ffc08223bd76f4622f39</sum>
        </package>
        <package name="postfix" arch="x86_64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c2d34f3322417d94e882e379c1ba0610fc5d4f960917c9e76ce63121f7889251</sum>
        </package>
        <package name="postfix-perl-scripts" arch="x86_64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-perl-scripts-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cbbf9c5db6509399acbccdc5fbfe5195ad7f1b36b0d1b4bdd4c70e556aff5cb8</sum>
        </package>
        <package name="postfix-pgsql" arch="x86_64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-pgsql-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b0205dcceee52f156d7ef7a093251daef17042f6b506f3703aa3292d6c31f8b3</sum>
        </package>
        <package name="postfix-pcre" arch="x86_64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-pcre-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">80c9e0d181abab66adb33156aa86f025c0cf6eafcc22e9c0a0c0021248abe64e</sum>
        </package>
        <package name="postfix-cdb" arch="x86_64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-cdb-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">68269d181a5ba37656d0f9fe3296bc07a681d459f825e4d4e09975bfcade5d58</sum>
        </package>
        <package name="postfix-lmdb" arch="x86_64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-lmdb-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a8a71421fb681b7b4848e8a466bf7741ed87a36b7f741d8e54ed92c8e0de7162</sum>
        </package>
        <package name="postfix-sqlite" arch="x86_64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-sqlite-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">68731fabf498453df44dd119d705d0eab18092118f630cd194073a53742dc5e4</sum>
        </package>
        <package name="postfix-ldap" arch="x86_64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-ldap-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">860c87428fd8d76c3aae3ab387652bc6efb5bc8212c939fe9b58dc7cddd0c8b7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25999</id>
    <title>Moderate: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-06-19 06:04:41" />
    <updated date="2026-07-03 06:06:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:25999 (https://access.redhat.com/errata/RHSA-2026:25999), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25999" id="RLSA-2026:25999" type="self" title="RLSA-2026:25999" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:25999" id="RHSA-2026:25999" type="vendor" title="Red Hat RHSA-2026:25999" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="x86_64" epoch="0" version="0.2.3" release="7.el10_2" src="yggdrasil-worker-package-manager-0.2.3-7.el10_2.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">91df426faf6541ab9f1c15436fb861128063ec9b646cb1a5ec80d5f559a36831</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:26228</id>
    <title>Important: hplip security update</title>
    <issued date="2026-06-19 06:04:41" />
    <updated date="2026-07-03 06:06:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:26228 (https://access.redhat.com/errata/RHSA-2026:26228), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for hplip.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

* HPLIP: HPLIP: Privilege escalation and arbitrary code execution via operating system command injection (CVE-2026-8632)

* HPLIP: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups (CVE-2026-8631)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8631" id="CVE-2026-8631" type="cve" title="CVE-2026-8631" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8632" id="CVE-2026-8632" type="cve" title="CVE-2026-8632" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480300" id="2480300" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480297" id="2480297" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:26228" id="RLSA-2026:26228" type="self" title="RLSA-2026:26228" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:26228" id="RHSA-2026:26228" type="vendor" title="Red Hat RHSA-2026:26228" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsane-hpaio" arch="x86_64" epoch="0" version="3.23.12" release="10.el10_2.4" src="hplip-3.23.12-10.el10_2.4.src.rpm">
          <filename>libsane-hpaio-3.23.12-10.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">f85ccde8b035d16f889ba37adc02dbabf5f6eab4f5d06e3e844e6d85d4b15518</sum>
        </package>
        <package name="hplip" arch="x86_64" epoch="0" version="3.23.12" release="10.el10_2.4" src="hplip-3.23.12-10.el10_2.4.src.rpm">
          <filename>hplip-3.23.12-10.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">90573ca1db3c307fdf6ac8efaab04c044a367b9b24335c6e74b887bf133ce2c2</sum>
        </package>
        <package name="hplip-common" arch="x86_64" epoch="0" version="3.23.12" release="10.el10_2.4" src="hplip-3.23.12-10.el10_2.4.src.rpm">
          <filename>hplip-common-3.23.12-10.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">4c9ad283279b6caea7ac469ad8bed5f6e267c8c317b61e8fc4e17d0389b54534</sum>
        </package>
        <package name="hplip-libs" arch="x86_64" epoch="0" version="3.23.12" release="10.el10_2.4" src="hplip-3.23.12-10.el10_2.4.src.rpm">
          <filename>hplip-libs-3.23.12-10.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">e056222e9a859236cbb8e78c1d9fdc65196813b63cfd52ea27f78cc34fab77d1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:26456</id>
    <title>Important: 389-ds-base security, bug fix, and enhancement update</title>
    <issued date="2026-06-19 06:04:41" />
    <updated date="2026-07-03 06:06:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:26456 (https://access.redhat.com/errata/RHSA-2026:26456), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for 389-ds-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)

Bug Fix(es) and Enhancement(s):

* DS 12 does not handle escape char in bind user [rhel-10.2.z] (JIRA:Rocky Linux-170271)

* dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] (JIRA:Rocky Linux-170276)

* Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] (JIRA:Rocky Linux-170281)

* access log - suspicious wtime  optime negative and large values in internal op [rhel-10.2.z] (JIRA:Rocky Linux-170363)

* An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] (JIRA:Rocky Linux-170478)

* dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] (JIRA:Rocky Linux-170481)

* Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] (JIRA:Rocky Linux-170515)

* [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] (JIRA:Rocky Linux-174526)

* Online export is failing when using the option "-s" [rhel-10.2.z] (JIRA:Rocky Linux-180718)

* Server shutdown during online reindex may lead to data loss [rhel-10.2.z] (JIRA:Rocky Linux-183897)

* Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] (JIRA:Rocky Linux-183898)

* Replication errors in logs [rhel-10.2.z] (JIRA:Rocky Linux-183899)

* Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] (JIRA:Rocky Linux-183900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9064" id="CVE-2026-9064" type="cve" title="CVE-2026-9064" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480093" id="2480093" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:26456" id="RLSA-2026:26456" type="self" title="RLSA-2026:26456" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:26456" id="RHSA-2026:26456" type="vendor" title="Red Hat RHSA-2026:26456" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="389-ds-base-snmp" arch="x86_64" epoch="0" version="3.2.0" release="7.el10_2" src="389-ds-base-3.2.0-7.el10_2.src.rpm">
          <filename>389-ds-base-snmp-3.2.0-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a64f29a93900771f5bd5255b1eb88d05b473cd1a224b5112dc80ca1e90591269</sum>
        </package>
        <package name="389-ds-base" arch="x86_64" epoch="0" version="3.2.0" release="7.el10_2" src="389-ds-base-3.2.0-7.el10_2.src.rpm">
          <filename>389-ds-base-3.2.0-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">66533147903787429b99b719cff142699fb56a96466c8c9897468b708c5bde5f</sum>
        </package>
        <package name="python3-lib389" arch="noarch" epoch="0" version="3.2.0" release="7.el10_2" src="389-ds-base-3.2.0-7.el10_2.src.rpm">
          <filename>python3-lib389-3.2.0-7.el10_2.noarch.rpm</filename>
          <sum type="sha256">38e619ce2126d28966d16ad2c0a64dc3aff8d52f9462bd2c2df42d2ce990f83d</sum>
        </package>
        <package name="389-ds-base-libs" arch="x86_64" epoch="0" version="3.2.0" release="7.el10_2" src="389-ds-base-3.2.0-7.el10_2.src.rpm">
          <filename>389-ds-base-libs-3.2.0-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">44d416617f154c57f0118facf706c6e4117db4ed695cff3cbb047d86120049ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:28582</id>
    <title>Moderate: keylime security update</title>
    <issued date="2026-06-25 12:05:27" />
    <updated date="2026-07-09 12:06:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:28582 (https://access.redhat.com/errata/RHSA-2026:28582), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for keylime.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

* keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6420" id="CVE-2026-6420" type="cve" title="CVE-2026-6420" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458889" id="2458889" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:28582" id="RLSA-2026:28582" type="self" title="RLSA-2026:28582" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:28582" id="RHSA-2026:28582" type="vendor" title="Red Hat RHSA-2026:28582" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="keylime-tools" arch="x86_64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-tools-7.14.1-5.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">72282938edf1a997b088d37fd1a264039235c88ba0c205cd75f4c65d935344aa</sum>
        </package>
        <package name="keylime" arch="x86_64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-7.14.1-5.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">770e0e62fe6b6701e6aa473c0445f2427a97516f7a122d71bdaefe5fa6fcc6aa</sum>
        </package>
        <package name="keylime-base" arch="x86_64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-base-7.14.1-5.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">2e77eb9265ce6cb83f0bd733ac9879211c8811b554feda1a028ee55e2c8bdd5e</sum>
        </package>
        <package name="keylime-verifier" arch="x86_64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-verifier-7.14.1-5.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">fd391929af33b6b9536bc3ebcacb05a5511e8d0d2256a6bb08c6008ad0ec1768</sum>
        </package>
        <package name="python3-keylime" arch="x86_64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>python3-keylime-7.14.1-5.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">6ca1ecb0de3aee6f4395482562ed2e32c87d1453e344a77570a14c720288cc64</sum>
        </package>
        <package name="keylime-registrar" arch="x86_64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-registrar-7.14.1-5.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">32febe2f1fdb7916bf4c25dbb5b434fc47b2e85b9a15d5926b02a39cdc54c912</sum>
        </package>
        <package name="keylime-tenant" arch="x86_64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-tenant-7.14.1-5.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">c1fd6da74c26b4fdebcf8df352cdf53b5123fccbf8ea60ece8744e576f96c9b4</sum>
        </package>
        <package name="keylime-selinux" arch="noarch" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-selinux-7.14.1-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">dcd20951fcfa048f3adf49d51eea2041e6fce414a3e3d27632e42bce0af96f4a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:28584</id>
    <title>Moderate: libxslt security update</title>
    <issued date="2026-06-25 12:05:27" />
    <updated date="2026-07-09 12:06:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:28584 (https://access.redhat.com/errata/RHSA-2026:28584), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libxslt.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. 

Security Fix(es):

* libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10911" id="CVE-2025-10911" type="cve" title="CVE-2025-10911" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2397838" id="2397838" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:28584" id="RLSA-2026:28584" type="self" title="RLSA-2026:28584" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:28584" id="RHSA-2026:28584" type="vendor" title="Red Hat RHSA-2026:28584" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libxslt" arch="x86_64" epoch="0" version="1.1.39" release="8.el10_2.1" src="libxslt-1.1.39-8.el10_2.1.src.rpm">
          <filename>libxslt-1.1.39-8.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">9f067ff7bd1ac912dd885c2c6c1cb593c78fcbece3650354b0ca771f04ff5cb4</sum>
        </package>
        <package name="libxslt-devel" arch="x86_64" epoch="0" version="1.1.39" release="8.el10_2.1" src="libxslt-1.1.39-8.el10_2.1.src.rpm">
          <filename>libxslt-devel-1.1.39-8.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">5c045f374534fc374585273f837c0cb6f03f656aa2519e4652f644cec2508a73</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:29035</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-06-25 12:05:27" />
    <updated date="2026-07-09 12:06:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:29035 (https://access.redhat.com/errata/RHSA-2026:29035), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:29035" id="RLSA-2026:29035" type="self" title="RLSA-2026:29035" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:29035" id="RHSA-2026:29035" type="vendor" title="Red Hat RHSA-2026:29035" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.22.2" release="2.el10_2" src="skopeo-1.22.2-2.el10_2.src.rpm">
          <filename>skopeo-tests-1.22.2-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fe57b05a0d94963eb87c89f34c978b15aba47f4bf4dbec645b0c80be30472218</sum>
        </package>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.22.2" release="2.el10_2" src="skopeo-1.22.2-2.el10_2.src.rpm">
          <filename>skopeo-1.22.2-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">449a3c1e3eb76c0d64f4d6174fba194a614f42e90f1be4a445c0065015317905</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:29874</id>
    <title>Important: nginx security update</title>
    <issued date="2026-06-26 12:05:00" />
    <updated date="2026-07-10 12:07:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:29874 (https://access.redhat.com/errata/RHSA-2026:29874), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9256" id="CVE-2026-9256" type="cve" title="CVE-2026-9256" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480746" id="2480746" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:29874" id="RLSA-2026:29874" type="self" title="RLSA-2026:29874" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:29874" id="RHSA-2026:29874" type="vendor" title="Red Hat RHSA-2026:29874" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">257aae33a8348286b69ea9a26aa46bb49f0d0383a076f12501ef8656cbd82a41</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">090df6e6f4aac19bd460cf4f6803ace6aa68d0bc23d481f3cf8761e462f29aca</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:29980</id>
    <title>Moderate: golang security, bug fix, and enhancement update</title>
    <issued date="2026-06-26 12:05:00" />
    <updated date="2026-07-10 12:07:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:29980 (https://access.redhat.com/errata/RHSA-2026:29980), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)

Bug Fix(es) and Enhancement(s):

* Update Go to version 1.26.4+1 [rhel-10.2.z] (JIRA:Rocky Linux-183347)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42507" id="CVE-2026-42507" type="cve" title="CVE-2026-42507" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484205" id="2484205" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:29980" id="RLSA-2026:29980" type="self" title="RLSA-2026:29980" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:29980" id="RHSA-2026:29980" type="vendor" title="Red Hat RHSA-2026:29980" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-misc-1.26.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">5d408d5055e58997f7813b82104cc826daf5b1e3ac7e46d0dd58c4e13b6aa41c</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-docs-1.26.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">6cfeb977b32a146facd7a47b0b6167099e6683169d11d8749b0c868d8b1fb406</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-tests-1.26.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">a8847313447ef5a94ea6f8a08caf0d330e0ddd4a3157f4f98c72728b30face69</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-src-1.26.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">c6c199afd97140748f0c99c1ad6f048f5fa41f602f09ee7c5487cfd1c6cc6466</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:28581</id>
    <title>Important: python3.14 security, bug fix, and enhancement update</title>
    <issued date="2026-06-27 06:04:25" />
    <updated date="2026-07-11 06:04:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:28581 (https://access.redhat.com/errata/RHSA-2026:28581), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python3.14.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

* python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

* [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:Rocky Linux-176147)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6019" id="CVE-2026-6019" type="cve" title="CVE-2026-6019" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460869" id="2460869" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458049" id="2458049" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:28581" id="RLSA-2026:28581" type="self" title="RLSA-2026:28581" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:28581" id="RHSA-2026:28581" type="vendor" title="Red Hat RHSA-2026:28581" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3.14" arch="x86_64" epoch="0" version="3.14.5" release="1.el10_2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-3.14.5-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f8aa1d760642011e1e358f0e2bf7cef0162e0dabf32a6dc60c4d2827df3cf485</sum>
        </package>
        <package name="python3.14-devel" arch="x86_64" epoch="0" version="3.14.5" release="1.el10_2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.5-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f3a638919f6fe3bcf838c50105911a6987cbe8d02de67db4a9582c9bd84edd33</sum>
        </package>
        <package name="python3.14-tkinter" arch="x86_64" epoch="0" version="3.14.5" release="1.el10_2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.5-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">84f64226262b0398db4f4efbacde546d4ca201cbf5cc8cf83e06e154050809c1</sum>
        </package>
        <package name="python3.14-libs" arch="x86_64" epoch="0" version="3.14.5" release="1.el10_2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.5-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5516827dbab8edd2aa7d1bbb15a5ab711ea18fb1efc35342f992c0d1c1005ff4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:30860</id>
    <title>Important: perl-IO-Compress security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:28" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:30860 (https://access.redhat.com/errata/RHSA-2026:30860), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-IO-Compress.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries.  IO-Compress supports reading and writing of bzip2, RFC 1950, RFC 1951, RFC 1952 (i.e. gzip) and zip files/buffers.  The following modules used to be distributed separately, but are now included with the IO-Compress distribution:
* Compress-Zlib
* IO-Compress-Zlib
* IO-Compress-Bzip2
* IO-Compress-Base

Security Fix(es):

* perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962" id="CVE-2026-48962" type="cve" title="CVE-2026-48962" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2481767" id="2481767" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:30860" id="RLSA-2026:30860" type="self" title="RLSA-2026:30860" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:30860" id="RHSA-2026:30860" type="vendor" title="Red Hat RHSA-2026:30860" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl-IO-Compress" arch="noarch" epoch="0" version="2.212" release="512.el10_2.1" src="perl-IO-Compress-2.212-512.el10_2.1.src.rpm">
          <filename>perl-IO-Compress-2.212-512.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">b059ac10cc0fcc90f882a530ae1a53380607e1817d38ceaaf4d3544824a10b03</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:30857</id>
    <title>Important: perl-Archive-Tar security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:30857 (https://access.redhat.com/errata/RHSA-2026:30857), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-Archive-Tar.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Archive::Tar provides an object oriented mechanism for handling tar files.  It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation.  If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.

Security Fix(es):

* perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496" id="CVE-2026-42496" type="cve" title="CVE-2026-42496" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2481314" id="2481314" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:30857" id="RLSA-2026:30857" type="self" title="RLSA-2026:30857" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:30857" id="RHSA-2026:30857" type="vendor" title="Red Hat RHSA-2026:30857" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl-Archive-Tar" arch="noarch" epoch="0" version="3.02" release="512.el10_2.1" src="perl-Archive-Tar-3.02-512.el10_2.1.src.rpm">
          <filename>perl-Archive-Tar-3.02-512.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">def235214b96ac1753ba263eea2241b5563e0010c7070bc858179956c3b829da</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33093</id>
    <title>Important: mariadb10.11 security, bug fix, and enhancement update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:33093 (https://access.redhat.com/errata/RHSA-2026:33093), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mariadb10.11.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)

Bug Fix(es) and Enhancement(s):

* Rebase MariaDB 10.11 to 10.11.18 in Rocky Linux10 (JIRA:Rocky Linux-183086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44168" id="CVE-2026-44168" type="cve" title="CVE-2026-44168" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44170" id="CVE-2026-44170" type="cve" title="CVE-2026-44170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44171" id="CVE-2026-44171" type="cve" title="CVE-2026-44171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44173" id="CVE-2026-44173" type="cve" title="CVE-2026-44173" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48163" id="CVE-2026-48163" type="cve" title="CVE-2026-48163" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48165" id="CVE-2026-48165" type="cve" title="CVE-2026-48165" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49261" id="CVE-2026-49261" type="cve" title="CVE-2026-49261" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487957" id="2487957" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488450" id="2488450" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488453" id="2488453" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488458" id="2488458" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488451" id="2488451" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488460" id="2488460" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488454" id="2488454" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33093" id="RLSA-2026:33093" type="self" title="RLSA-2026:33093" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:33093" id="RHSA-2026:33093" type="vendor" title="Red Hat RHSA-2026:33093" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mariadb-common" arch="noarch" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-common-10.11.18-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">3cd74e44e796f07186f75a393865c312bb1d3f6ef70b615efa0d85cf9cced829</sum>
        </package>
        <package name="mariadb-errmsg" arch="noarch" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-errmsg-10.11.18-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">24478e435c3192ce142367475151c6ac8066ae9239eed0b5be804a8b8a61cc7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33412</id>
    <title>Important: galera and mariadb11.8 security, bug fix, and enhancement update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:33412 (https://access.redhat.com/errata/RHSA-2026:33412), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mariadb11.8, galera.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)

Bug Fix(es) and Enhancement(s):

* Rebase MariaDB 11.8 to 11.8.8 in Rocky Linux10 (JIRA:Rocky Linux-183084)

* Rebase Galera to 26.4.27 in Rocky Linux10 (JIRA:Rocky Linux-183259)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44168" id="CVE-2026-44168" type="cve" title="CVE-2026-44168" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44169" id="CVE-2026-44169" type="cve" title="CVE-2026-44169" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44170" id="CVE-2026-44170" type="cve" title="CVE-2026-44170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44171" id="CVE-2026-44171" type="cve" title="CVE-2026-44171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44173" id="CVE-2026-44173" type="cve" title="CVE-2026-44173" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48163" id="CVE-2026-48163" type="cve" title="CVE-2026-48163" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48165" id="CVE-2026-48165" type="cve" title="CVE-2026-48165" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49261" id="CVE-2026-49261" type="cve" title="CVE-2026-49261" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488450" id="2488450" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488453" id="2488453" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488458" id="2488458" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488451" id="2488451" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488460" id="2488460" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488467" id="2488467" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488454" id="2488454" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487957" id="2487957" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33412" id="RLSA-2026:33412" type="self" title="RLSA-2026:33412" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:33412" id="RHSA-2026:33412" type="vendor" title="Red Hat RHSA-2026:33412" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mariadb11.8-client-utils" arch="noarch" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-client-utils-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">bdf085f9b32027a04faf1936121294f4e125cbbaa4d25d41790a24c0ad470748</sum>
        </package>
        <package name="mariadb11.8-common" arch="noarch" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-common-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">27b7c1c52b97aa63466127b63183d7f1383218b9a5e76c82725d30a90ea56f6d</sum>
        </package>
        <package name="mariadb11.8-server-utils" arch="noarch" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-server-utils-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">67adcf01931ae0f0f1af0de602946a94f403b211d441e3dc1db0c3878db9d7c3</sum>
        </package>
        <package name="mariadb11.8-errmsg" arch="noarch" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-errmsg-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1c2e025220336444a26355b1c6fd8c3674cf71a426b239bf27040ce11a51899f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33565</id>
    <title>Important: ruby security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:33565 (https://access.redhat.com/errata/RHSA-2026:33565), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245)

* ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258)

* net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42245" id="CVE-2026-42245" type="cve" title="CVE-2026-42245" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42246" id="CVE-2026-42246" type="cve" title="CVE-2026-42246" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42258" id="CVE-2026-42258" type="cve" title="CVE-2026-42258" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468495" id="2468495" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468499" id="2468499" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468498" id="2468498" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33565" id="RLSA-2026:33565" type="self" title="RLSA-2026:33565" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:33565" id="RHSA-2026:33565" type="vendor" title="Red Hat RHSA-2026:33565" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-irb-1.13.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">28cf1c820c847698d85c6c93c4c5e956fd32cad37b2c37fe0bad1cc2733b1129</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rake-13.1.0-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">fb0899a3b9b46f54db49b28696bdd96743cb35f8893bc3277f0a9b4afae47fe6</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygems-devel-3.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">b03f3b4b8e82aa8edc66fe5450c64e40fa5077192b659b0732597d5d021b5d11</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.4.4" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rexml-3.4.4-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">8517f1665690b67e89de21483e07ff58235570b5eb05563d6aa2d72a9158f42d</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygems-3.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">e2a37f258c1711d598ec2925881e5d03d8f911b3fd7be75ac29f6360b377ec1f</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-test-unit-3.6.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">89baaea436528e59b988d3bf472121fc65f3cfdd3c0ce79634de4b2fd08c8242</sum>
        </package>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-typeprof-0.21.9-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">5280386d092bc331ac552910b710f8bdaa37fb619f97d5e21601adbf85f7c784</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.10" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-default-gems-3.3.10-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">c59c666c2cfc7c70462f8eff4842c02f2344b6c51cbe3b543af9c429db9060bc</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-minitest-5.20.0-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">833fc9fc88e6368f005ccec5994cdb15e408050c12dd96772a47a07f3b69bdec</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">06a507e0c3f82ef923f820ceaf33ef9e0a87543304ff4548999c361be1dee061</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-power_assert-2.0.3-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">67513e1e30b7a65f258843366aba5ce0c270f13ada04afa6df9be8639abc79fb</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rss-0.3.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">0b178d6ce03da5bf79edb2506a13da5511fcdc939a9f328662bf96e5d851db1d</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-bundler-2.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">e59464032348e22159892eb4aa81e8d2bc6dbb44bb43b3a45d7921e0f7691463</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33731</id>
    <title>Moderate: rrdtool security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:33731 (https://access.redhat.com/errata/RHSA-2026:33731), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for rrdtool.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.

Security Fix(es):

* rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43958" id="CVE-2026-43958" type="cve" title="CVE-2026-43958" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460932" id="2460932" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33731" id="RLSA-2026:33731" type="self" title="RLSA-2026:33731" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:33731" id="RHSA-2026:33731" type="vendor" title="Red Hat RHSA-2026:33731" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="rrdtool-perl" arch="x86_64" epoch="0" version="1.8.0" release="21.el10_2" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-perl-1.8.0-21.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4c5275f3f3c028aae9fc5dd6b9b6c764b1ff166e74a1c75be828a75fe0a60ee6</sum>
        </package>
        <package name="rrdtool" arch="x86_64" epoch="0" version="1.8.0" release="21.el10_2" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-1.8.0-21.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bf5ca38e75459072071af11f410d0ed019cb715f56aac2e32c09f229ded7e641</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:34109</id>
    <title>Important: httpd security, bug fix, and enhancement update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:34109 (https://access.redhat.com/errata/RHSA-2026:34109), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)

* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)

* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)

* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)

* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

Bug Fix(es) and Enhancement(s):

* address Moderate severity issues from httpd 2.4.68 [rhel-10.2.z] (JIRA:Rocky Linux-184518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42516" id="CVE-2024-42516" type="cve" title="CVE-2024-42516" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24072" id="CVE-2026-24072" type="cve" title="CVE-2026-24072" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29169" id="CVE-2026-29169" type="cve" title="CVE-2026-29169" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33006" id="CVE-2026-33006" type="cve" title="CVE-2026-33006" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34355" id="CVE-2026-34355" type="cve" title="CVE-2026-34355" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34356" id="CVE-2026-34356" type="cve" title="CVE-2026-34356" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42535" id="CVE-2026-42535" type="cve" title="CVE-2026-42535" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42536" id="CVE-2026-42536" type="cve" title="CVE-2026-42536" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43951" id="CVE-2026-43951" type="cve" title="CVE-2026-43951" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44119" id="CVE-2026-44119" type="cve" title="CVE-2026-44119" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44185" id="CVE-2026-44185" type="cve" title="CVE-2026-44185" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44186" id="CVE-2026-44186" type="cve" title="CVE-2026-44186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44631" id="CVE-2026-44631" type="cve" title="CVE-2026-44631" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486411" id="2486411" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486397" id="2486397" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374549" id="2374549" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486399" id="2486399" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486395" id="2486395" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2465296" id="2465296" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486414" id="2486414" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486415" id="2486415" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2465293" id="2465293" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486416" id="2486416" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486402" id="2486402" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486406" id="2486406" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464941" id="2464941" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:34109" id="RLSA-2026:34109" type="self" title="RLSA-2026:34109" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:34109" id="RHSA-2026:34109" type="vendor" title="Red Hat RHSA-2026:34109" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="httpd" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-2.4.63-13.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">82e63336f1d7db491a94aee9d6b668394811e8788c869154f25b96bc52e0b32d</sum>
        </package>
        <package name="httpd-tools" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-tools-2.4.63-13.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">fc9f77989ccafe36762e8fb4ed7e36f84af8c7c3a184d074a94f524505a628b9</sum>
        </package>
        <package name="mod_session" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_session-2.4.63-13.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">4c904d43721b01837bcaa198621172d8086ad4174e9b2b620a0e78a142399ea8</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">ca2e34bd838cbcae62e3b8016d136f176d7139be57372b5ec6893ef5f777b8cf</sum>
        </package>
        <package name="httpd-devel" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-devel-2.4.63-13.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">41fdb4ab93c77bf769e22c052d16d90df8a911b43517b349e5ec662525534ba3</sum>
        </package>
        <package name="mod_proxy_html" arch="x86_64" epoch="1" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_proxy_html-2.4.63-13.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">4b4f64a4cb201cfff9656057b7b5051e984b6095d1a267db007fe869ec68594b</sum>
        </package>
        <package name="mod_ldap" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_ldap-2.4.63-13.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">e554f78f112db0ab4ff2fb6aa7d034d5a33d3d5f1dddd9c9a8f759ae0c02c90f</sum>
        </package>
        <package name="mod_ssl" arch="x86_64" epoch="1" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_ssl-2.4.63-13.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">a402c0cabb09211889b38560b95e24d82f6e5eb3db3331a196c067cce6d2324a</sum>
        </package>
        <package name="httpd-core" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-core-2.4.63-13.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">31f1e349e02b3b264a04fef768613364f98febd27e85df131dfb9b9c8b92cd1e</sum>
        </package>
        <package name="mod_lua" arch="x86_64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_lua-2.4.63-13.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">b38bcd313b7679af689999408d7805b241ebce881e502320b5ff814930508dc9</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">49f415b3e7032f430319a8047f39e8d1477ba790df8d02b6035044a82e9eae2a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:34355</id>
    <title>Moderate: mod_http2 security, bug fix, and enhancement update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:34355 (https://access.redhat.com/errata/RHSA-2026:34355), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_http2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913)

* httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

Bug Fix(es) and Enhancement(s):

* address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:Rocky Linux-188008)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43951" id="CVE-2026-43951" type="cve" title="CVE-2026-43951" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48913" id="CVE-2026-48913" type="cve" title="CVE-2026-48913" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486415" id="2486415" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486405" id="2486405" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:34355" id="RLSA-2026:34355" type="self" title="RLSA-2026:34355" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:34355" id="RHSA-2026:34355" type="vendor" title="Red Hat RHSA-2026:34355" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_http2" arch="x86_64" epoch="0" version="2.0.29" release="4.el10_2.2" src="mod_http2-2.0.29-4.el10_2.2.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">bb58f25f61ae8623786c954f1c0c89934bcdc9a941b217e29fa0bc85b9be5095</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:34357</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:34357 (https://access.redhat.com/errata/RHSA-2026:34357), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

* github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681" id="CVE-2026-25681" type="cve" title="CVE-2026-25681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42151" id="CVE-2026-42151" type="cve" title="CVE-2026-42151" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42154" id="CVE-2026-42154" type="cve" title="CVE-2026-42154" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466507" id="2466507" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466505" id="2466505" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480761" id="2480761" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484207" id="2484207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467822" id="2467822" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:34357" id="RLSA-2026:34357" type="self" title="RLSA-2026:34357" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:34357" id="RHSA-2026:34357" type="vendor" title="Red Hat RHSA-2026:34357" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.152.1" release="1.el10_2" src="opentelemetry-collector-0.152.1-1.el10_2.src.rpm">
          <filename>opentelemetry-collector-0.152.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5edab315bf9449f06e7bd4765b90bc61c7392a561bff4d45b1b061600262215e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35827</id>
    <title>Important: grafana security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:35827 (https://access.redhat.com/errata/RHSA-2026:35827), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681" id="CVE-2026-25681" type="cve" title="CVE-2026-25681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480761" id="2480761" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35827" id="RLSA-2026:35827" type="self" title="RLSA-2026:35827" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:35827" id="RHSA-2026:35827" type="vendor" title="Red Hat RHSA-2026:35827" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="27.el10_2" src="grafana-10.2.6-27.el10_2.src.rpm">
          <filename>grafana-selinux-10.2.6-27.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2086ed80c5a6e23034428915dad804b3eb2f4a9993972add6eab7758661e560e</sum>
        </package>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="27.el10_2" src="grafana-10.2.6-27.el10_2.src.rpm">
          <filename>grafana-10.2.6-27.el10_2.x86_64.rpm</filename>
          <sum type="sha256">65e59c422b08d24fb14ef1deb48b2e8b565d04a5b3778449dd5a4921c704ebb6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35826</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:35826 (https://access.redhat.com/errata/RHSA-2026:35826), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35826" id="RLSA-2026:35826" type="self" title="RLSA-2026:35826" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:35826" id="RHSA-2026:35826" type="vendor" title="Red Hat RHSA-2026:35826" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-pcp" arch="x86_64" epoch="0" version="5.3.0" release="7.el10_2" src="grafana-pcp-5.3.0-7.el10_2.src.rpm">
          <filename>grafana-pcp-5.3.0-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">10e5bafdb7689892ab91b8a6d054a94a7270bac8e612a77c39c717cca077cc68</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35832</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:35832 (https://access.redhat.com/errata/RHSA-2026:35832), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484207" id="2484207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467822" id="2467822" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35832" id="RLSA-2026:35832" type="self" title="RLSA-2026:35832" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:35832" id="RHSA-2026:35832" type="vendor" title="Red Hat RHSA-2026:35832" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="7.el10_2.2" src="golang-github-openprinting-ipp-usb-0.9.27-7.el10_2.2.src.rpm">
          <filename>ipp-usb-0.9.27-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">0b2d998d43ebc0bf6bd26eb5b5b931fb0839cbbcad9fb1b689ebbf8b8cf954b9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35842</id>
    <title>Important: nodejs22 security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:35842 (https://access.redhat.com/errata/RHSA-2026:35842), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

* nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:Rocky Linux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11525" id="CVE-2026-11525" type="cve" title="CVE-2026-11525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12151" id="CVE-2026-12151" type="cve" title="CVE-2026-12151" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42338" id="CVE-2026-42338" type="cve" title="CVE-2026-42338" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48615" id="CVE-2026-48615" type="cve" title="CVE-2026-48615" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48618" id="CVE-2026-48618" type="cve" title="CVE-2026-48618" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48619" id="CVE-2026-48619" type="cve" title="CVE-2026-48619" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48928" id="CVE-2026-48928" type="cve" title="CVE-2026-48928" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48930" id="CVE-2026-48930" type="cve" title="CVE-2026-48930" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48933" id="CVE-2026-48933" type="cve" title="CVE-2026-48933" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48934" id="CVE-2026-48934" type="cve" title="CVE-2026-48934" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48935" id="CVE-2026-48935" type="cve" title="CVE-2026-48935" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6733" id="CVE-2026-6733" type="cve" title="CVE-2026-6733" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9678" id="CVE-2026-9678" type="cve" title="CVE-2026-9678" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490006" id="2490006" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476810" id="2476810" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490008" id="2490008" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493333" id="2493333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493329" id="2493329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493335" id="2493335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493331" id="2493331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489980" id="2489980" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493332" id="2493332" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490000" id="2490000" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493326" id="2493326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493325" id="2493325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493337" id="2493337" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35842" id="RLSA-2026:35842" type="self" title="RLSA-2026:35842" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:35842" id="RHSA-2026:35842" type="vendor" title="Red Hat RHSA-2026:35842" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs-libs" arch="x86_64" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-libs-22.23.1-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">90771ea06ea8be1b70c6bf11da191b73eef836e284b2dec3d7fb0f08acaadaa9</sum>
        </package>
        <package name="nodejs-npm" arch="x86_64" epoch="1" version="10.9.8" release="1.22.23.1.2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-npm-10.9.8-1.22.23.1.2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ad96595e2c7aa7068cbc950d0cdf9ef32f181cdcea8d5f9e3a3f3c32b43aa718</sum>
        </package>
        <package name="nodejs-full-i18n" arch="x86_64" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-full-i18n-22.23.1-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9ed04d902b1209e3399b2aabf9ddbf92ca463125d47eac75c36f60d5515583eb</sum>
        </package>
        <package name="nodejs" arch="x86_64" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-22.23.1-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5848d42e52d456acba527ebffcd860334813fadcc6f9baf0605c9dbcd457dc69</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">c445b134107495680afbb7148ce62f7d861da464bd69956a01343b69425db4a9</sum>
        </package>
        <package name="nodejs-devel" arch="x86_64" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-devel-22.23.1-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">212630dce0776334877e08dde8f1de11e077a3a60278ffbdd36d6421a594402a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36193</id>
    <title>Important: python3.14-pip security update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36193 (https://access.redhat.com/errata/RHSA-2026:36193), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python3.14-pip.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8643" id="CVE-2026-8643" type="cve" title="CVE-2026-8643" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460927" id="2460927" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36193" id="RLSA-2026:36193" type="self" title="RLSA-2026:36193" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36193" id="RHSA-2026:36193" type="vendor" title="Red Hat RHSA-2026:36193" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3.14-pip" arch="noarch" epoch="0" version="25.2" release="3.el10_2.5" src="python3.14-pip-25.2-3.el10_2.5.src.rpm">
          <filename>python3.14-pip-25.2-3.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">b2b879c8b24e449d465a83b2f005527bd01bac2235ac1438fd0e566aed2d8fe2</sum>
        </package>
        <package name="python3.14-pip-wheel" arch="noarch" epoch="0" version="25.2" release="3.el10_2.5" src="python3.14-pip-25.2-3.el10_2.5.src.rpm">
          <filename>python3.14-pip-wheel-25.2-3.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">bd3a925a4d2a54231e5d77058cfafc3a928fc3dfb986677755e5746d7f09f5b8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36196</id>
    <title>Important: 389-ds-base security update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36196 (https://access.redhat.com/errata/RHSA-2026:36196), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for 389-ds-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11610" id="CVE-2026-11610" type="cve" title="CVE-2026-11610" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11774" id="CVE-2026-11774" type="cve" title="CVE-2026-11774" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484414" id="2484414" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484916" id="2484916" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36196" id="RLSA-2026:36196" type="self" title="RLSA-2026:36196" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36196" id="RHSA-2026:36196" type="vendor" title="Red Hat RHSA-2026:36196" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-lib389" arch="noarch" epoch="0" version="3.2.0" release="8.el10_2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>python3-lib389-3.2.0-8.el10_2.noarch.rpm</filename>
          <sum type="sha256">15aaf000a8cda875daca68b969d0e2b54147ff2d82b49bfca1132402283db902</sum>
        </package>
        <package name="389-ds-base-libs" arch="x86_64" epoch="0" version="3.2.0" release="8.el10_2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-libs-3.2.0-8.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ff4e7373b29731f476a66e2730e73eaac2abe3a37f25c34a4c37db7d1bcc28dc</sum>
        </package>
        <package name="389-ds-base-snmp" arch="x86_64" epoch="0" version="3.2.0" release="8.el10_2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-snmp-3.2.0-8.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1db10a02b8fd4b17047dcdc26922f6329bb3f709aac8bb892f0fba2ba1c583a0</sum>
        </package>
        <package name="389-ds-base" arch="x86_64" epoch="0" version="3.2.0" release="8.el10_2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-3.2.0-8.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c4a3113ef17535fbf0bbd2eeb56b5dfd996c70ad4118d64a2308c8815034f6b8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36199</id>
    <title>Important: buildah security update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36199 (https://access.redhat.com/errata/RHSA-2026:36199), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829" id="CVE-2026-39829" type="cve" title="CVE-2026-39829" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830" id="CVE-2026-39830" type="cve" title="CVE-2026-39830" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832" id="CVE-2026-39832" type="cve" title="CVE-2026-39832" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835" id="CVE-2026-39835" type="cve" title="CVE-2026-39835" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480684" id="2480684" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480681" id="2480681" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480685" id="2480685" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480680" id="2480680" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36199" id="RLSA-2026:36199" type="self" title="RLSA-2026:36199" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36199" id="RHSA-2026:36199" type="vendor" title="Red Hat RHSA-2026:36199" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah" arch="x86_64" epoch="2" version="1.43.1" release="3.el10_2" src="buildah-1.43.1-3.el10_2.src.rpm">
          <filename>buildah-1.43.1-3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">230e07f937c11b8396adf23c25492628fbf910b60cd5b6c481ddc628e4140828</sum>
        </package>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.43.1" release="3.el10_2" src="buildah-1.43.1-3.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">86f18d171343916d2211ec5e9b6b57e8043a94f2c861eb291551e738eb74ec06</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36203</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36203 (https://access.redhat.com/errata/RHSA-2026:36203), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033)

* freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422)

* freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700)

* freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421)

* freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40033" id="CVE-2026-40033" type="cve" title="CVE-2026-40033" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44420" id="CVE-2026-44420" type="cve" title="CVE-2026-44420" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44421" id="CVE-2026-44421" type="cve" title="CVE-2026-44421" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44422" id="CVE-2026-44422" type="cve" title="CVE-2026-44422" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45700" id="CVE-2026-45700" type="cve" title="CVE-2026-45700" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2483470" id="2483470" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2483480" id="2483480" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2481473" id="2481473" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2483471" id="2483471" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2483467" id="2483467" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36203" id="RLSA-2026:36203" type="self" title="RLSA-2026:36203" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36203" id="RHSA-2026:36203" type="vendor" title="Red Hat RHSA-2026:36203" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.6" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>libwinpr-3.10.3-12.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">b493150d21b2acc6b694b09c00d9a8149208ab239d1d6152e0b3e8e4dbcc1e26</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.6" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>freerdp-libs-3.10.3-12.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">c628e133dac2904cd40806ca97b8e7e30b15a2c7c35c6dc9c2d0a9b10309e5f4</sum>
        </package>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.6" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>freerdp-3.10.3-12.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">48d47b89a2ae7a287b462eacc99bbf2c0172a21dcf6e8aff5dd6e588ff013e4d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36364</id>
    <title>Important: nginx security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36364 (https://access.redhat.com/errata/RHSA-2026:36364), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055)

Bug Fix(es) and Enhancement(s):

* "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [rhel-10.2.z] (JIRA:Rocky Linux-191778)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42055" id="CVE-2026-42055" type="cve" title="CVE-2026-42055" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489866" id="2489866" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36364" id="RLSA-2026:36364" type="self" title="RLSA-2026:36364" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36364" id="RHSA-2026:36364" type="vendor" title="Red Hat RHSA-2026:36364" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">70869b22331eda13a826332976a1f254157838aa68f5c3d65e328473d84f0983</sum>
        </package>
        <package name="nginx" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">1c88fced41ebff15d4d94115707b751ba2062a64d155605be948bc921c175de7</sum>
        </package>
        <package name="nginx-mod-mail" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">d9510ef0dd18ac4aad9e472dc097ecf485395d946c8f02b0b8bdc1e26c3885ed</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">528cd467ae551f3d265ba426447358c11ac31beb25e5a7141699e66104d8731f</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">c62771c9be4e32438c98dfa4fb4bad4e3b55a72e448ae8eed4ea97b05a9cb269</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">36e7dca9092cc1c4977087120cf2640ba586f28101ff094d0528d22792f289f5</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">2dde1bd38c6252ef68fc6a6b51f75f5543098f68951788b8e251cffb3368fb02</sum>
        </package>
        <package name="nginx-core" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">e52f36ebe19736bb3f031f3eb108013a51e9a39a09e57c9f36010f359fea73ee</sum>
        </package>
        <package name="nginx-mod-stream" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">122c1daa5497195b9cdbbdd572c5bc7118fbb658c5bb5b43232fcb7ddfb4981f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35841</id>
    <title>Important: nodejs24 security, bug fix, and enhancement update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:35841 (https://access.redhat.com/errata/RHSA-2026:35841), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

* undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

* undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11525" id="CVE-2026-11525" type="cve" title="CVE-2026-11525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12151" id="CVE-2026-12151" type="cve" title="CVE-2026-12151" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42338" id="CVE-2026-42338" type="cve" title="CVE-2026-42338" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48615" id="CVE-2026-48615" type="cve" title="CVE-2026-48615" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48618" id="CVE-2026-48618" type="cve" title="CVE-2026-48618" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48619" id="CVE-2026-48619" type="cve" title="CVE-2026-48619" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48928" id="CVE-2026-48928" type="cve" title="CVE-2026-48928" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48930" id="CVE-2026-48930" type="cve" title="CVE-2026-48930" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48933" id="CVE-2026-48933" type="cve" title="CVE-2026-48933" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48934" id="CVE-2026-48934" type="cve" title="CVE-2026-48934" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48935" id="CVE-2026-48935" type="cve" title="CVE-2026-48935" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6733" id="CVE-2026-6733" type="cve" title="CVE-2026-6733" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6734" id="CVE-2026-6734" type="cve" title="CVE-2026-6734" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9678" id="CVE-2026-9678" type="cve" title="CVE-2026-9678" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9697" id="CVE-2026-9697" type="cve" title="CVE-2026-9697" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490006" id="2490006" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476810" id="2476810" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490008" id="2490008" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490024" id="2490024" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493333" id="2493333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493329" id="2493329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493335" id="2493335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493331" id="2493331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489980" id="2489980" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493332" id="2493332" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490000" id="2490000" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493326" id="2493326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490018" id="2490018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493325" id="2493325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493337" id="2493337" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35841" id="RLSA-2026:35841" type="self" title="RLSA-2026:35841" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:35841" id="RHSA-2026:35841" type="vendor" title="Red Hat RHSA-2026:35841" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs24" arch="x86_64" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-24.18.0-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">de3888dd026f734f748c8a54755b91968930673c7b382c3ed6fe8e9dc40a4b91</sum>
        </package>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-docs-24.18.0-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">98dfc8543e2bda18ce07381220e682a38f99a487f4e472426103a224f872c145</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.16.0" release="1.24.18.0.1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-npm-11.16.0-1.24.18.0.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">f302925c9bee672aeef0da7db54c016811b40b05f7dcc16a87141d301e30d126</sum>
        </package>
        <package name="nodejs24-libs" arch="x86_64" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-libs-24.18.0-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2aea6dc6bed3cdd69f99ae3fa25313bcf6e6a32180b743c8a22e73e35263f362</sum>
        </package>
        <package name="nodejs24-devel" arch="x86_64" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-devel-24.18.0-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9e5a669f95cc27849811a67335504f100ce0999bae9dd0f00ab5de0a2a9075e9</sum>
        </package>
        <package name="nodejs24-full-i18n" arch="x86_64" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-full-i18n-24.18.0-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9366fdfc595a7ab5a1a3c8e22f9e65def30493c8de96c39b3fe083e3f049aa0d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36673</id>
    <title>Moderate: gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36673 (https://access.redhat.com/errata/RHSA-2026:36673), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gstreamer1-plugins-ugly-free.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This package contains plug-ins whose license is not fully compatible with LGPL.

Security Fix(es):

* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53703" id="CVE-2026-53703" type="cve" title="CVE-2026-53703" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487613" id="2487613" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36673" id="RLSA-2026:36673" type="self" title="RLSA-2026:36673" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36673" id="RHSA-2026:36673" type="vendor" title="Red Hat RHSA-2026:36673" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-ugly-free" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.1" src="gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">2e995b36b0bd2ce8a0fcd585c1a5579d2fdd7d0d23244d7577d348bdf3f901bb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36675</id>
    <title>Important: gstreamer1-plugins-good security update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36675 (https://access.redhat.com/errata/RHSA-2026:36675), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-good.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

* gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53705" id="CVE-2026-53705" type="cve" title="CVE-2026-53705" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487615" id="2487615" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36675" id="RLSA-2026:36675" type="self" title="RLSA-2026:36675" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36675" id="RHSA-2026:36675" type="vendor" title="Red Hat RHSA-2026:36675" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-good-gtk" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.1" src="gstreamer1-plugins-good-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">9fae028397b60401a0c4285c08fea41bad09923656790f1f5958bc25f8aa2c68</sum>
        </package>
        <package name="gstreamer1-plugins-good" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.1" src="gstreamer1-plugins-good-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">f7d3f9c7e579b2371ecd7c9697577fe2fb0777e06c942de6d6c108dc7564d291</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36749</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36749 (https://access.redhat.com/errata/RHSA-2026:36749), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-bad-free.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)

* gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)

* gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)

* gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52718" id="CVE-2026-52718" type="cve" title="CVE-2026-52718" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52719" id="CVE-2026-52719" type="cve" title="CVE-2026-52719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52720" id="CVE-2026-52720" type="cve" title="CVE-2026-52720" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52722" id="CVE-2026-52722" type="cve" title="CVE-2026-52722" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486731" id="2486731" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486353" id="2486353" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486733" id="2486733" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486328" id="2486328" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36749" id="RLSA-2026:36749" type="self" title="RLSA-2026:36749" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36749" id="RHSA-2026:36749" type="vendor" title="Red Hat RHSA-2026:36749" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-bad-free" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.4" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">049053e91cf04073ac186f25a634a60f4f9ac397aa9e45e94f417805caad9942</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.4" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">699484823008fd4e1c05c7bcd37b1211f088fecc9467c634cdef7bfaffa5722a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36782</id>
    <title>Moderate: aardvark-dns security update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36782 (https://access.redhat.com/errata/RHSA-2026:36782), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for aardvark-dns.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Authoritative DNS server for A/AAAA container records  Forwards other request to configured resolvers. Read more about configuration in `src/backend/mod.rs`.

Security Fix(es):

* aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset (CVE-2026-35406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35406" id="CVE-2026-35406" type="cve" title="CVE-2026-35406" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456280" id="2456280" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36782" id="RLSA-2026:36782" type="self" title="RLSA-2026:36782" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36782" id="RHSA-2026:36782" type="vendor" title="Red Hat RHSA-2026:36782" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aardvark-dns" arch="x86_64" epoch="2" version="1.17.1" release="1.el10_2" src="aardvark-dns-1.17.1-1.el10_2.src.rpm">
          <filename>aardvark-dns-1.17.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ee39182f2a83a7421116d24c45455bac1622fb74db3e3b65fdec1cf1dec78261</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36790</id>
    <title>Important: tomcat9 security, bug fix, and enhancement update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36790 (https://access.redhat.com/errata/RHSA-2026:36790), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)

* Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

* Remove tomcat clustering JAR from RPM builds (JIRA:Rocky Linux-185571)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66614" id="CVE-2025-66614" type="cve" title="CVE-2025-66614" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24733" id="CVE-2026-24733" type="cve" title="CVE-2026-24733" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24734" id="CVE-2026-24734" type="cve" title="CVE-2026-24734" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24880" id="CVE-2026-24880" type="cve" title="CVE-2026-24880" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25854" id="CVE-2026-25854" type="cve" title="CVE-2026-25854" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29129" id="CVE-2026-29129" type="cve" title="CVE-2026-29129" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29145" id="CVE-2026-29145" type="cve" title="CVE-2026-29145" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29146" id="CVE-2026-29146" type="cve" title="CVE-2026-29146" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32990" id="CVE-2026-32990" type="cve" title="CVE-2026-32990" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34483" id="CVE-2026-34483" type="cve" title="CVE-2026-34483" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34486" id="CVE-2026-34486" type="cve" title="CVE-2026-34486" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34487" id="CVE-2026-34487" type="cve" title="CVE-2026-34487" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34500" id="CVE-2026-34500" type="cve" title="CVE-2026-34500" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457027" id="2457027" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457020" id="2457020" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457031" id="2457031" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457040" id="2457040" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440430" id="2440430" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457043" id="2457043" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440426" id="2440426" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440437" id="2440437" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457044" id="2457044" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457037" id="2457037" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457039" id="2457039" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457038" id="2457038" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457025" id="2457025" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36790" id="RLSA-2026:36790" type="self" title="RLSA-2026:36790" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36790" id="RHSA-2026:36790" type="vendor" title="Red Hat RHSA-2026:36790" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-lib-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">683c5f85d2401482be297ea03195ee45106bc824cf2ecdb70650d20809e383cb</sum>
        </package>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">b15a4252e5c69c99bec43dfd3f607523e8d140c99a56718d76cd82551d8e78af</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">3d159c1ddd402e454d198b78d94122046c5295b7ff47d60dd12542f6880fa3b4</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">9e0c9011b4b9a50633335f9000fd7ca843ae7cdb187bd2c4ae85b295c330562b</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-webapps-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">48d9de76a1fbddb304aee31188eefcaae80c0363969dde185406df2d66103196</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">d88b46c29b1fbd0c4f6cfdc98ea9d2ace20db8dc2de0267346367fee143643cb</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">842f5604ed8323cc3351ea6a2d582f09894371f740bad67a74c50ca2ce205be5</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">c5003a87d029c2a076e15eb946fc14f7431c50a137b1059669f7a7d5d6de0644</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36788</id>
    <title>Important: tomcat security, bug fix, and enhancement update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36788 (https://access.redhat.com/errata/RHSA-2026:36788), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)

* Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

* Remove tomcat clustering JAR from RPM builds (JIRA:Rocky Linux-168577)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29146" id="CVE-2026-29146" type="cve" title="CVE-2026-29146" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34486" id="CVE-2026-34486" type="cve" title="CVE-2026-34486" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457027" id="2457027" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457020" id="2457020" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36788" id="RLSA-2026:36788" type="self" title="RLSA-2026:36788" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36788" id="RHSA-2026:36788" type="vendor" title="Red Hat RHSA-2026:36788" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">f77bac79a8487880b7aa20bee573515bc76854c724122045bbfdb91574de28b8</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">4c6f0fa1c5836a6f219f49ea6ee662f10530cb93482dc3cbddc6a6933be57fe9</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">538ce92952c00d4e49ec935dcf908eb291638a9bcefe9104e9822e317a96763f</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-webapps-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">08bdf6df703c7c98b8d870e3273ada67e39643c0c940001df1beecaa305511fc</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">6fbf7894259828065b77f5016dbf0d892bc953d0aba0c39b6b9e6be69b1b776c</sum>
        </package>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">c1ea0f315e45dfb7eb39f51ab66fa4f02c72d3213187b9c209c943ce60bffb58</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">a470bd4f75c4bf1ef7dd98afbfd7dd852165111d29282c8aef2417c6621412a3</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-lib-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">8a7ebad976679a90775eaf497779d3f0a07ea5b9125118ccfe045b925ceb8e7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:37072</id>
    <title>Important: podman security, bug fix, and enhancement update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:37072 (https://access.redhat.com/errata/RHSA-2026:37072), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)

* golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)

* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

* podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)

Bug Fix(es) and Enhancement(s):

* podman does not clean up all files and leaves orphaned files consuming disk space [rhel-10.2.z] (JIRA:Rocky Linux-173842)

* [FJ10.2 Bug]: [REG]The "podman-remote save" command fails for rootless users. [rhel-10.2.z] (JIRA:Rocky Linux-192440)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681" id="CVE-2026-25681" type="cve" title="CVE-2026-25681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136" id="CVE-2026-27136" type="cve" title="CVE-2026-27136" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829" id="CVE-2026-39829" type="cve" title="CVE-2026-39829" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830" id="CVE-2026-39830" type="cve" title="CVE-2026-39830" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832" id="CVE-2026-39832" type="cve" title="CVE-2026-39832" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835" id="CVE-2026-39835" type="cve" title="CVE-2026-39835" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508" id="CVE-2026-42508" type="cve" title="CVE-2026-42508" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231" id="CVE-2026-57231" type="cve" title="CVE-2026-57231" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480688" id="2480688" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480681" id="2480681" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480680" id="2480680" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480684" id="2480684" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480761" id="2480761" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480685" id="2480685" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493620" id="2493620" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480757" id="2480757" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:37072" id="RLSA-2026:37072" type="self" title="RLSA-2026:37072" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:37072" id="RHSA-2026:37072" type="vendor" title="Red Hat RHSA-2026:37072" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.8.2" release="4.el10_2" src="podman-5.8.2-4.el10_2.src.rpm">
          <filename>podman-remote-5.8.2-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">be56b7e7b067ce1816201f16ddce88bf579bd0f67d2fc3309373fadab530d7f1</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.8.2" release="4.el10_2" src="podman-5.8.2-4.el10_2.src.rpm">
          <filename>podman-docker-5.8.2-4.el10_2.noarch.rpm</filename>
          <sum type="sha256">1f8f1552aa0fdc7917048d9c874502c74433bdcfb2e78d992981685c0ca3eebe</sum>
        </package>
        <package name="podman" arch="x86_64" epoch="7" version="5.8.2" release="4.el10_2" src="podman-5.8.2-4.el10_2.src.rpm">
          <filename>podman-5.8.2-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">352b113f23864860e6422e4cdd63acd14098a8359def966fc3cf7d702a19b828</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:37436</id>
    <title>Important: golang security, bug fix, and enhancement update</title>
    <issued date="2026-07-13 00:05:40" />
    <updated date="2026-07-27 00:08:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:37436 (https://access.redhat.com/errata/RHSA-2026:37436), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

Bug Fix(es) and Enhancement(s):

* Update Go to version 1.26.5+1 [rhel-10.2.z] (JIRA:Rocky Linux-193473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498152" id="2498152" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:37436" id="RLSA-2026:37436" type="self" title="RLSA-2026:37436" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:37436" id="RHSA-2026:37436" type="vendor" title="Red Hat RHSA-2026:37436" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-docs-1.26.5-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">7d56c4705f41f8059b8525e5e10532b7577793818d96eba3ba9c7a4c2fb42bc8</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-misc-1.26.5-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">82bc692b6e16e8b7b28594c167a923d1e43ae243e17ffa884f4e79dce6ba07eb</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-tests-1.26.5-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">03bd96c9c35146d54fce39675a2984a11d3f60d11ddc5677d5c0caa292c7a802</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-src-1.26.5-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b3bfb3baac45cbf187f91e77ed16fa051677bf158c828d9185978236579d0f5c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36211</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-07-13 18:04:04" />
    <updated date="2026-07-27 12:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:36211 (https://access.redhat.com/errata/RHSA-2026:36211), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freeipmi.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.

Security Fix(es):

* freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50031" id="CVE-2026-50031" type="cve" title="CVE-2026-50031" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484296" id="2484296" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36211" id="RLSA-2026:36211" type="self" title="RLSA-2026:36211" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:36211" id="RHSA-2026:36211" type="vendor" title="Red Hat RHSA-2026:36211" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freeipmi-ipmiseld" arch="x86_64" epoch="0" version="1.6.18" release="1.el10_2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-ipmiseld-1.6.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f8b2e63cfbf63f77a211bad3102088c293757a511150f0663643fdf4ef663507</sum>
        </package>
        <package name="freeipmi-ipmidetectd" arch="x86_64" epoch="0" version="1.6.18" release="1.el10_2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-ipmidetectd-1.6.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">33a18900e9aa88a51e125e2d3d8fa504a6763790cccf486a6d71c1854364fabe</sum>
        </package>
        <package name="freeipmi" arch="x86_64" epoch="0" version="1.6.18" release="1.el10_2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-1.6.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e11bf84315aa5b765abe02636eeef0cd656a490f6c1c86aa2eb28d4a98f85c1f</sum>
        </package>
        <package name="freeipmi-bmc-watchdog" arch="x86_64" epoch="0" version="1.6.18" release="1.el10_2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-bmc-watchdog-1.6.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0b34a1facd6ac6a5bebcd18e061042ce1211c349da4c0e6fe5d7f717975e9268</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:38514</id>
    <title>Important: plexus-utils security update</title>
    <issued date="2026-07-14 12:05:31" />
    <updated date="2026-07-28 12:08:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:38514 (https://access.redhat.com/errata/RHSA-2026:38514), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for plexus-utils.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage.

Security Fix(es):

* org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67030" id="CVE-2025-67030" type="cve" title="CVE-2025-67030" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451409" id="2451409" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:38514" id="RLSA-2026:38514" type="self" title="RLSA-2026:38514" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:38514" id="RHSA-2026:38514" type="vendor" title="Red Hat RHSA-2026:38514" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="plexus-utils" arch="noarch" epoch="0" version="3.5.1" release="9.el10_2" src="plexus-utils-3.5.1-9.el10_2.src.rpm">
          <filename>plexus-utils-3.5.1-9.el10_2.noarch.rpm</filename>
          <sum type="sha256">fa709eeedd422e5f53c93c8ec20f4aba5d39caccd81473f43666a4e1c6a47959</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:38495</id>
    <title>Important: podman security update</title>
    <issued date="2026-07-14 12:05:31" />
    <updated date="2026-07-28 12:08:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:38495 (https://access.redhat.com/errata/RHSA-2026:38495), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498152" id="2498152" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:38495" id="RLSA-2026:38495" type="self" title="RLSA-2026:38495" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:38495" id="RHSA-2026:38495" type="vendor" title="Red Hat RHSA-2026:38495" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.8.2" release="5.el10_2" src="podman-5.8.2-5.el10_2.src.rpm">
          <filename>podman-docker-5.8.2-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">8c6b2c85bbf2245bb41c018a03a2314b20e98e4afc950ac71a86f9349424435b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:39297</id>
    <title>Moderate: edk2 security, bug fix, and enhancement update</title>
    <issued date="2026-07-15 12:06:01" />
    <updated date="2026-07-29 12:08:46" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:39297 (https://access.redhat.com/errata/RHSA-2026:39297), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for edk2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. 

Security Fix(es):

* openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)

* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)

Bug Fix(es) and Enhancement(s):

* edk2/x64: re-enable legacy kernel loader [rhel-10.2.z] (JIRA:Rocky Linux-182421)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390" id="CVE-2026-28390" type="cve" title="CVE-2026-28390" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31790" id="CVE-2026-31790" type="cve" title="CVE-2026-31790" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456314" id="2456314" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451094" id="2451094" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:39297" id="RLSA-2026:39297" type="self" title="RLSA-2026:39297" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:39297" id="RHSA-2026:39297" type="vendor" title="Red Hat RHSA-2026:39297" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="edk2-aarch64" arch="noarch" epoch="0" version="20251114" release="5.el10_2.2" src="edk2-20251114-5.el10_2.2.src.rpm">
          <filename>edk2-aarch64-20251114-5.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">265b732f29dbac4df05f7afbbb5a8b243b281aa90ec4212373389276610eb1e3</sum>
        </package>
        <package name="edk2-ovmf" arch="noarch" epoch="0" version="20251114" release="5.el10_2.2" src="edk2-20251114-5.el10_2.2.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">4bb2cda1a65acef0c9aba7c15f779b0fd8a63cc370fad8029236ea1b4ae09997</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:41893</id>
    <title>Important: .NET 8.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-23 06:07:38" />
    <updated date="2026-08-06 06:10:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:41893 (https://access.redhat.com/errata/RHSA-2026:41893), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

* dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

* ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

* ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

* ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

* dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

* dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

* dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

* dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

* dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

* dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

* dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

* dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

* dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

* .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

* dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

* Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [rhel-10.2.z] (JIRA:Rocky Linux-192468)

* dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192329)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50525" id="CVE-2026-50525" type="cve" title="CVE-2026-50525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500509" id="2500509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500565" id="2500565" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500563" id="2500563" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500502" id="2500502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500562" id="2500562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500589" id="2500589" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500587" id="2500587" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500189" id="2500189" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500109" id="2500109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500581" id="2500581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500556" id="2500556" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500593" id="2500593" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500577" id="2500577" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499217" id="2499217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500580" id="2500580" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500515" id="2500515" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500492" id="2500492" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:41893" id="RLSA-2026:41893" type="self" title="RLSA-2026:41893" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:41893" id="RHSA-2026:41893" type="vendor" title="Red Hat RHSA-2026:41893" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.29-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ab8a3e915447c2e3b1ee773e1363ddc6f2b7070cc4aaae1c11db7ef9ead465c4</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.129" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.129-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a39c6551ed51b0de96a5139acb1401a53c408aad3af744916452bae26148161b</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.129" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.129-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8918a171cd56a7ea4be56b745e91d713ba9ecf94383b003566ea0df9120c7c0c</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.29-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9d5c92ab6debe00f422242de080fda02b54cfa3addc8b120b4aea125475d81bf</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.129" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.129-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">18042268048ffa9910419f6a76fb8e668be10ec29e5950b66396b221d91984ba</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.29-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a29340d6a797057d739dc92044059e0d1cffa09a430c665eed15a8207155baf4</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.29-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ae40abf58bf64e4d1404dfda25a7b3a0a403a1f0cd3c45c6fd103100a372ec25</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.29-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5cf520e5da1c817791a623eb3ed425bc1b3b2c95602ff0103bb8a7d25917f926</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.29-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d4b383545ae885209c284fc6f68ab2e3e901fb53266cccfdec48acd63315a6b9</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.29-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8f3ff67bcd40e3a6c1215d7bdb3f165d4cf4cecf627e8e2063da0fe2b49db1f7</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.29-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">02d8e8787e69f413b75704656bdf1e8072e82f6036bbc8a50f27525948d3c403</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:41895</id>
    <title>Important: .NET 9.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-23 06:07:38" />
    <updated date="2026-08-06 06:10:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:41895 (https://access.redhat.com/errata/RHSA-2026:41895), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

* dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

* ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

* ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

* ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

* dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

* dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

* dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

* dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

* dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

* dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

* dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

* dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

* .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

* dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

* Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [rhel-10.2.z] (JIRA:Rocky Linux-192473)

* dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500509" id="2500509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500565" id="2500565" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500563" id="2500563" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500502" id="2500502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500562" id="2500562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500589" id="2500589" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500587" id="2500587" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500189" id="2500189" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500109" id="2500109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500581" id="2500581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500556" id="2500556" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500593" id="2500593" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500577" id="2500577" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499217" id="2499217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500515" id="2500515" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500492" id="2500492" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:41895" id="RLSA-2026:41895" type="self" title="RLSA-2026:41895" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:41895" id="RHSA-2026:41895" type="vendor" title="Red Hat RHSA-2026:41895" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">71cbcc52a2e863575df4bccafe8568fc2d3c0701b7e9e5b515434b18be8d247a</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.119-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">93f2c1b0137cca2aa94c0f26905a8368954b0b425e1c51447340b287c53b846c</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c426ce940c53a8ce2ac07c4ce45a050fa9f064aaad779c82e91785b3cf567f17</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.119-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bcb3575cf526b09a36bd4a0db577e5d14c551d37ed4991cb57877dfae2d12b74</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.119-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3e4a655fa830f53f4ffb7fbc557bb5c5b9c9b211df222d8dab48c60165967149</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e9065ec1e4d82789fd405d4664ea61cba3c4301e574f3b4e811bc67f0300626a</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.119-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">540866b8fa88c4f3258d5e9316c6d240c6a201add94ccecf26563a784b8c9bc0</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ecbb7e8c6bd758ddbf762ecaa72f0ee04e444915771c489ae80ed2e914ed0335</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bf3da998d8eb4e5c940d10c417912a7a5bac7cef56dc989a55e8de505210eac5</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8b7280bb4f034f710ced42b5bbe4de9fe00665ce027f7c43a758fca4e2fb5d82</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">82c1d34b5db08a000dc4a912282390275e1a964fc167c4b51b4d354e57d73719</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">87428a703032243c4be723853370301f4a378a6aa7dfd76a8491ba5256ec5339</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.18-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a370744a2f0f421e4759da04a8339de76b9285caa0e84f31f8dab7d9abdc7c54</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:41897</id>
    <title>Important: .NET 10.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-23 06:07:38" />
    <updated date="2026-08-06 06:10:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:41897 (https://access.redhat.com/errata/RHSA-2026:41897), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

* dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

* ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

* ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

* ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

* dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

* dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

* dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

* dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

* dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

* dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

* dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

* dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

* .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

* dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

* Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [rhel-10.2.z] (JIRA:Rocky Linux-192463)

* dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192326)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500509" id="2500509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500565" id="2500565" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500563" id="2500563" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500502" id="2500502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500562" id="2500562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500589" id="2500589" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500587" id="2500587" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500189" id="2500189" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500109" id="2500109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500581" id="2500581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500556" id="2500556" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500593" id="2500593" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500577" id="2500577" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499217" id="2499217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500515" id="2500515" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500492" id="2500492" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:41897" id="RLSA-2026:41897" type="self" title="RLSA-2026:41897" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:41897" id="RHSA-2026:41897" type="vendor" title="Red Hat RHSA-2026:41897" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.10-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2d39990223d416299c911217380619b4d30e4d92e31cf5071ef3b6aec498ecc0</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.10-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c3fc1cb00049e4a822248ba0cca3eaeff5c1022db7316ea3c2d85e15a8ec6d41</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.10-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f8e2730aa19aca98760bae3a0279d0b97b1b0ab845a3cd3fe6de4a9c5b2cdf5f</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="x86_64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.10-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">30216143c69e19d35a1ffd5532eadabfb50a6242356af5d4f9b6f4cb56a10ee3</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="x86_64" epoch="0" version="10.0.110" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.110-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d6ea2f45e342cee02959bf4a2c01525b73f472b48eba74831819c4709e53288f</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" arch="x86_64" epoch="0" version="10.0.110" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.110-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">978ea73708dd314ea285937590d707adbffe1183543e3a4ab035577ce6cf683b</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="x86_64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.10-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">adb2bd66d5c099bd151d2d27c8b3e1959eb8aab6c869b8fb9ff0b23af7e11728</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="x86_64" epoch="0" version="10.0.110" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.110-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">022fed8512ed2f97b2bb0335ec6697a3e69e6c3a77dae50aa4dc2eddd5cd74c4</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.10-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8425f5220137ba051a2f7d2b2bbab8c7d9aa16ba4a6f47e25a4104b17576ef7b</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="x86_64" epoch="0" version="10.0.110" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.110-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">878b9a2264784dbb7582623cb220e8d08136c39dc7bcdceced3a85d8681a435b</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="x86_64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.10-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e61490f9f76f5e4514334a2f9ff32c3b09bb80dbca0c9aa00a94cee6e8419698</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.10-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2589d056a673bd041a2d8185ee0543fb635588de87e12562de4a1a02ebf182cd</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="x86_64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.10-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8b78eac293a2989b014a57f08ff6630c185129794f7557bdc587e4b137c051a3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:43400</id>
    <title>Important: dogtag-pki security update</title>
    <issued date="2026-07-23 06:07:38" />
    <updated date="2026-08-06 06:10:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:43400 (https://access.redhat.com/errata/RHSA-2026:43400), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dogtag-pki.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments.  IdM PKI consists of the following components: 
  * Certificate Authority (CA)
  * Key Recovery Authority (KRA)
  * Online Certificate Status Protocol (OCSP) Manager
  * Token Key Service (TKS)
  * Token Processing Service (TPS)
  * Automatic Certificate Management Environment (ACME) Responder
  * Enrollment over Secure Transport (EST) Responder

Security Fix(es):

* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)

* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54512" id="CVE-2026-54512" type="cve" title="CVE-2026-54512" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54513" id="CVE-2026-54513" type="cve" title="CVE-2026-54513" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2492015" id="2492015" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2492010" id="2492010" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:43400" id="RLSA-2026:43400" type="self" title="RLSA-2026:43400" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:43400" id="RHSA-2026:43400" type="vendor" title="Red Hat RHSA-2026:43400" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="idm-pki-server" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-server-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">98b781b5ea8bb853d20563d38eb2bfc67e7151462ad61858ee14a6f7eea3368b</sum>
        </package>
        <package name="idm-pki-ca" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-ca-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">8f32674a96a6f47411d51b52a365a4260cb026923f042dfe6cb12c98a01b2a4d</sum>
        </package>
        <package name="idm-pki-base" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-base-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">8e8f843ddc2bfa4ac5bec288a009b178cfc44779ed69cc1db066d9060f497b4f</sum>
        </package>
        <package name="idm-pki-kra" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-kra-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">d45f57cca9aeced7958c36c9c2b9a2ec068fbab0949f59d9607348b15fa849e5</sum>
        </package>
        <package name="python3-idm-pki" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>python3-idm-pki-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">c6d0f5541588fc4603e0b2bbc5fd02f00c4a302f7a0af77ec3846b0d3161ce16</sum>
        </package>
        <package name="idm-pki-acme" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-acme-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">41dc615c14ce67d13c3be27d9c24a7100f843ed26c8fec95ce234fdeb91b31e4</sum>
        </package>
        <package name="idm-pki-tools" arch="x86_64" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-tools-11.9.0-4.el10_2.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">e1facf2550ae5dd5112e4a1d2f3bf67c39885ce4f5edbfe50a74115c6d842ae5</sum>
        </package>
        <package name="idm-pki-java" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-java-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">656c272e766b97cf08111b999807872bbb6e897bf9a83897f73e95355f4bb6f9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:48032</id>
    <title>Important: nodejs-nodemon security update</title>
    <issued date="2026-07-30 12:06:30" />
    <updated date="2026-08-13 12:10:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:48032 (https://access.redhat.com/errata/RHSA-2026:48032), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs-nodemon.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Simple monitor script for use during development of a node.js app.  For use during development of a node.js based application.  nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application.  nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.

Security Fix(es):

* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13149" id="CVE-2026-13149" type="cve" title="CVE-2026-13149" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2494813" id="2494813" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:48032" id="RLSA-2026:48032" type="self" title="RLSA-2026:48032" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:48032" id="RHSA-2026:48032" type="vendor" title="Red Hat RHSA-2026:48032" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs-nodemon" arch="noarch" epoch="0" version="3.1.14" release="2.el10_2" src="nodejs-nodemon-3.1.14-2.el10_2.src.rpm">
          <filename>nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">de218912151c602edad0f670cb0d3db303b6113621fcf5796d956632136dc620</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:48034</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-07-31 18:06:02" />
    <updated date="2026-08-14 18:09:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:48034 (https://access.redhat.com/errata/RHSA-2026:48034), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13149" id="CVE-2026-13149" type="cve" title="CVE-2026-13149" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59873" id="CVE-2026-59873" type="cve" title="CVE-2026-59873" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59874" id="CVE-2026-59874" type="cve" title="CVE-2026-59874" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498116" id="2498116" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498120" id="2498120" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2494813" id="2494813" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:48034" id="RLSA-2026:48034" type="self" title="RLSA-2026:48034" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:48034" id="RHSA-2026:48034" type="vendor" title="Red Hat RHSA-2026:48034" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.18.0" release="3.el10_2" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-docs-24.18.0-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">6da935ed83bfb56e336b8563921f623063c5547d37d53b25654f146d3ef4b5c0</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.16.0" release="1.24.18.0.3.el10_2" src="nodejs24-24.18.0-3.el10_2.src.rpm">
          <filename>nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm</filename>
          <sum type="sha256">b9d24539486c5c362af5d538ab361dde3b32d8d3b04b02740ecf628b9de9e554</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:48033</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-07-31 18:06:02" />
    <updated date="2026-08-14 18:09:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:48033 (https://access.redhat.com/errata/RHSA-2026:48033), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13149" id="CVE-2026-13149" type="cve" title="CVE-2026-13149" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59873" id="CVE-2026-59873" type="cve" title="CVE-2026-59873" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59874" id="CVE-2026-59874" type="cve" title="CVE-2026-59874" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498116" id="2498116" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498120" id="2498120" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2494813" id="2494813" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:48033" id="RLSA-2026:48033" type="self" title="RLSA-2026:48033" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:48033" id="RHSA-2026:48033" type="vendor" title="Red Hat RHSA-2026:48033" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.23.1" release="4.el10_2" src="nodejs22-22.23.1-4.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-4.el10_2.noarch.rpm</filename>
          <sum type="sha256">11b67f4e4f44b92b255d1e37aecccf3b6932fd4043a4d61a5e462b676ce9643f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:48585</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-07-31 18:06:02" />
    <updated date="2026-08-14 18:09:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:48585 (https://access.redhat.com/errata/RHSA-2026:48585), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59939" id="CVE-2026-59939" type="cve" title="CVE-2026-59939" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498212" id="2498212" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:48585" id="RLSA-2026:48585" type="self" title="RLSA-2026:48585" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:48585" id="RHSA-2026:48585" type="vendor" title="Red Hat RHSA-2026:48585" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-wti-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">05f5ac08c3f21973e1bc6d0954ab5a29cbc9755b7a3d045103df5f68d0f0231a</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">81bfa8fbe3f60ebc84915f32a5c29f0a9865458eb279debec5ff8e311a6f3e7b</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">c189dd30f6bdf230ba7572c39d57d36d7ed5729354f08c3ddda842c864eb80d7</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">1ec12a9ddc2146285a5fc345b9a8c4de1846a6ea239f6a62666ff613735276e1</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">ffdc63429aa521264c86978e209e15d3f2dce8ea70774fae08da8d16c82265fe</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">887674a34578e496bfd582117d518043f00b9ed10eac15c2b764206b87843a0c</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">f467ef98694e8fd5c415eb0a2e94656c4a95fb2b26ae963b01124d8e31309067</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">e6e558384ad15ff101b5a7ff5dfc1fc2e269bcfa11d4336fef222f4d7e669c8f</sum>
        </package>
        <package name="fence-agents-nutanix-ahv" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-nutanix-ahv-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">8c31470e36b97d09fdcdf87c9fb89e2fb53cea376cb45327671ef3bbc0060a77</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-lpar-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">2a1ca79f90f6a810be1d2d60f32fbbfe93f63be40b68170d09edb8e620dbfc05</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-rsb-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">f01dd80eabca6ef2021c06e4dd74de87c4c12626147e5840a952ad639a545490</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">bd4cd89002023975b3e1d48ded768401e07db295ae1e6f0e8c304dc2dfb0d300</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">093a85a7af0982f2d6cd6bb8f7e60f7796d69cf053b79fdc3565e3f2181af975</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">0f92ccb996f58765d2eb9ed7a6855d407e368e3914cb2b76a761cc6d36802100</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">37f5eb2fb70419fede41ab7e521697797f9b94aa2baa43de491431d4f187b904</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">d016c4880a2886145eefb1f39ba538c65c159898a2df8ffee2ada393a0875c62</sum>
        </package>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">785e1d15ef3d75b2816f553246523d4d8db0f97dc4bcfa6d89b11eb4519000b6</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">dcf8a4e12fded2f6b7ea41918f4290995cd21b44c5d7c4f9fb492e015e5d49e0</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-eps-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">7d46ddfc5502966c2f7e5575f87898bc4ac7e3d653c84039909b38ee6ba39d47</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">9de9efea407a133c83670c0cd43be9cd30aca9096d869846a7882fd3a9f7527b</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-rsa-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">3a685fb042203cba4f8f3d8e83a46b81375b1ead8e61f883e5686df3c53bfa4b</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-apc-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">ee9b94ae3f10a84088e033510095e34469fc691c9dfc74755b38f7540074d16e</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-scsi-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">fdbc072133a930085d4d8a0b87d48fdbb5b1b763c133c7246754a6274dcc7afa</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-emerson-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">ffa597dcbbafe049e98a6bde3de767238c542c59ecac75f57dfd181277a27a38</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">539e426fefc3801ca3e0b3d618af10bc7cc50d38615775d45fac811ee3125f40</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">e71e28435f2322d192f66730a4c63c3db9ab8475a2179fcd6bd3f72b368c1a89</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-sbd-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">23187adbcb3dc7cfc6ee4981baf48b7d14995a10a36b22e4ab07dc24219f7ac6</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">8853e4308f723ed0bccf174bf5efc2d53842a8aee350d28d0a114580cf2381b8</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">9fe92feae99f1e47c321781875fc7adc7c149763bba9c770e4d93e2c32e1887b</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">e1a88b605045ee3a7f13af69d486e6fe4ae764a7039246c8ac60473faba6e267</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">8cf7840bb0ac47a166eaff38274b1fa07a3aaf03c39d42a1bdaf6b7826be14fb</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-brocade-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">4e4ea13fe04063049aeac2404e3b82827e00a2583dfa413cf124fb3c43260dc4</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-virsh-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">04d915d14e3dc1f68b30c77e4503a3d7bae59e11230d9cba46ca8ad5ad4890eb</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">ecda603c11806861bda6b27153f09b9325fbc7a7537855d8b64446f7e1e49d7f</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-mpath-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">18c590a346e02019583d073c7374b36e414904016a8d9ece4c4db4b1532dc703</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.5" src="fence-agents-4.16.0-21.el10_2.5.src.rpm">
          <filename>fence-agents-drac5-4.16.0-21.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">094091bbc1ccd444f45ea74f227c3d89bf9765a3d178119e3e89b42b5b973cc8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:49523</id>
    <title>Important: perl-Archive-Tar security update</title>
    <issued date="2026-08-04 12:06:38" />
    <updated date="2026-08-18 12:10:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:49523 (https://access.redhat.com/errata/RHSA-2026:49523), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-Archive-Tar.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Archive::Tar provides an object oriented mechanism for handling tar files.  It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation.  If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.

Security Fix(es):

* perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size (CVE-2026-9538)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538" id="CVE-2026-9538" type="cve" title="CVE-2026-9538" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2481315" id="2481315" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:49523" id="RLSA-2026:49523" type="self" title="RLSA-2026:49523" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:49523" id="RHSA-2026:49523" type="vendor" title="Red Hat RHSA-2026:49523" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl-Archive-Tar" arch="noarch" epoch="0" version="3.02" release="512.el10_2.2" src="perl-Archive-Tar-3.02-512.el10_2.2.src.rpm">
          <filename>perl-Archive-Tar-3.02-512.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">a15831e6edc179598130f3924c6886f59e8f19e1801fe393a9229b8fe07d38b2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:49621</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-08-06 00:07:16" />
    <updated date="2026-08-20 00:10:21" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:49621 (https://access.redhat.com/errata/RHSA-2026:49621), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)

* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)

* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)

* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)

* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)

* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

* thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14899" id="CVE-2026-14899" type="cve" title="CVE-2026-14899" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15718" id="CVE-2026-15718" type="cve" title="CVE-2026-15718" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15719" id="CVE-2026-15719" type="cve" title="CVE-2026-15719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16349" id="CVE-2026-16349" type="cve" title="CVE-2026-16349" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16350" id="CVE-2026-16350" type="cve" title="CVE-2026-16350" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16351" id="CVE-2026-16351" type="cve" title="CVE-2026-16351" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16352" id="CVE-2026-16352" type="cve" title="CVE-2026-16352" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16353" id="CVE-2026-16353" type="cve" title="CVE-2026-16353" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16354" id="CVE-2026-16354" type="cve" title="CVE-2026-16354" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16355" id="CVE-2026-16355" type="cve" title="CVE-2026-16355" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16356" id="CVE-2026-16356" type="cve" title="CVE-2026-16356" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16357" id="CVE-2026-16357" type="cve" title="CVE-2026-16357" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16358" id="CVE-2026-16358" type="cve" title="CVE-2026-16358" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16359" id="CVE-2026-16359" type="cve" title="CVE-2026-16359" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16360" id="CVE-2026-16360" type="cve" title="CVE-2026-16360" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16361" id="CVE-2026-16361" type="cve" title="CVE-2026-16361" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16362" id="CVE-2026-16362" type="cve" title="CVE-2026-16362" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16363" id="CVE-2026-16363" type="cve" title="CVE-2026-16363" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16368" id="CVE-2026-16368" type="cve" title="CVE-2026-16368" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16369" id="CVE-2026-16369" type="cve" title="CVE-2026-16369" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16371" id="CVE-2026-16371" type="cve" title="CVE-2026-16371" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16374" id="CVE-2026-16374" type="cve" title="CVE-2026-16374" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16375" id="CVE-2026-16375" type="cve" title="CVE-2026-16375" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16377" id="CVE-2026-16377" type="cve" title="CVE-2026-16377" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16379" id="CVE-2026-16379" type="cve" title="CVE-2026-16379" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16381" id="CVE-2026-16381" type="cve" title="CVE-2026-16381" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16383" id="CVE-2026-16383" type="cve" title="CVE-2026-16383" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16387" id="CVE-2026-16387" type="cve" title="CVE-2026-16387" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16390" id="CVE-2026-16390" type="cve" title="CVE-2026-16390" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16391" id="CVE-2026-16391" type="cve" title="CVE-2026-16391" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16396" id="CVE-2026-16396" type="cve" title="CVE-2026-16396" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16405" id="CVE-2026-16405" type="cve" title="CVE-2026-16405" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16412" id="CVE-2026-16412" type="cve" title="CVE-2026-16412" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503432" id="2503432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503501" id="2503501" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503473" id="2503473" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503472" id="2503472" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503456" id="2503456" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503423" id="2503423" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503425" id="2503425" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503497" id="2503497" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503430" id="2503430" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503451" id="2503451" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503440" id="2503440" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503463" id="2503463" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503517" id="2503517" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503489" id="2503489" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503505" id="2503505" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503439" id="2503439" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503513" id="2503513" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503444" id="2503444" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499974" id="2499974" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503434" id="2503434" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503454" id="2503454" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503420" id="2503420" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503416" id="2503416" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499973" id="2499973" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503527" id="2503527" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503521" id="2503521" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503485" id="2503485" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503491" id="2503491" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503512" id="2503512" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503500" id="2503500" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503498" id="2503498" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503415" id="2503415" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2506217" id="2506217" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:49621" id="RLSA-2026:49621" type="self" title="RLSA-2026:49621" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:49621" id="RHSA-2026:49621" type="vendor" title="Red Hat RHSA-2026:49621" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.13.0" release="1.el10_2" src="thunderbird-140.13.0-1.el10_2.src.rpm">
          <filename>thunderbird-140.13.0-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">45b901de0f4fca67ccbd7225e4a1f0875d96a4f797dcb93faab18f0ffb050b24</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:49836</id>
    <title>Important: ldns security update</title>
    <issued date="2026-08-06 00:07:16" />
    <updated date="2026-08-20 00:10:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:49836 (https://access.redhat.com/errata/RHSA-2026:49836), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ldns.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets.

Security Fix(es):

* ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10846" id="CVE-2026-10846" type="cve" title="CVE-2026-10846" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487437" id="2487437" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:49836" id="RLSA-2026:49836" type="self" title="RLSA-2026:49836" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:49836" id="RHSA-2026:49836" type="vendor" title="Red Hat RHSA-2026:49836" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ldns" arch="x86_64" epoch="0" version="1.8.3" release="18.el10_2.1" src="ldns-1.8.3-18.el10_2.1.src.rpm">
          <filename>ldns-1.8.3-18.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">0c5e02c56d094fd6ed178f65709f3f820a9e25f1f7541660342be7e964dea842</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:50747</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-08-06 00:07:16" />
    <updated date="2026-08-20 00:10:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:50747 (https://access.redhat.com/errata/RHSA-2026:50747), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding (CVE-2026-55827)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55827" id="CVE-2026-55827" type="cve" title="CVE-2026-55827" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499159" id="2499159" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:50747" id="RLSA-2026:50747" type="self" title="RLSA-2026:50747" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:50747" id="RHSA-2026:50747" type="vendor" title="Red Hat RHSA-2026:50747" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.7" src="freerdp-3.10.3-12.el10_2.7.src.rpm">
          <filename>freerdp-libs-3.10.3-12.el10_2.7.x86_64.rpm</filename>
          <sum type="sha256">5ce1334accd6148bebe40e6130c24d07deffa0e3cb3126bf77d7087c8678c734</sum>
        </package>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.7" src="freerdp-3.10.3-12.el10_2.7.src.rpm">
          <filename>freerdp-3.10.3-12.el10_2.7.x86_64.rpm</filename>
          <sum type="sha256">851a35ebcbb009c9ef0c4f72369fa741b2ded85ba7a06a381d663efa11a71f2b</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.7" src="freerdp-3.10.3-12.el10_2.7.src.rpm">
          <filename>libwinpr-3.10.3-12.el10_2.7.x86_64.rpm</filename>
          <sum type="sha256">5ba32456e6a003d51331b895e2961cc0f6d9952da79aabf2d4a865e535978092</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:51075</id>
    <title>Important: gpsd security update</title>
    <issued date="2026-08-07 12:07:56" />
    <updated date="2026-08-21 12:10:43" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:51075 (https://access.redhat.com/errata/RHSA-2026:51075), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gpsd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.  The Rocky Enterprise Software Foundation support for this package is limited. See https://access.redhat.com/support/policy/gpsd-support for more details.

Security Fix(es):

* gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution (CVE-2026-58459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58459" id="CVE-2026-58459" type="cve" title="CVE-2026-58459" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498575" id="2498575" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:51075" id="RLSA-2026:51075" type="self" title="RLSA-2026:51075" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:51075" id="RHSA-2026:51075" type="vendor" title="Red Hat RHSA-2026:51075" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gpsd-clients" arch="x86_64" epoch="1" version="3.26.1" release="3.el10_2.1" src="gpsd-3.26.1-3.el10_2.1.src.rpm">
          <filename>gpsd-clients-3.26.1-3.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">f4e8d9b53818a9a3c29ba5c434845c8f44f7db2ec40a751a7e5ce1c3ad98ca33</sum>
        </package>
        <package name="python3-gpsd" arch="x86_64" epoch="1" version="3.26.1" release="3.el10_2.1" src="gpsd-3.26.1-3.el10_2.1.src.rpm">
          <filename>python3-gpsd-3.26.1-3.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">771108c6247b17750991ec6bc531b0b4a947b7e680257e7c1313fa9e231aa85c</sum>
        </package>
        <package name="gpsd" arch="x86_64" epoch="1" version="3.26.1" release="3.el10_2.1" src="gpsd-3.26.1-3.el10_2.1.src.rpm">
          <filename>gpsd-3.26.1-3.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">b49eafe49626f673ea84b9eed60eff7468c85613ca527d5ff5de63de8ca68fe5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:53435</id>
    <title>Important: udisks2 security update</title>
    <issued date="2026-08-12 12:08:21" />
    <updated date="2026-08-26 06:10:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:53435 (https://access.redhat.com/errata/RHSA-2026:53435), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for udisks2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.

Security Fix(es):

* udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7867" id="CVE-2026-7867" type="cve" title="CVE-2026-7867" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466747" id="2466747" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:53435" id="RLSA-2026:53435" type="self" title="RLSA-2026:53435" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:53435" id="RHSA-2026:53435" type="vendor" title="Red Hat RHSA-2026:53435" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libudisks2" arch="x86_64" epoch="0" version="2.11.0" release="2.el10_2.1" src="udisks2-2.11.0-2.el10_2.1.src.rpm">
          <filename>libudisks2-2.11.0-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">322725191f39282032de59f7c64b32eb7f56d65ec7d0b4953bce6c2497e64739</sum>
        </package>
        <package name="udisks2-iscsi" arch="x86_64" epoch="0" version="2.11.0" release="2.el10_2.1" src="udisks2-2.11.0-2.el10_2.1.src.rpm">
          <filename>udisks2-iscsi-2.11.0-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">790c111e08099b5e267bd157630a55cd4e222ac3a258111f61fa7fa48f975d1c</sum>
        </package>
        <package name="udisks2-lvm2" arch="x86_64" epoch="0" version="2.11.0" release="2.el10_2.1" src="udisks2-2.11.0-2.el10_2.1.src.rpm">
          <filename>udisks2-lvm2-2.11.0-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">1fac0ce1abfbea17f1d11c3ec0d4d83fee0e3c4a8a6d05c25a473c67c35fff9f</sum>
        </package>
        <package name="udisks2" arch="x86_64" epoch="0" version="2.11.0" release="2.el10_2.1" src="udisks2-2.11.0-2.el10_2.1.src.rpm">
          <filename>udisks2-2.11.0-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">d2874764c5826f39d76e50d302fa314b60e297b3f0209c69b9009bc6d6a38e60</sum>
        </package>
        <package name="udisks2-lsm" arch="x86_64" epoch="0" version="2.11.0" release="2.el10_2.1" src="udisks2-2.11.0-2.el10_2.1.src.rpm">
          <filename>udisks2-lsm-2.11.0-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">dc0863eea18a62e625aee6d2073badbc00d15557e8251033f3d7a9383ec2578f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:53451</id>
    <title>Moderate: gstreamer1-plugins-good security update</title>
    <issued date="2026-08-12 12:08:21" />
    <updated date="2026-08-26 06:10:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:53451 (https://access.redhat.com/errata/RHSA-2026:53451), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gstreamer1-plugins-good.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

* gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18649" id="CVE-2026-18649" type="cve" title="CVE-2026-18649" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2510614" id="2510614" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:53451" id="RLSA-2026:53451" type="self" title="RLSA-2026:53451" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:53451" id="RHSA-2026:53451" type="vendor" title="Red Hat RHSA-2026:53451" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-good" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.3" src="gstreamer1-plugins-good-1.26.7-2.el10_2.3.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">1aecebace708ef590ad03ecab0c69e6e191863ae96b201f8b96de54ba8dd0d32</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.3" src="gstreamer1-plugins-good-1.26.7-2.el10_2.3.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">cba0733aa4c9bbdee6851df1a2a00ae022254bda919bfaa10722d65b0f95c114</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:54178</id>
    <title>Moderate: grafana security, bug fix, and enhancement update</title>
    <issued date="2026-08-13 12:07:38" />
    <updated date="2026-08-26 06:10:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:54178 (https://access.redhat.com/errata/RHSA-2026:54178), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

* grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

* grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33376" id="CVE-2026-33376" type="cve" title="CVE-2026-33376" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33377" id="CVE-2026-33377" type="cve" title="CVE-2026-33377" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33382" id="CVE-2026-33382" type="cve" title="CVE-2026-33382" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8609" id="CVE-2026-8609" type="cve" title="CVE-2026-8609" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477262" id="2477262" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499061" id="2499061" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477246" id="2477246" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499062" id="2499062" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:54178" id="RLSA-2026:54178" type="self" title="RLSA-2026:54178" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:54178" id="RHSA-2026:54178" type="vendor" title="Red Hat RHSA-2026:54178" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="28.el10_2.4" src="grafana-10.2.6-28.el10_2.4.src.rpm">
          <filename>grafana-10.2.6-28.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">b30a27742641f4196a36644aea42f29005faf73e98ff40168739c22b3641ed85</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="28.el10_2.4" src="grafana-10.2.6-28.el10_2.4.src.rpm">
          <filename>grafana-selinux-10.2.6-28.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">33007450991ee611ad1dc61b0f9b852adebbbe91c61e07f08f7a6748d824b648</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:54486</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-08-13 18:06:29" />
    <updated date="2026-08-26 06:10:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:54486 (https://access.redhat.com/errata/RHSA-2026:54486), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620)

* FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621)

* FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)

* FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)

* FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)

* FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64620" id="CVE-2026-64620" type="cve" title="CVE-2026-64620" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64621" id="CVE-2026-64621" type="cve" title="CVE-2026-64621" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64624" id="CVE-2026-64624" type="cve" title="CVE-2026-64624" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-67289" id="CVE-2026-67289" type="cve" title="CVE-2026-67289" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-67299" id="CVE-2026-67299" type="cve" title="CVE-2026-67299" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68580" id="CVE-2026-68580" type="cve" title="CVE-2026-68580" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2509985" id="2509985" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2502752" id="2502752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2510004" id="2510004" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503096" id="2503096" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2502766" id="2502766" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2510125" id="2510125" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:54486" id="RLSA-2026:54486" type="self" title="RLSA-2026:54486" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:54486" id="RHSA-2026:54486" type="vendor" title="Red Hat RHSA-2026:54486" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.8" src="freerdp-3.10.3-12.el10_2.8.src.rpm">
          <filename>libwinpr-3.10.3-12.el10_2.8.x86_64.rpm</filename>
          <sum type="sha256">944653fe74757c4deeafde28efb16b1125788b4f88854f83f9a5fbaa2a24e9b9</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.8" src="freerdp-3.10.3-12.el10_2.8.src.rpm">
          <filename>freerdp-libs-3.10.3-12.el10_2.8.x86_64.rpm</filename>
          <sum type="sha256">fe8eeb67bec3933e81d724bbe57e29e74d26eefe3c42a328724fd8fd63ede9cc</sum>
        </package>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="12.el10_2.8" src="freerdp-3.10.3-12.el10_2.8.src.rpm">
          <filename>freerdp-3.10.3-12.el10_2.8.x86_64.rpm</filename>
          <sum type="sha256">0c2915c044dbacc635148105cbbcb750491c9328cd85da5ab3681eaf383e1975</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:48170</id>
    <title>Low: php security, bug fix, and enhancement update</title>
    <issued date="2026-08-14 00:06:45" />
    <updated date="2026-08-26 06:10:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:48170 (https://access.redhat.com/errata/RHSA-2026:48170), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>An update is available for php.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:Rocky Linux-192618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14355" id="CVE-2026-14355" type="cve" title="CVE-2026-14355" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2496971" id="2496971" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:48170" id="RLSA-2026:48170" type="self" title="RLSA-2026:48170" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:48170" id="RHSA-2026:48170" type="vendor" title="Red Hat RHSA-2026:48170" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="php-ldap" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-ldap-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5f37dc72818595f993a61e53b1cb31af3741dcbd5e3fcf7a2619cf72cf97dbf6</sum>
        </package>
        <package name="php-cli" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-cli-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9b4aa6f863d13e66b1ed80bc16bbf502717953b030fd08b4b53d31a055b15180</sum>
        </package>
        <package name="php-soap" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-soap-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9203e0858e09b855987150064ce39f9415e98483eb7ebdf27af4f76713cb782e</sum>
        </package>
        <package name="php-bcmath" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-bcmath-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">90cbb366c0f756db94b00b079bd1d7dddb56fbb3a12acf9477674f5ee12def31</sum>
        </package>
        <package name="php-mysqlnd" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-mysqlnd-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4122b58a0bbb728b6cdd25577aa0ac3cbb803f5b41bc9babaa51aee8effe5718</sum>
        </package>
        <package name="php-process" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-process-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">acae5a14d19a1c940669472f848b4470fab279156727c7e8a7cb21a6c3168041</sum>
        </package>
        <package name="php-ffi" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-ffi-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b15ea01e4b7d0e8ad613a88a07f06431d118441028baab40abccef65ef020613</sum>
        </package>
        <package name="php-xml" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-xml-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">25efee3ec75957151773786fb7776e3ea961a1444648ae582da8c2378a6d0ac2</sum>
        </package>
        <package name="php-odbc" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-odbc-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ca042437759065ab84da9571ada6d1ddd7770da9360c4f4282105775f3b8be77</sum>
        </package>
        <package name="php-dba" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-dba-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8d9473503c519151b7660f2c5db91e37508a5f1eabc1a6aa2efe4d413928a93c</sum>
        </package>
        <package name="php-fpm" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-fpm-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f350e8fc61ea9e3932e8475ddf74d5a6886bc59a097e9aa8cc9a2af4843d3747</sum>
        </package>
        <package name="php-devel" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-devel-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">33ff36289c7677fc923649d49805a3eb309d8f4f1ba5d36a5accbe0883f29a80</sum>
        </package>
        <package name="php-opcache" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-opcache-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">808857e6f084038abb2265400fa5bcfd335c18eb70bebc3f158cffdf952bf342</sum>
        </package>
        <package name="php-gd" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-gd-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b5b8544ebcfe216fe7efa11e0e0bdc878ed6a05a2353c6450fcbdf188eea5a80</sum>
        </package>
        <package name="php" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1b8dc67661aba9c103cd3aef638cfab6958f8f98a26fa3f7c3f546d991ca1fd3</sum>
        </package>
        <package name="php-embedded" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-embedded-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">44029a89f1fd9e35d983fe86255fb1b33e80741d846ab6037ca46add41cc6671</sum>
        </package>
        <package name="php-enchant" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-enchant-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d043b3ad14f8221d870ef9d07b286961987792a09856b313a057dc0b9758cff6</sum>
        </package>
        <package name="php-mbstring" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-mbstring-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1b3f145fa7629bf81249fabbe51a3b4b6ca5ddcba266ae35822c500150870b25</sum>
        </package>
        <package name="php-intl" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-intl-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8bc62d5d87a9898d51841f5e6286cc88f7cc215f37133e43bbfbbdeba616a720</sum>
        </package>
        <package name="php-dbg" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-dbg-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0daefa7734b847e9aa5b963833202efa8ba53992bd6578e4f221d643bc7005c6</sum>
        </package>
        <package name="php-common" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-common-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8029d6140708079a31a697d2aeadf96aa8e01e9da487df124e897ade7bbdaff6</sum>
        </package>
        <package name="php-pdo" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-pdo-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c0d5690db88ccf792a0f4cb719a2d1e3822e7b2dd3fedaee01e2a444a8f340de</sum>
        </package>
        <package name="php-gmp" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-gmp-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a3e215d17058206391067523272f242c5cc34751e2b2cb0efd04d38598372128</sum>
        </package>
        <package name="php-pgsql" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-pgsql-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2f596a0b091283f95339f8f8f205ae806b9f01a5395bd1bc48b1c47cbf53e93c</sum>
        </package>
        <package name="php-snmp" arch="x86_64" epoch="0" version="8.3.32" release="1.el10_2" src="php-8.3.32-1.el10_2.src.rpm">
          <filename>php-snmp-8.3.32-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6a4aed0adfad2ee3f041bb37bc94cc8e981e7312be37d2a43eb2fc35012b1e71</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:49914</id>
    <title>Low: php8.4 security, bug fix, and enhancement update</title>
    <issued date="2026-08-14 00:06:45" />
    <updated date="2026-08-26 06:10:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:49914 (https://access.redhat.com/errata/RHSA-2026:49914), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>An update is available for php8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

* php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.4.23 for CVE-2026-14355 in 10.2.z (JIRA:Rocky Linux-192616)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14355" id="CVE-2026-14355" type="cve" title="CVE-2026-14355" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2496971" id="2496971" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:49914" id="RLSA-2026:49914" type="self" title="RLSA-2026:49914" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:49914" id="RHSA-2026:49914" type="vendor" title="Red Hat RHSA-2026:49914" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="php8.4-xml" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-xml-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9cfc1ce1667b49a45e4f2ef009cbad2e9094a0ce308d27026881731a952fac40</sum>
        </package>
        <package name="php8.4-common" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-common-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3168fcd5715a87796555064ef5d8f1679568334d962aac438f39da9fe3bb5873</sum>
        </package>
        <package name="php8.4-pgsql" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-pgsql-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6895809e8eb69d081bcbe69ae2983155ca306702f91085e90fccd2d24a13b5f6</sum>
        </package>
        <package name="php8.4-odbc" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-odbc-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5b275a0271e9ad9e60b0fa419a8cc4866eb70a7dfefbc8069485f9e8ad03ad88</sum>
        </package>
        <package name="php8.4-gmp" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-gmp-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">50feb596e676d26f6d41c872701d17eca8ecc006341ad393050accdfb30b5b96</sum>
        </package>
        <package name="php8.4-ffi" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-ffi-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1cba47ffee38e6aa266120a2fc8316c228ade9d914de63a0d9705431f8a60b59</sum>
        </package>
        <package name="php8.4-mysqlnd" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-mysqlnd-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e0ac087fd3dfde72d4463328852f216dc4edfe50e22f6508020274097c1cbdda</sum>
        </package>
        <package name="php8.4-opcache" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-opcache-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">89f5f4d4e5b9d5832bb4f7edd2de2451eae22f6a1dca8e45daf206b93427cf9c</sum>
        </package>
        <package name="php8.4-enchant" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-enchant-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a382ae0347b6368412a7b392fc1595045407ec51073f3d141a209a5bdcbde22c</sum>
        </package>
        <package name="php8.4" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bc5067ed566bdc706d789898df7f2cdbc5f26b8d839a85496a74940ffcc59a1d</sum>
        </package>
        <package name="php8.4-snmp" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-snmp-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9fb5c6892c8a35573b6d2cc006dbaa1415b2b3868d3191d61fb0c94c6d8f1734</sum>
        </package>
        <package name="php8.4-soap" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-soap-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">75206344b8bd73142d16c6d4a420eac133456460927595344db09fe6b2deac03</sum>
        </package>
        <package name="php8.4-process" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-process-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4678a873cad17f709e2070bd7e547427192a102f198a889e9e885a4397ec424d</sum>
        </package>
        <package name="php8.4-intl" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-intl-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">691c04379826613039d0c6206332049c8d77fbf9a0a8859269b042f9ce385353</sum>
        </package>
        <package name="php8.4-gd" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-gd-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">38bd96c928ef4a7fe44d5dec3201fb2b22ae35f976df99d6a5b23dac39bc1d9b</sum>
        </package>
        <package name="php8.4-dba" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-dba-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9e62a8b80dbed24ea8fdaf45fe5d6c779feae1ff0da8fb868a8d97dc67511f19</sum>
        </package>
        <package name="php8.4-bcmath" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-bcmath-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ecdfeff1da457c7db6f7f166607e81cd329d1091030f29ecfd7898c649881f82</sum>
        </package>
        <package name="php8.4-mbstring" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-mbstring-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e5c4d56aa39bbb052f7eee40a7154701ab698c926c179de938b87927ea1b0a7b</sum>
        </package>
        <package name="php8.4-fpm" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-fpm-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6045c9a60ad635f57b03f95dc8f2e028d97135abcbe77aaf398dbc01057a625d</sum>
        </package>
        <package name="php8.4-dbg" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-dbg-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">47de88f28c2d5b7907977b413e44101e6d1fc669035d03afded7f644d3cb8f61</sum>
        </package>
        <package name="php8.4-ldap" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-ldap-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">97563100c72f4201100dd5ad0ac9eaa7de05248602e5ff9976e5a861f714a22e</sum>
        </package>
        <package name="php8.4-embedded" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-embedded-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">466f21fac2767ac4f031059ca3c4beb46d88f8c37d47f66cb1bf237f96e82403</sum>
        </package>
        <package name="php8.4-devel" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-devel-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">80ecbedc907345df1d1d19b2c142e1a2e8be83e738cc5111531020ea3770cafc</sum>
        </package>
        <package name="php8.4-pdo" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-pdo-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">56fc4e7c05fb56a07a1e1e6c445768fe9c1cae2f196452f3f432275e62e26da6</sum>
        </package>
        <package name="php8.4-cli" arch="x86_64" epoch="0" version="8.4.23" release="1.el10_2" src="php8.4-8.4.23-1.el10_2.src.rpm">
          <filename>php8.4-cli-8.4.23-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ea896bf8c7729cf045f44d08a82376916aca7aaa5ba32dcd36be51626259fece</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:54512</id>
    <title>Moderate: gnome-remote-desktop security update</title>
    <issued date="2026-08-14 12:06:50" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:54512 (https://access.redhat.com/errata/RHSA-2026:54512), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gnome-remote-desktop.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.

Security Fix(es):

* gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service (CVE-2026-18358)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18358" id="CVE-2026-18358" type="cve" title="CVE-2026-18358" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2462876" id="2462876" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:54512" id="RLSA-2026:54512" type="self" title="RLSA-2026:54512" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:54512" id="RHSA-2026:54512" type="vendor" title="Red Hat RHSA-2026:54512" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gnome-remote-desktop" arch="x86_64" epoch="0" version="49.3" release="4.el10_2" src="gnome-remote-desktop-49.3-4.el10_2.src.rpm">
          <filename>gnome-remote-desktop-49.3-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f5a5caec1cf60cfc70e657bc9e157612b2b03824f039fdb0545caa153b0da167</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:54541</id>
    <title>Important: .NET 8.0 security, bug fix, and enhancement update</title>
    <issued date="2026-08-14 12:06:50" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:54541 (https://access.redhat.com/errata/RHSA-2026:54541), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows.  It particularly focuses on creating console applications, web applications and micro-services.  .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.130
Runtime version: 8.0.30

Security Fix(es):

* .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

* .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

* .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

* .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

* Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [rhel-10.2.z] (JIRA:Rocky Linux-235472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62899" id="CVE-2026-62899" type="cve" title="CVE-2026-62899" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62900" id="CVE-2026-62900" type="cve" title="CVE-2026-62900" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62901" id="CVE-2026-62901" type="cve" title="CVE-2026-62901" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62909" id="CVE-2026-62909" type="cve" title="CVE-2026-62909" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512180" id="2512180" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512185" id="2512185" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512175" id="2512175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512179" id="2512179" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:54541" id="RLSA-2026:54541" type="self" title="RLSA-2026:54541" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:54541" id="RHSA-2026:54541" type="vendor" title="Red Hat RHSA-2026:54541" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.30" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.30-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7d6f603f2636135084327a3d50c47b3aabb5ed220b0e8feb6535aa13abdb98c6</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.30" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.30-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ff9110f50c5d3bd96ff09c32543d3549dc94582cb465aaea7391915c6537e8fb</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.30" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.30-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">66f64566a6814d58c6134c502b17139086025d2d5af4a8e07288a4bddb179cf4</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.130" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.130-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">278df22bab999aa883f5456053585333e89f7187453acebeca1be5033a2baf9d</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.130" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.130-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">88f9358aa2e0cda10c0e3eadf783e3e2476589100de2b41a0f3d25d5dc3efd9e</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.30" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.30-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fcc121b8d95a80bc44aa04a1568017420b1cdc826a5b3ce2f555964d1e25d3c8</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.30" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.30-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e1daa200f31f75b9f89f0695107c88861e8669e39b0acf324486b83cf5346c50</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.30" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.30-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d7f78b5362d6f6a5d4cf33377805cb5ae35b82f60959928142a80bc9ed6e07fe</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.30" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.30-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e8057688307689a3e0df3a2051412b484e94b03cf05ddc4959ab061c28b9606f</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.130" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.130-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a81fa8e2f11afa183c41f1ae5ef28d844cbeacdd48db1cb75ea64fe01011a5bb</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.30" release="1.el10_2" src="dotnet8.0-8.0.130-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.30-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ab89633421acc26633eb18f615c7091c25f25a9eedda66a57634b4fd4970189e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:54590</id>
    <title>Important: .NET 9.0 security, bug fix, and enhancement update</title>
    <issued date="2026-08-14 12:06:50" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:54590 (https://access.redhat.com/errata/RHSA-2026:54590), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows.  It particularly focuses on creating console applications, web applications and micro-services.  .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.120
Runtime version: 9.0.19

Security Fix(es):

* .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

* .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

* .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

* .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

* Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [rhel-10.2.z] (JIRA:Rocky Linux-235477)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62899" id="CVE-2026-62899" type="cve" title="CVE-2026-62899" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62900" id="CVE-2026-62900" type="cve" title="CVE-2026-62900" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62901" id="CVE-2026-62901" type="cve" title="CVE-2026-62901" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62909" id="CVE-2026-62909" type="cve" title="CVE-2026-62909" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512180" id="2512180" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512185" id="2512185" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512175" id="2512175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512179" id="2512179" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:54590" id="RLSA-2026:54590" type="self" title="RLSA-2026:54590" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:54590" id="RHSA-2026:54590" type="vendor" title="Red Hat RHSA-2026:54590" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.19" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.19-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6d8bdba795a2eda55ba3a59a23072716f81daa2f541104794ff4e9ba51680fa5</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.120" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.120-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9e341bf6e920d5a6b292f7dcd4be0191133d4c85e2c3ccc2867a807d5f693508</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.19" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.19-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c99b3badf0bbbe012c3698bc731961f70f9316584c3bc8ca55cd80242306d39a</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.120" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.120-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ca1ec8c47ec85ce00717e2291f6c526f30b9afd81ffa3a79e5b5bf8019599fa8</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.120" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.120-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9ea7e121900df7243c076153930edc03cde8a86d4f8509c518d7a57b54b39b5e</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.120" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.120-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">238915891f181dd96f20606cf024a1d607156d54648b11039bbdcc0fef95b4e7</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.19" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.19-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">32c0b0585989cabb2d1a27c95d1a8711900f28ca5b3af8c3e38416b6407fc5cb</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.19" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.19-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1762d6c69bfba2e493694193a7a7ff71cc652c7cb4cce4ef9defa5449925218f</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.19" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.19-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7f00dee81f6bf5cfcd262c104bfde1f3761cf2ecb30af23f43fee14c9a9a5d9d</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.19" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.19-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">50f2c589a621ca4f45659b1000fcc88222fe05bdde522893b18f7a937c71cf9b</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.19" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.19-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e88057914fdafd5a9611664962425b918b672e3d722c92683b345ccf341231a8</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.120" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.120-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d3bebe8c89d4eb20fa743894b7c5357b6811c7e507e9666dc0edd5151b27bc03</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.19" release="1.el10_2" src="dotnet9.0-9.0.120-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.19-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9f64445be0ac4069d5c18bd948a2c8219118e5fce7516536693bcc5e652d48f5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55424</id>
    <title>Important: 389-ds-base security update</title>
    <issued date="2026-08-17 18:06:54" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55424 (https://access.redhat.com/errata/RHSA-2026:55424), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for 389-ds-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770)

* 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788)

* 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11770" id="CVE-2026-11770" type="cve" title="CVE-2026-11770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11788" id="CVE-2026-11788" type="cve" title="CVE-2026-11788" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15722" id="CVE-2026-15722" type="cve" title="CVE-2026-15722" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484802" id="2484802" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499961" id="2499961" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485423" id="2485423" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55424" id="RLSA-2026:55424" type="self" title="RLSA-2026:55424" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55424" id="RHSA-2026:55424" type="vendor" title="Red Hat RHSA-2026:55424" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="389-ds-base" arch="x86_64" epoch="0" version="3.2.0" release="9.el10_2" src="389-ds-base-3.2.0-9.el10_2.src.rpm">
          <filename>389-ds-base-3.2.0-9.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b63a6e710784d6f612e148e4d644bdbf8f9f0e56284acb81e7b4a46b1bd5874b</sum>
        </package>
        <package name="389-ds-base-libs" arch="x86_64" epoch="0" version="3.2.0" release="9.el10_2" src="389-ds-base-3.2.0-9.el10_2.src.rpm">
          <filename>389-ds-base-libs-3.2.0-9.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6eb26d3e7fe323868fd666530d409f35e1fb77e9d586520ae702da7c51248afb</sum>
        </package>
        <package name="python3-lib389" arch="noarch" epoch="0" version="3.2.0" release="9.el10_2" src="389-ds-base-3.2.0-9.el10_2.src.rpm">
          <filename>python3-lib389-3.2.0-9.el10_2.noarch.rpm</filename>
          <sum type="sha256">90fe45aa4658b9c3b99c5db327091e062ad92370baac0985b09cdcb89114b710</sum>
        </package>
        <package name="389-ds-base-snmp" arch="x86_64" epoch="0" version="3.2.0" release="9.el10_2" src="389-ds-base-3.2.0-9.el10_2.src.rpm">
          <filename>389-ds-base-snmp-3.2.0-9.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c62fbcdbd1bef84455e0112116df569426dad65cde8b358c35b527b02c6b0afb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55435</id>
    <title>Important: gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-08-17 18:06:54" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55435 (https://access.redhat.com/errata/RHSA-2026:55435), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-ugly-free.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This package contains plug-ins whose license is not fully compatible with LGPL.

Security Fix(es):

* gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19389" id="CVE-2026-19389" type="cve" title="CVE-2026-19389" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2513016" id="2513016" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55435" id="RLSA-2026:55435" type="self" title="RLSA-2026:55435" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55435" id="RHSA-2026:55435" type="vendor" title="Red Hat RHSA-2026:55435" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-ugly-free" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.2" src="gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.2.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">5131d53de94dd301858ce3b3bdd2c1bb41d797e5bcb087e35fe04a3ac175c95e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55434</id>
    <title>Moderate: gstreamer1-plugins-good security update</title>
    <issued date="2026-08-17 18:06:54" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55434 (https://access.redhat.com/errata/RHSA-2026:55434), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gstreamer1-plugins-good.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

* gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)

* gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73433" id="CVE-2026-73433" type="cve" title="CVE-2026-73433" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73434" id="CVE-2026-73434" type="cve" title="CVE-2026-73434" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2514807" id="2514807" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2514801" id="2514801" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55434" id="RLSA-2026:55434" type="self" title="RLSA-2026:55434" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55434" id="RHSA-2026:55434" type="vendor" title="Red Hat RHSA-2026:55434" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-good" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.5" src="gstreamer1-plugins-good-1.26.7-2.el10_2.5.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">9061d74ad4d1f5fcbfcdcb9ebd521a6a9949ece4d07b2d0de55301b6626a5aac</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.5" src="gstreamer1-plugins-good-1.26.7-2.el10_2.5.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">5fab7cf386da63771e011f573e15bb36a63b5fd742dd5104581a727233dc0f63</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55433</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2026-08-17 18:06:54" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55433 (https://access.redhat.com/errata/RHSA-2026:55433), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-bad-free.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19387" id="CVE-2026-19387" type="cve" title="CVE-2026-19387" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2513015" id="2513015" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55433" id="RLSA-2026:55433" type="self" title="RLSA-2026:55433" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55433" id="RHSA-2026:55433" type="vendor" title="Red Hat RHSA-2026:55433" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-bad-free-libs" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.7" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.7.x86_64.rpm</filename>
          <sum type="sha256">65a986eb090ba426393f1489bd1f119bba64be86d698b10116304b0131e6c921</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.7" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.x86_64.rpm</filename>
          <sum type="sha256">d93a3f85da34f5d51015d60cac9cb262217a2d16aa01942a90c54a5a6d752eb9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55448</id>
    <title>Important: libXfont2 security update</title>
    <issued date="2026-08-17 18:06:54" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55448 (https://access.redhat.com/errata/RHSA-2026:55448), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libXfont2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>X.Org X11 libXfont2 runtime library

Security Fix(es):

* libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)

* libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44950" id="CVE-2026-44950" type="cve" title="CVE-2026-44950" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59679" id="CVE-2026-59679" type="cve" title="CVE-2026-59679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2509620" id="2509620" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2509622" id="2509622" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55448" id="RLSA-2026:55448" type="self" title="RLSA-2026:55448" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55448" id="RHSA-2026:55448" type="vendor" title="Red Hat RHSA-2026:55448" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libXfont2" arch="x86_64" epoch="0" version="2.0.6" release="5.el10_2.3" src="libXfont2-2.0.6-5.el10_2.3.src.rpm">
          <filename>libXfont2-2.0.6-5.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">bbe29e22b7287a813d4d0147fdc96ab345de36ee2484853226c4a48949b271d1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55437</id>
    <title>Important: bind security update</title>
    <issued date="2026-08-17 18:06:54" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55437 (https://access.redhat.com/errata/RHSA-2026:55437), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for bind.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)

* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

* bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

* bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

* bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10723" id="CVE-2026-10723" type="cve" title="CVE-2026-10723" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11331" id="CVE-2026-11331" type="cve" title="CVE-2026-11331" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11622" id="CVE-2026-11622" type="cve" title="CVE-2026-11622" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11721" id="CVE-2026-11721" type="cve" title="CVE-2026-11721" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13204" id="CVE-2026-13204" type="cve" title="CVE-2026-13204" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13321" id="CVE-2026-13321" type="cve" title="CVE-2026-13321" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504338" id="2504338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504166" id="2504166" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504560" id="2504560" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503721" id="2503721" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504447" id="2504447" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504298" id="2504298" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55437" id="RLSA-2026:55437" type="self" title="RLSA-2026:55437" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55437" id="RHSA-2026:55437" type="vendor" title="Red Hat RHSA-2026:55437" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="bind" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.10" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-9.18.33-15.el10_2.10.x86_64.rpm</filename>
          <sum type="sha256">7f7a0b2fb96592c38b909e9a44d4f07d0147e0dad356a82797cfeb3c3a134943</sum>
        </package>
        <package name="bind-license" arch="noarch" epoch="2" version="9.18.33" release="15.el10_2.10" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-license-9.18.33-15.el10_2.10.noarch.rpm</filename>
          <sum type="sha256">470321a2c37f6c39ee7f0684c36c00a139e950ddb2714a6ac3c706283b610ca3</sum>
        </package>
        <package name="bind-chroot" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.10" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-chroot-9.18.33-15.el10_2.10.x86_64.rpm</filename>
          <sum type="sha256">3ea0d270c87dbdaa5a1f29c40b94616e9ec9bb85f6bc979989344526ce68a6c5</sum>
        </package>
        <package name="bind-dnssec-utils" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.10" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-15.el10_2.10.x86_64.rpm</filename>
          <sum type="sha256">383d1bc731a4fe5d03671151b7df2deb37fa252988c2b2c1797adf6567097225</sum>
        </package>
        <package name="bind-libs" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.10" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-libs-9.18.33-15.el10_2.10.x86_64.rpm</filename>
          <sum type="sha256">ac22e6db661ba62ff082d6e5294153a576c3289e7421f891075006f4406c76c4</sum>
        </package>
        <package name="bind-utils" arch="x86_64" epoch="2" version="9.18.33" release="15.el10_2.10" src="bind-9.18.33-15.el10_2.10.src.rpm">
          <filename>bind-utils-9.18.33-15.el10_2.10.x86_64.rpm</filename>
          <sum type="sha256">d31277a20f1cb2c0d508e052eaf24caa8b22eec2370faefc2192652e1e7a7843</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55541</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-08-18 12:07:31" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55541 (https://access.redhat.com/errata/RHSA-2026:55541), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14257" id="CVE-2026-14257" type="cve" title="CVE-2026-14257" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69152" id="CVE-2026-69152" type="cve" title="CVE-2026-69152" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69192" id="CVE-2026-69192" type="cve" title="CVE-2026-69192" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2510722" id="2510722" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2506433" id="2506433" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2510801" id="2510801" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55541" id="RLSA-2026:55541" type="self" title="RLSA-2026:55541" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55541" id="RHSA-2026:55541" type="vendor" title="Red Hat RHSA-2026:55541" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs-libs" arch="x86_64" epoch="1" version="22.23.1" release="6.el10_2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-libs-22.23.1-6.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b79b8c43ad14920f0aeb5365d2eff1c1e487bf5bef78b81065b80c9df2b177ae</sum>
        </package>
        <package name="nodejs-devel" arch="x86_64" epoch="1" version="22.23.1" release="6.el10_2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-devel-22.23.1-6.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f67bfdfb05ee97cec494ad0448b58c94046600246c9eb1616c11de2da79bf493</sum>
        </package>
        <package name="nodejs-full-i18n" arch="x86_64" epoch="1" version="22.23.1" release="6.el10_2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-full-i18n-22.23.1-6.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2dc28231f6fedda0a6779c6cc19b58fc4e32ff55443db48197dd0b7747bc9010</sum>
        </package>
        <package name="nodejs-npm" arch="x86_64" epoch="1" version="10.9.8" release="1.22.23.1.6.el10_2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-npm-10.9.8-1.22.23.1.6.el10_2.x86_64.rpm</filename>
          <sum type="sha256">dec0d9e5e1098d6f3d1a2bcc9526a47b2bc94de54b0468542403498d4be48b7f</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.23.1" release="6.el10_2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-6.el10_2.noarch.rpm</filename>
          <sum type="sha256">3b4bda9236c344d1851e9359ea1f83cfa134fc42a9ddebf9169c2af24ef302d8</sum>
        </package>
        <package name="nodejs" arch="x86_64" epoch="1" version="22.23.1" release="6.el10_2" src="nodejs22-22.23.1-6.el10_2.src.rpm">
          <filename>nodejs-22.23.1-6.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a51d3ae8d1e72c17078aae7ee2170338e530c4d0140c10d53f51586d06dd2d23</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55679</id>
    <title>Important: haproxy security update</title>
    <issued date="2026-08-18 12:07:31" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55679 (https://access.redhat.com/errata/RHSA-2026:55679), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for haproxy.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

* haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)

* haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55203" id="CVE-2026-55203" type="cve" title="CVE-2026-55203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55204" id="CVE-2026-55204" type="cve" title="CVE-2026-55204" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490518" id="2490518" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490522" id="2490522" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55679" id="RLSA-2026:55679" type="self" title="RLSA-2026:55679" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55679" id="RHSA-2026:55679" type="vendor" title="Red Hat RHSA-2026:55679" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="haproxy" arch="x86_64" epoch="0" version="3.0.5" release="6.el10_2.2" src="haproxy-3.0.5-6.el10_2.2.src.rpm">
          <filename>haproxy-3.0.5-6.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">8a6bb5f3afc88e3da5ce4c0631484ac44b3f33696953d2037c71ef49f41d02b4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55617</id>
    <title>Important: pcp security update</title>
    <issued date="2026-08-18 12:07:31" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55617 (https://access.redhat.com/errata/RHSA-2026:55617), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.

Security Fix(es):

* PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524)

* PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526)

* PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527)

* PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16524" id="CVE-2026-16524" type="cve" title="CVE-2026-16524" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16526" id="CVE-2026-16526" type="cve" title="CVE-2026-16526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16527" id="CVE-2026-16527" type="cve" title="CVE-2026-16527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16529" id="CVE-2026-16529" type="cve" title="CVE-2026-16529" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2506023" id="2506023" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2506031" id="2506031" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2506032" id="2506032" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2506026" id="2506026" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55617" id="RLSA-2026:55617" type="self" title="RLSA-2026:55617" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55617" id="RHSA-2026:55617" type="vendor" title="Red Hat RHSA-2026:55617" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="pcp-import-sar2pcp" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-sar2pcp-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6e5f82e7efac3e4022ddbcbfa2aebd8120ea5004ce70d4a6d8c266ef0aba2a4b</sum>
        </package>
        <package name="pcp-pmda-haproxy" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-haproxy-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e71c3cc231b73ea54f6830c50c5e0fc7bc5bc2a123fc6fe70cf7da801ac540e3</sum>
        </package>
        <package name="pcp-export-zabbix-agent" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-zabbix-agent-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4ae6e1993b45e52e3507757b332640d038f13eb36f27502abe27738aa617dd6b</sum>
        </package>
        <package name="pcp-export-pcp2zabbix" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2zabbix-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">af47067d20c7663f787029c45d2b36d2740fb28b6e7029e4ecd4fcb70c52c016</sum>
        </package>
        <package name="pcp-system-tools" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-system-tools-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e5ffbc62baba535cda8bc9a7c97f3b2e42d815d4bc090cd6534f08afb43e4134</sum>
        </package>
        <package name="pcp-export-pcp2elasticsearch" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2elasticsearch-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">26ac13d88add50f4a5dedd06399e4a589e880919579522f66acbce8fdec572ab</sum>
        </package>
        <package name="pcp-pmda-slurm" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-slurm-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e624781b98c1b3cac98cdd8968f7a892cc47e09aaa2753219a198059286a0b8c</sum>
        </package>
        <package name="pcp-pmda-bonding" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bonding-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c83f9543104c057a76f85261ec93e33255e2c023c0dc5e9821b863ac8c17f0d4</sum>
        </package>
        <package name="pcp-pmda-weblog" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-weblog-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b2f3f7f9dceba2dc2508aaf2582925959d6cc89668ce381a80d3df1f79d42b04</sum>
        </package>
        <package name="pcp-pmda-zimbra" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-zimbra-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a867897e588beee1794ac16a6d4bf29e965ebda592e1ffccb2a5f9f1bc9cef68</sum>
        </package>
        <package name="pcp-pmda-docker" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-docker-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">45803a3771b4fc7a288d4e62403a382e339efb57a82b1f43f0085d08a47e52ee</sum>
        </package>
        <package name="pcp-pmda-opentelemetry" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-opentelemetry-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fbf86360359f23aa0c17addb5be60922308ba40ae9c4d7b6f38eed9179575afc</sum>
        </package>
        <package name="pcp-pmda-bpf" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bpf-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3d3e303243de3c1bbdbefcea9d829fc719656aa93c57ca2e999a8571da6648b9</sum>
        </package>
        <package name="pcp-pmda-ds389log" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-ds389log-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">27f9f589b99bf9515b22ac5a7077b971ec953471283be31de9f067480c4a39c8</sum>
        </package>
        <package name="pcp-libs" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-libs-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">89ffd09e4b97c3ef6d2f2d29c26f566f29f771159c382339c9d9621ed89f62d5</sum>
        </package>
        <package name="pcp-pmda-rabbitmq" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-rabbitmq-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c19f4f0fbaa3aabcf0a27f069c7624f6f6bcb6c1b709d64cacad8172884b7539</sum>
        </package>
        <package name="pcp-pmda-openvswitch" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-openvswitch-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">10421b66557378a99cc6cbead79baa1686d19ca700373c14a48e3cea350218ed</sum>
        </package>
        <package name="pcp-pmda-mysql" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mysql-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a0e020f17358355bbc1a7be927990b3dac7bfaeca78190088a016c59b9f36f0d</sum>
        </package>
        <package name="pcp-pmda-nfsclient" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-nfsclient-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">df6062ba7c1a63c0a26cd9755a92642a7fb009c4be7bcd5104e693daa2ad59cc</sum>
        </package>
        <package name="pcp-zeroconf" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-zeroconf-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fedb31b6ac3453e5f63f06c68dc35df18d87942174089c02c49d84cf773700bc</sum>
        </package>
        <package name="pcp-pmda-redis" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-redis-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">aad50bc3d3f2b9affcb786b34aa3b79a6ad0d465c8d5fb81c159f8d39190ab6e</sum>
        </package>
        <package name="pcp-pmda-pdns" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-pdns-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">32d4a8fc0b711426ca6c6f9448655ce791d3b16fd3554f2ddc4aace99984e7b9</sum>
        </package>
        <package name="pcp-pmda-lustrecomm" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-lustrecomm-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1b91593b9fbcc2763177d7a2256a3f65c28bff46ca29587764418c1e4c4873a0</sum>
        </package>
        <package name="pcp-pmda-perfevent" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-perfevent-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">34db8bb0c145a6d4a00387d4327974ce368f6fa58d04d450e70be3f4fe498afd</sum>
        </package>
        <package name="pcp-pmda-hdb" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-hdb-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e2f6009d21c2f843bf45dd94b80ff4362a1ed0e1a520c1d2e7a673d362734abd</sum>
        </package>
        <package name="pcp-pmda-smart" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-smart-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b6243ab2e74746e7ae612e94b8a4dc912f9b3ca393d23423910b43282ba4611f</sum>
        </package>
        <package name="pcp-import-pmseries" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-pmseries-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">62d7f30a0a80cd9f4f95ace11ffce20487696f0e0f1f60341c5559923aed8009</sum>
        </package>
        <package name="pcp-selinux" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-selinux-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b91589b8a9fa865a91901af329f55cd27039031afb1a2af7881770691b932a79</sum>
        </package>
        <package name="pcp-export-pcp2graphite" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2graphite-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1da0b24ecaa686e5d0776188bcc96cac21cacd00561ff1c58654dfdb7d2aa51a</sum>
        </package>
        <package name="pcp-pmda-uwsgi" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-uwsgi-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">82ddd53425935a6f838d8c1f79e6bd50ca6ea409a2378236dc57d7d028f3edbe</sum>
        </package>
        <package name="pcp-pmda-podman" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-podman-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4f9271c3b64c0c8da676ded88792732d958ec6440719fcc22eedf6ee2cd5f1b8</sum>
        </package>
        <package name="pcp-pmda-hacluster" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-hacluster-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e2ae90810a8b537a852f5277662bb98c88f6717da1ef822792c4f5bf29f7c853</sum>
        </package>
        <package name="pcp-pmda-mongodb" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mongodb-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d7ecb85ff2a20e3d94ebfab9238aac6240e10e18b817b3678ac8e1b8a482ca38</sum>
        </package>
        <package name="pcp-pmda-bcc" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bcc-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">235851a7aa1b5bcc0dcca80840c3cf02f5009a1c2bac73ca1b14dc396ae0f4ea</sum>
        </package>
        <package name="pcp-pmda-bind2" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bind2-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">38bfb9430fd8859fd67beb93a0c4aec03c938284478f321dfbcc21624dbc7f46</sum>
        </package>
        <package name="pcp-pmda-unbound" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-unbound-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8086a535631d74d59f2656a9fd438d008258b2461f60ca57e2fa3deb47b17536</sum>
        </package>
        <package name="pcp-pmda-cifs" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-cifs-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0abb6f81a7208c6b2a6c2f2ee0e8e4650f4d0f8455a251ffd2be665b70b64aac</sum>
        </package>
        <package name="pcp-conf" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-conf-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">eb4146e521eefda42c4bac54551caf354f9c2ecdd9608856e57f4830dafb78d6</sum>
        </package>
        <package name="pcp-pmda-zswap" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-zswap-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4b56ce34c303f476b58d60859d42f0386b65da2cb1b599e4759d016847aa0f16</sum>
        </package>
        <package name="pcp-export-pcp2influxdb" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2influxdb-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">966900f0fc1c9ca4d2feedba060adc2e07fff80b18c58498416ecbf7fd80318c</sum>
        </package>
        <package name="pcp-pmda-samba" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-samba-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ee42e07d5df3c74597c9691352ac4806e319d45a9d3b1e7a037d197ba3484395</sum>
        </package>
        <package name="pcp-pmda-gpsd" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-gpsd-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b9770bf8cd8625253e9f0ef5cbc3afed5d350c1f0e7c407d9d9abe8dc94e48e2</sum>
        </package>
        <package name="pcp-pmda-sendmail" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-sendmail-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8ccb98eab405c31ded2d47697453e880a68ae1fc9e38414adccd521b31038908</sum>
        </package>
        <package name="pcp-pmda-postfix" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-postfix-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">750c4c2e8ad55ce4dfa7b41e85e4f62529cc3993f0c8d5ddd78a00e3c85d83be</sum>
        </package>
        <package name="pcp-pmda-sockets" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-sockets-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7e4ece53c5161c1e1384c9bf121e0ca9f3340de45a35a76978c475f1306513f0</sum>
        </package>
        <package name="pcp-pmda-summary" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-summary-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9ec124d2f2c58ca965904cba86c0c142a2e4546c9a6245d314e85cbc88fabc83</sum>
        </package>
        <package name="pcp-pmda-mssql" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mssql-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">271ea8ec032a5341d4def89c6dc04438ef5bc4c27ac748dbb08d86e1ca1f251f</sum>
        </package>
        <package name="pcp-pmda-roomtemp" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-roomtemp-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">921b1df3fcac95bf2e0c95a03d9c0e9a4bf460b14c38c77d9f35621661730812</sum>
        </package>
        <package name="pcp-pmda-mounts" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mounts-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">83a42421bbfbf5d53d7b7a2479a08ae2a7eb208ece881ef61b577471da8a774d</sum>
        </package>
        <package name="pcp-pmda-farm" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-farm-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9c2635dffb451a50b18838f095417034f33df203a09f22035cd0d45dd34876c4</sum>
        </package>
        <package name="perl-PCP-PMDA" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>perl-PCP-PMDA-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9426000dca13c489ce895c848c1ad00028f2fe8ee9c69cbada69451f5a88b571</sum>
        </package>
        <package name="pcp-pmda-dbping" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-dbping-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f39345d39d9f96097652218e12151ed8ef797f8c0a47ecde9e93771b7195d80d</sum>
        </package>
        <package name="pcp-pmda-rocestat" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-rocestat-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c7856941077f98a33f164c3310dd0b0afaad4684b903ab44d22d9a5d911bb614</sum>
        </package>
        <package name="pcp-pmda-ds389" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-ds389-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0db06c01d252a2b34c68f4bb7b79c8a4c74c668ac6060d9e2abcede74b498183</sum>
        </package>
        <package name="pcp-pmda-systemd" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-systemd-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ea51131d1c3aa1be7e855a241e4181f80afc1eb11337a6c77532d6e0a1813755</sum>
        </package>
        <package name="pcp-pmda-nginx" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-nginx-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">30a3721484197d968a38fce939514683a246e4c577076a40cdd678f7d25cdc60</sum>
        </package>
        <package name="pcp-pmda-apache" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-apache-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2667e9f4d815cef16f326834d1e39e0b962cb47ad990e42a6b1787e3efbd2fc8</sum>
        </package>
        <package name="pcp-pmda-memcache" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-memcache-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">aacd9a1038113f8513a7291b83637c1fd9edc88e8fa61c31b38dfcf5ddbc04a7</sum>
        </package>
        <package name="pcp-pmda-dm" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-dm-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ed1b630113352730d8b68895004b45a895a7bf922a58ebc44f96e228efffa497</sum>
        </package>
        <package name="pcp-libs-devel" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-libs-devel-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b808d5b3dde26b2795bf6e8a63cdd8a6ca8c92cb8a3cda25089e338927952758</sum>
        </package>
        <package name="pcp-pmda-netcheck" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-netcheck-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c205669c10cf789f09d688752f1b5f2b346fd654d2dcf8c5b8d33cd1edacf769</sum>
        </package>
        <package name="pcp-import-ganglia2pcp" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-ganglia2pcp-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a3c011c99bf0945b00161fb1908e57042e9cae91b97844cffc11ecb0877b75b6</sum>
        </package>
        <package name="pcp-pmda-mic" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mic-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e046afdf5cbabd259daf7d137198d693d40eec337ffbddbad2845cbe31dcf27e</sum>
        </package>
        <package name="pcp-import-iostat2pcp" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-iostat2pcp-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fd54b2b2ada6cbf574ef24fba603dca3baac08bd0d64d588d21b0df2cbd66915</sum>
        </package>
        <package name="pcp-pmda-nvidia-gpu" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-nvidia-gpu-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c5266e7cf0d5eb428f9b17e24ea4cbdafcf791ee659f6623a33c045648a818f9</sum>
        </package>
        <package name="pcp-pmda-news" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-news-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6f4e02d2a670743c3053f90250883eedfb3a5bbfa0b5ffe1c900951b74bea23b</sum>
        </package>
        <package name="pcp-import-benchmarks" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-benchmarks-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1f261d71b68a8d2d5e54218a5845fcd93bc329f9607b3cac72861ef50ac3df16</sum>
        </package>
        <package name="pcp-export-pcp2json" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2json-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5dbfcb0c125c18ff4e8cd213c8f376cd7ba95acf6abfbfbbd4086fd3cebc5a1f</sum>
        </package>
        <package name="pcp-pmda-gpfs" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-gpfs-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4befff4ce55440062c2bf0b1d3dbd0de503b60782186e029800f22926e11f417</sum>
        </package>
        <package name="pcp-pmda-resctrl" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-resctrl-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">730eaa1e89335406659422b0342231f3cf9f4b76c38179a727ed2394339d1af9</sum>
        </package>
        <package name="pcp-pmda-libvirt" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-libvirt-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7e31e665bfc8227be31bd7905ca07c84ae8a4ac39c335ca478f7e933f6d699e0</sum>
        </package>
        <package name="pcp-pmda-trace" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-trace-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bfa5e647aa06a2575f9150107cf0b8f42b2d3cf35c43e775c32e01bcb5a8cb4d</sum>
        </package>
        <package name="pcp-pmda-snmp" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-snmp-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6a5634a4157335d0c21c1fd0cc72e11684a1fc863e75d471c7da5553672185b1</sum>
        </package>
        <package name="pcp-pmda-activemq" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-activemq-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">143516aa50197c974b3c5181df234b9b2719ed82cbc282a637c0ce2bb16f7ed5</sum>
        </package>
        <package name="pcp-pmda-oracle" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-oracle-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">923b7401e7c0a370def441b516799431d3065eaa02ad3b4e0d2535f31e99ef84</sum>
        </package>
        <package name="perl-PCP-MMV" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>perl-PCP-MMV-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1cd1903a9032065bacc853d183fa4fe8194c8f037420819812833e3c6756510f</sum>
        </package>
        <package name="pcp-import-collectl2pcp" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-collectl2pcp-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">76e077d82216ebecf90dd9380b8f0bfe93f049a5a47a733a748e631bbca51d01</sum>
        </package>
        <package name="pcp-pmda-mailq" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-mailq-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">046deae72dcf23895d01619a634615224d9280ea1bdf6c306f333dbfc0325255</sum>
        </package>
        <package name="pcp-doc" arch="noarch" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-doc-7.0.3-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">757a4161491cf30a033460691485424abf99b5d10f1ea4bf3cd53c6c8b154c70</sum>
        </package>
        <package name="pcp-pmda-openmetrics" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-openmetrics-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8fe86f08b075da1bb21dcab06eb5639c068a4d9a09c9d27b51fe7917b969dc42</sum>
        </package>
        <package name="pcp-pmda-bpftrace" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bpftrace-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d75ae158d3b9c2d1e60556f6619fad78c3060d97c49fcfbffc02fb69869f9122</sum>
        </package>
        <package name="pcp" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">78e20255e38ad096bc183ca01ac1cf0991dd78ff1bafbdc8f1ebf3b4bc898f3e</sum>
        </package>
        <package name="python3-pcp" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>python3-pcp-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">63c009acc2f6c4d7b90a026c6e6bb713ae7390a4b774252d8e09e9ee1f0d93d2</sum>
        </package>
        <package name="pcp-pmda-statsd" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-statsd-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3e8f219326734f7313910f35d26c4fe40feaea33f08ca7526a69adec32f0b6d6</sum>
        </package>
        <package name="pcp-export-pcp2spark" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2spark-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e5a140bdc3031bdb0c1e76eb325b394e4b9313ecd60ffaf1ecd9a478d92b430e</sum>
        </package>
        <package name="pcp-pmda-bash" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-bash-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ee139da950cecb9b531d01c4f1d2d53f159e38c25411fd43a203f7f684fd3d50</sum>
        </package>
        <package name="pcp-gui" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-gui-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f4525192682b08f6eceb52a3605fc6d676017b969863a0d5cbd5a9fdf9e95ad4</sum>
        </package>
        <package name="pcp-geolocate" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-geolocate-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d39ead4e039f15b3b0567b1c149a6519793f523ca99d5ddf2d39579e313184e7</sum>
        </package>
        <package name="pcp-pmda-gluster" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-gluster-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b9d13ba40ebb86c44542d5340a10b05d03c85e375b1f6cb67d60937926afda5f</sum>
        </package>
        <package name="pcp-pmda-cisco" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-cisco-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a449b815edf6b7ee7d6cfbbd030f1f3ae165d38d399f38ec62fe7d37acdef675</sum>
        </package>
        <package name="pcp-export-pcp2opentelemetry" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2opentelemetry-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ada84396afd2f7bafe1f48693ba0e9194eaa2063e8bd3c3a616ed9675a6bd78b</sum>
        </package>
        <package name="pcp-pmda-elasticsearch" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-elasticsearch-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1d5ab3a3b7a1319486202811d80ac950af135f2837d17040c06244c867219504</sum>
        </package>
        <package name="pcp-devel" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-devel-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c7a0de49de7087d3a5592dd955d0b7c9cdaf560989fbeefbc795de8dda0c16cb</sum>
        </package>
        <package name="pcp-pmda-denki" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-denki-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f16ea78c4eba4135a224d533db20685b988b520fc7732e8bd57ec89d473931ee</sum>
        </package>
        <package name="pcp-pmda-lmsensors" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-lmsensors-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">64d002cbacb4b10f64361cbe277b273d3b4a90862f89c8e6bfc6bb8a2aa1de8a</sum>
        </package>
        <package name="pcp-pmda-lio" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-lio-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3aa7c34552f78a0082f4b59c5e6a1f6e85faefd7a103801992b169ac101a52cf</sum>
        </package>
        <package name="pcp-pmda-logger" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-logger-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">527200eb85d879d50f500c138a368c19f2d33a22fe71792f4b034b86a9b57826</sum>
        </package>
        <package name="pcp-pmda-shping" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-shping-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0f6f3714fd26b69efbcc1c68fc5b98b6f8781d4da7575ac62995fd93f7352ae5</sum>
        </package>
        <package name="pcp-pmda-rsyslog" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-rsyslog-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">52a40a10eab9dc262d1c0871a7b31ad46796b11bea3ede51fc81ab0818d73f71</sum>
        </package>
        <package name="perl-PCP-LogSummary" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>perl-PCP-LogSummary-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b02252b956fa903190989ed859dfca81434870da48d7c4f74ecb7edc13ba4e76</sum>
        </package>
        <package name="pcp-pmda-infiniband" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-infiniband-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6ce055d5f727b57ffd0b883082983efa49a66f727ae35811328ceffcf0426928</sum>
        </package>
        <package name="pcp-export-pcp2openmetrics" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2openmetrics-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0f6e7d49d96b0c1eca501926c3fa904fd5dd71a4a010e9c4fb51bfb0ef490e21</sum>
        </package>
        <package name="pcp-pmda-named" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-named-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2aaec9eafce99185a4aff0f2c6dc491aa4afffb397039ffc8d05ba08f154ad97</sum>
        </package>
        <package name="pcp-pmda-postgresql" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-postgresql-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8de11482d55e5d949937011e0d35c81020a0beb7be0d9828456c4d97eeff0d2c</sum>
        </package>
        <package name="pcp-import-mrtg2pcp" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-import-mrtg2pcp-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c6c561fdee14d65dc24aefa54f9244efbad0d500498026453938f0e747c5827b</sum>
        </package>
        <package name="pcp-export-pcp2xml" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-export-pcp2xml-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f6e400341a7b5e6f77e926cfcfacf65a8bcb3afc8863bd84efac44c1c7c0ba6a</sum>
        </package>
        <package name="pcp-pmda-lustre" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-lustre-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">666a8477a69d7645007f79c00c53241d4d2eaa79337b3f2f3d6fecbfd5ec589c</sum>
        </package>
        <package name="perl-PCP-LogImport" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>perl-PCP-LogImport-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c31a0809069161ac710d0d307932f9dea687f01ffdbaacb6a3b9a4633f10fd94</sum>
        </package>
        <package name="pcp-pmda-netfilter" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-netfilter-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d243f4e45a075478d59dfa29faafff70b7d0a8192d8d452a931e4e2c51d07c60</sum>
        </package>
        <package name="pcp-pmda-amdgpu" arch="x86_64" epoch="0" version="7.0.3" release="5.el10_2" src="pcp-7.0.3-5.el10_2.src.rpm">
          <filename>pcp-pmda-amdgpu-7.0.3-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3f5428946c278845944c0c1146c61b80aa48c196247aca35c4520a85e8a5ffff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55858</id>
    <title>Important: .NET 10.0 security, bug fix, and enhancement update</title>
    <issued date="2026-08-18 12:07:31" />
    <updated date="2026-08-26 06:10:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55858 (https://access.redhat.com/errata/RHSA-2026:55858), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows.  It particularly focuses on creating console applications, web applications and micro-services.  .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.111
Runtime version: 10.0.11

Security Fix(es):

* .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

* .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

* .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

* .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

* Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [rhel-10.2.z] (JIRA:Rocky Linux-235482)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62899" id="CVE-2026-62899" type="cve" title="CVE-2026-62899" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62900" id="CVE-2026-62900" type="cve" title="CVE-2026-62900" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62901" id="CVE-2026-62901" type="cve" title="CVE-2026-62901" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62909" id="CVE-2026-62909" type="cve" title="CVE-2026-62909" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512180" id="2512180" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512185" id="2512185" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512175" id="2512175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2512179" id="2512179" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55858" id="RLSA-2026:55858" type="self" title="RLSA-2026:55858" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55858" id="RHSA-2026:55858" type="vendor" title="Red Hat RHSA-2026:55858" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-sdk-aot-10.0" arch="x86_64" epoch="0" version="10.0.111" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.111-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">730c688d56c8222cc3a8e51e904c452a3c349ea577d94aa16c1b2ae0faf8a0d2</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="10.0.11" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.11-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d54843d803797db14cf62f3be5dc5cff0de44e52a490304236eceaf0ee3e654c</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.11" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.11-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">398ff2ff202e43cb66c8ea690c7a1cbf9a07a849354e40d63fd47105a9c91e1c</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="x86_64" epoch="0" version="10.0.111" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.111-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">60bae7e84621c38fb31762cfa744a09cba75532043973b82cae4ce33f3f24ef1</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.11" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.11-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">21784cf7e62fcb119f4a9b1c83ac51cef5e7fb1c583cae143b897748a3c56fe5</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.11" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.11-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6e930759fcd8b3c1fe5769a09dc566706e00964140266e5195bd78a17b3de17e</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.11" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.11-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1be763f42346338a844ac4d0090cec84684022fc4990f3bd34c33dcf4349dcb6</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="x86_64" epoch="0" version="10.0.11" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.11-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">89b653144c7005322998f6ee6bc4d16120b339763c43e19260db2b8288490a64</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="x86_64" epoch="0" version="10.0.111" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.111-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1f0c60af82877a29b8f16d679d012422e7e9840e277c0121eb8fc23d5c8f50c0</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" arch="x86_64" epoch="0" version="10.0.111" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.111-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">11dd6b488b25ac0837a68646bf4caec05718a9590b3d78007096e659c78ac542</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="x86_64" epoch="0" version="10.0.11" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.11-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">327f318b61cc7fa59eba2168387ddc2a508b1a014ef9700ca8a5e54d21d753a6</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="x86_64" epoch="0" version="10.0.11" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.11-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c62f32890ec8798e42db9102ea9a7269c819aad42c2a59677a435ba3c0438793</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="x86_64" epoch="0" version="10.0.11" release="1.el10_2" src="dotnet10.0-10.0.111-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.11-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0263cc850340a8e3246f926d6139c30e16b316434acab0bffb949d31bf281558</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55892</id>
    <title>Important: unbound security update</title>
    <issued date="2026-08-18 12:07:31" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55892 (https://access.redhat.com/errata/RHSA-2026:55892), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)

* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44690" id="CVE-2026-44690" type="cve" title="CVE-2026-44690" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55973" id="CVE-2026-55973" type="cve" title="CVE-2026-55973" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503063" id="2503063" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2503075" id="2503075" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55892" id="RLSA-2026:55892" type="self" title="RLSA-2026:55892" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55892" id="RHSA-2026:55892" type="vendor" title="Red Hat RHSA-2026:55892" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="unbound-utils" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.4" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">7c57bd22d2cdafcafcc625852a0eb7c00c02a08f41f9036f932589dddccb679b</sum>
        </package>
        <package name="unbound" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.4" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-1.24.2-7.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">2e74efd80e643aa341881b88924f28897632c7dddaf83729a0692da12deae0be</sum>
        </package>
        <package name="python3-unbound" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.4" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">ba8461d72e53a3e5870e812c0a2b266563a66ca444cb14f7784e257a979f7a0b</sum>
        </package>
        <package name="unbound-libs" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.4" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">8d1049fc894cfa23764f6f7685e91bdfdced642ee54dc5ce662b1c29713fbf1f</sum>
        </package>
        <package name="unbound-anchor" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.4" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">c43e57b6fde63051df47f31e9c264c245f647bc5cbce94a85a05e76f4c517110</sum>
        </package>
        <package name="unbound-dracut" arch="x86_64" epoch="0" version="1.24.2" release="7.el10_2.4" src="unbound-1.24.2-7.el10_2.4.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">0fad9678fe58378c9c124d48c0b2276d9bee0cf9d6067a2c2b40407520136dc1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:56007</id>
    <title>Important: mysql8.4 security, bug fix, and enhancement update</title>
    <issued date="2026-08-20 18:07:20" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:56007 (https://access.redhat.com/errata/RHSA-2026:56007), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mysql8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* mysql: Performance Schema unspecified vulnerability (CPU Jul 2026) (CVE-2026-61081)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47064)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47012)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60331)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60190)

* mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60177)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-60145)

* mysql: DDL unspecified vulnerability (CPU Jul 2026) (CVE-2026-46936)

* mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60186)

* mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60315)

* mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026) (CVE-2026-61096)

* mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60163)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2026) (CVE-2026-47052)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60188)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60184)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60185)

* mysql: JSON unspecified vulnerability (CPU Jul 2026) (CVE-2026-61109)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60191)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-61094)

* mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60178)

* mysql: Group Replication GCS unspecified vulnerability (CPU Jul 2026) (CVE-2026-60332)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60189)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60747)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-47023)

* mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60183)

* mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60316)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60187)

* mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60585)

* mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60182)

Bug Fix(es) and Enhancement(s):

* [tracker] Rebase MySQL to 8.4.11 (JIRA:Rocky Linux-188044)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46936" id="CVE-2026-46936" type="cve" title="CVE-2026-46936" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47012" id="CVE-2026-47012" type="cve" title="CVE-2026-47012" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47023" id="CVE-2026-47023" type="cve" title="CVE-2026-47023" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47052" id="CVE-2026-47052" type="cve" title="CVE-2026-47052" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47064" id="CVE-2026-47064" type="cve" title="CVE-2026-47064" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60145" id="CVE-2026-60145" type="cve" title="CVE-2026-60145" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60163" id="CVE-2026-60163" type="cve" title="CVE-2026-60163" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60177" id="CVE-2026-60177" type="cve" title="CVE-2026-60177" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60178" id="CVE-2026-60178" type="cve" title="CVE-2026-60178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60182" id="CVE-2026-60182" type="cve" title="CVE-2026-60182" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60183" id="CVE-2026-60183" type="cve" title="CVE-2026-60183" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60184" id="CVE-2026-60184" type="cve" title="CVE-2026-60184" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60185" id="CVE-2026-60185" type="cve" title="CVE-2026-60185" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60186" id="CVE-2026-60186" type="cve" title="CVE-2026-60186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60187" id="CVE-2026-60187" type="cve" title="CVE-2026-60187" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60188" id="CVE-2026-60188" type="cve" title="CVE-2026-60188" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60189" id="CVE-2026-60189" type="cve" title="CVE-2026-60189" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60190" id="CVE-2026-60190" type="cve" title="CVE-2026-60190" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60191" id="CVE-2026-60191" type="cve" title="CVE-2026-60191" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60315" id="CVE-2026-60315" type="cve" title="CVE-2026-60315" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60316" id="CVE-2026-60316" type="cve" title="CVE-2026-60316" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60331" id="CVE-2026-60331" type="cve" title="CVE-2026-60331" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60332" id="CVE-2026-60332" type="cve" title="CVE-2026-60332" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60585" id="CVE-2026-60585" type="cve" title="CVE-2026-60585" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60747" id="CVE-2026-60747" type="cve" title="CVE-2026-60747" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61081" id="CVE-2026-61081" type="cve" title="CVE-2026-61081" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61094" id="CVE-2026-61094" type="cve" title="CVE-2026-61094" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61096" id="CVE-2026-61096" type="cve" title="CVE-2026-61096" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61109" id="CVE-2026-61109" type="cve" title="CVE-2026-61109" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505027" id="2505027" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505259" id="2505259" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505594" id="2505594" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504823" id="2504823" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505868" id="2505868" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505509" id="2505509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505300" id="2505300" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505891" id="2505891" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505927" id="2505927" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504779" id="2504779" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505002" id="2505002" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505844" id="2505844" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505200" id="2505200" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505310" id="2505310" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505182" id="2505182" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504940" id="2504940" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505722" id="2505722" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505215" id="2505215" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504848" id="2504848" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504855" id="2504855" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505319" id="2505319" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505001" id="2505001" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504925" id="2504925" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505711" id="2505711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505923" id="2505923" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505699" id="2505699" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2504877" id="2504877" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505643" id="2505643" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2505262" id="2505262" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:56007" id="RLSA-2026:56007" type="self" title="RLSA-2026:56007" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:56007" id="RHSA-2026:56007" type="vendor" title="Red Hat RHSA-2026:56007" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mysql8.4-server" arch="x86_64" epoch="0" version="8.4.11" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.11-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-server-8.4.11-1.el10_2.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">00eb145492757e180166981c5cb9b4d0b77d2e8246dd7debb8b62ff0ad59eb9e</sum>
        </package>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.11" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.11-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-common-8.4.11-1.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">676a05962415357b1939f6e215649298d444b2dd517606a8f59e67b272d81a72</sum>
        </package>
        <package name="mysql8.4-libs" arch="x86_64" epoch="0" version="8.4.11" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.11-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-libs-8.4.11-1.el10_2.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">bb4c87968620f7a2d0b5040e92e099d465b1013fc40e5323b34339a067fb3fcb</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.11" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.11-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.11-1.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">7906622ae3bc6ecb423119e077a37b85d3582b01040239b537df12661b1595bb</sum>
        </package>
        <package name="mysql8.4" arch="x86_64" epoch="0" version="8.4.11" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.11-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-8.4.11-1.el10_2.rocky.0.1.x86_64.rpm</filename>
          <sum type="sha256">3e408faff8104743a9cbaab8f1fdb5188da9ba3dfa9853a83d105dd29fbd9f2f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:56965</id>
    <title>Moderate: libcupsfilters security update</title>
    <issued date="2026-08-20 18:07:20" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:56965 (https://access.redhat.com/errata/RHSA-2026:56965), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libcupsfilters.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications.

Security Fix(es):

* libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611)

* libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64611" id="CVE-2026-64611" type="cve" title="CVE-2026-64611" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64612" id="CVE-2026-64612" type="cve" title="CVE-2026-64612" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2502799" id="2502799" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2502801" id="2502801" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:56965" id="RLSA-2026:56965" type="self" title="RLSA-2026:56965" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:56965" id="RHSA-2026:56965" type="vendor" title="Red Hat RHSA-2026:56965" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libcupsfilters" arch="x86_64" epoch="1" version="2.0.0" release="13.el10_2" src="libcupsfilters-2.0.0-13.el10_2.src.rpm">
          <filename>libcupsfilters-2.0.0-13.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7a4c02290e08fd49b8f3c5f21f7139c762936c6dd07d52f09f3824edfee84520</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:56971</id>
    <title>Important: perl-Date-Manip security update</title>
    <issued date="2026-08-20 18:07:20" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:56971 (https://access.redhat.com/errata/RHSA-2026:56971), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-Date-Manip.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.

Security Fix(es):

* perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60075" id="CVE-2026-60075" type="cve" title="CVE-2026-60075" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2509486" id="2509486" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:56971" id="RLSA-2026:56971" type="self" title="RLSA-2026:56971" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:56971" id="RHSA-2026:56971" type="vendor" title="Red Hat RHSA-2026:56971" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl-Date-Manip" arch="noarch" epoch="0" version="6.94" release="5.el10_2.1" src="perl-Date-Manip-6.94-5.el10_2.1.src.rpm">
          <filename>perl-Date-Manip-6.94-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">d02826cbdda862762e33f007711157ed7443fd122c9e546af669d71afae3d360</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:56969</id>
    <title>Important: php8.4 security, bug fix, and enhancement update</title>
    <issued date="2026-08-20 18:07:20" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:56969 (https://access.redhat.com/errata/RHSA-2026:56969), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

* php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)

* php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:Rocky Linux-223949)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17543" id="CVE-2026-17543" type="cve" title="CVE-2026-17543" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17544" id="CVE-2026-17544" type="cve" title="CVE-2026-17544" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2509256" id="2509256" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2509254" id="2509254" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:56969" id="RLSA-2026:56969" type="self" title="RLSA-2026:56969" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:56969" id="RHSA-2026:56969" type="vendor" title="Red Hat RHSA-2026:56969" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="php8.4-devel" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-devel-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">619296dc200a654c787e06104a4d379a17ba98b4666194d9828b6c987f63f268</sum>
        </package>
        <package name="php8.4-ldap" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-ldap-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c4aa8deae8fc0d0061538f374858ce46fe6eea6f907ba087c14f1900cdd766ea</sum>
        </package>
        <package name="php8.4-fpm" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-fpm-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0706b5f2ba4a3403f657cebcb6049f1e531ac2db7454a5309d11472dcaef0240</sum>
        </package>
        <package name="php8.4-gd" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-gd-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1b159b8e0bae3a98a1902d36fd9148c889e7f9d0bb570028f8a4a800e1c718a8</sum>
        </package>
        <package name="php8.4-snmp" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-snmp-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b284564c0c4ca676b47b696cd02e121bc9e75a99c83d0be9dd47ac1d1244f25a</sum>
        </package>
        <package name="php8.4-gmp" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-gmp-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e8c218a232bbe14bebbb1ef19acf2b57b37d0556800f74185babb1cb04dfa8ca</sum>
        </package>
        <package name="php8.4-bcmath" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-bcmath-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4ecc232c7591a9f04147cd80e4524b67c46d0d34a4a6136c6975720627ed5458</sum>
        </package>
        <package name="php8.4-soap" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-soap-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5cd46851a7eb0c345ef048d300de80a30965a81528791859a7e7bdc025442a16</sum>
        </package>
        <package name="php8.4-mysqlnd" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-mysqlnd-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2f00142f3cf9ec0182a27c91f371e6cea8ae04e7d8cb0a751878f6256815ae40</sum>
        </package>
        <package name="php8.4-dba" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-dba-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4f0d3bee010f0d2bd2846f9192ab37a6005a2797442089497dba7dbaf7208139</sum>
        </package>
        <package name="php8.4-ffi" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-ffi-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e920b077d29462dc96eeb6e09d349de6b969ec6bde209d59cef81098a27ed072</sum>
        </package>
        <package name="php8.4-common" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-common-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9de88d92b9e9e5840349ef956ded02a1158242adb6d82b6a6e4ff3a10858e3b1</sum>
        </package>
        <package name="php8.4-mbstring" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-mbstring-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">797eaa3c37fbaed3b510a1a29d57d42007b6f0e2b0c83dd1bd6524508e60c649</sum>
        </package>
        <package name="php8.4-opcache" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-opcache-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">032cf4d1a4694e29eca22a977cc0317fcefc1fe0bc057d67ebc9402d771ef9ed</sum>
        </package>
        <package name="php8.4-xml" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-xml-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5147fc833e0e9684c3642acc4a494945c0fc3cf237178d482fc6cca928b9a6de</sum>
        </package>
        <package name="php8.4" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">67e0cc8382c63061fac98cc19815954c8c0031d72f348ced9c983539aba52c17</sum>
        </package>
        <package name="php8.4-pgsql" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-pgsql-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f7dcb8a76664c88d750d65d54b14a148f5e4115ce6126f50a19158878885d804</sum>
        </package>
        <package name="php8.4-process" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-process-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a058a1676fecbfc9ab27bb9f9035dc16c576a2d6907671065ab81bd300c60520</sum>
        </package>
        <package name="php8.4-enchant" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-enchant-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">591e10144e6e840705f6b12fd0082a275afee7e7fc22244ce96fdc2548279e30</sum>
        </package>
        <package name="php8.4-odbc" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-odbc-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5b3c49a1faa6031547a855e3694a380d8acdcf85856230ac2f9b44de7064e9e4</sum>
        </package>
        <package name="php8.4-embedded" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-embedded-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fcf853241ff99a8bb2edee25e88edc63291fd8007c6249777e9937485706237d</sum>
        </package>
        <package name="php8.4-pdo" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-pdo-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f70a131ca9cd5785287528ad0322dece3e1971de09950bb9a64bd4abbc168bd1</sum>
        </package>
        <package name="php8.4-cli" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-cli-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7c1588083f83b0aa0e9e8ee3e0cea3cf34c084017153708a2e951af8b4f3e089</sum>
        </package>
        <package name="php8.4-dbg" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-dbg-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c1471fc478d1c629e4d1600813106b859d3f8471d9655ddc83df8a96958218da</sum>
        </package>
        <package name="php8.4-intl" arch="x86_64" epoch="0" version="8.4.24" release="1.el10_2" src="php8.4-8.4.24-1.el10_2.src.rpm">
          <filename>php8.4-intl-8.4.24-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">579ff7249aaa3e62e9e421821a0cd1cf39ea1ac44df146e0f9e70167b02f8a30</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:57126</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-08-20 18:07:20" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:57126 (https://access.redhat.com/errata/RHSA-2026:57126), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810" id="CVE-2026-33810" type="cve" title="CVE-2026-33810" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456335" id="2456335" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:57126" id="RLSA-2026:57126" type="self" title="RLSA-2026:57126" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:57126" id="RHSA-2026:57126" type="vendor" title="Red Hat RHSA-2026:57126" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.9.2" release="1.el10_2.2" src="yggdrasil-0.4.9.2-1.el10_2.2.src.rpm">
          <filename>yggdrasil-0.4.9.2-1.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">a1d0552dce8b557e82df55dba99496862d116b847f3515e9a34f0abfebd033f6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:57148</id>
    <title>Important: ansible-core security update</title>
    <issued date="2026-08-20 18:07:20" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:57148 (https://access.redhat.com/errata/RHSA-2026:57148), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ansible-core.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.

Security Fix(es):

* ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11332" id="CVE-2026-11332" type="cve" title="CVE-2026-11332" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485379" id="2485379" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:57148" id="RLSA-2026:57148" type="self" title="RLSA-2026:57148" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:57148" id="RHSA-2026:57148" type="vendor" title="Red Hat RHSA-2026:57148" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ansible-test" arch="noarch" epoch="1" version="2.16.16" release="2.el10_2.1" src="ansible-core-2.16.16-2.el10_2.1.src.rpm">
          <filename>ansible-test-2.16.16-2.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">b0e71243f4b1efd9acd76fa333732a4b1a54599d7b25696e42fc7f97f44dae80</sum>
        </package>
        <package name="ansible-core" arch="noarch" epoch="1" version="2.16.16" release="2.el10_2.1" src="ansible-core-2.16.16-2.el10_2.1.src.rpm">
          <filename>ansible-core-2.16.16-2.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">3abd7abf089f8abdafb3a185d24117f120ad3b02cdf5797154e3679262b5d9b0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:55798</id>
    <title>Moderate: java-25-openjdk security update</title>
    <issued date="2026-08-21 12:07:48" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:55798 (https://access.redhat.com/errata/RHSA-2026:55798), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for java-25-openjdk.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

* JDK: Improve Resource Resolving (CVE-2026-60589)

* JDK: Enhance HTTP Connections (CVE-2026-61308)

* JDK: Improve font loading (CVE-2026-70906)

* JDK: Enhance TLS server (CVE-2026-70907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60589" id="CVE-2026-60589" type="cve" title="CVE-2026-60589" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61308" id="CVE-2026-61308" type="cve" title="CVE-2026-61308" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-70906" id="CVE-2026-70906" type="cve" title="CVE-2026-70906" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-70907" id="CVE-2026-70907" type="cve" title="CVE-2026-70907" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2513038" id="2513038" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2513035" id="2513035" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2513037" id="2513037" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2513039" id="2513039" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:55798" id="RLSA-2026:55798" type="self" title="RLSA-2026:55798" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:55798" id="RHSA-2026:55798" type="vendor" title="Red Hat RHSA-2026:55798" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="java-25-openjdk-static-libs" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-static-libs-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a516f245d3c7c29757c2f4061f462b4f392c93349e52805489e47686d7f70930</sum>
        </package>
        <package name="java-25-openjdk-devel" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-devel-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ef30c14c935257eceaf55b00707f29ee2f634b0b13c83dc9540a0908f8db5633</sum>
        </package>
        <package name="java-25-openjdk" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7ba60c1e5cce5deec5fb26b5c53100831e5a28c8c0d93c482dfd8c79bde534dd</sum>
        </package>
        <package name="java-25-openjdk-src" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-src-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6a8277cdb35de04ef505861832cc23edce510df6c97c52877606ea6c6f1ad136</sum>
        </package>
        <package name="java-25-openjdk-demo" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-demo-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">005957c1d311cbd92bc9878aab4e2b58b89edb6b659105a83529feda0e90194c</sum>
        </package>
        <package name="java-25-openjdk-crypto-adapter" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-crypto-adapter-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">382c84b969e964d678974edba5fd2a0ef899e6771d26054d8a833c821526f2b5</sum>
        </package>
        <package name="java-25-openjdk-headless" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-headless-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">08e0ea2015ca1f6ead77e8ae0beede297859ae8bfed9ec6315c934e4df189fbc</sum>
        </package>
        <package name="java-25-openjdk-javadoc-zip" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-javadoc-zip-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">aa9faad5b97c31442041d6555fd100507eed968fb5be753b250224747bc7dee2</sum>
        </package>
        <package name="java-25-openjdk-jmods" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-jmods-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5599da99d25f44f324dfb8d2d5e0775cdcb3b49979ca19c8850a59a721a6d5ff</sum>
        </package>
        <package name="java-25-openjdk-javadoc" arch="x86_64" epoch="1" version="25.0.4.1.1" release="1.1.el10_2" src="java-25-openjdk-25.0.4.1.1-1.1.el10_2.src.rpm">
          <filename>java-25-openjdk-javadoc-25.0.4.1.1-1.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3fdf921988e0d1026592eadea9cb2be4fb22540d726c906a1ac50c1a16b9656b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:57596</id>
    <title>Important: mrtg security update</title>
    <issued date="2026-08-21 12:07:48" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:57596 (https://access.redhat.com/errata/RHSA-2026:57596), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mrtg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Multi Router Traffic Grapher (MRTG) monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic.

Security Fix(es):

* mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation (CVE-2026-72694)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72694" id="CVE-2026-72694" type="cve" title="CVE-2026-72694" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460973" id="2460973" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:57596" id="RLSA-2026:57596" type="self" title="RLSA-2026:57596" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:57596" id="RHSA-2026:57596" type="vendor" title="Red Hat RHSA-2026:57596" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mrtg" arch="x86_64" epoch="0" version="2.17.10" release="12.el10_2.1" src="mrtg-2.17.10-12.el10_2.1.src.rpm">
          <filename>mrtg-2.17.10-12.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">e8f2f61d7d6216cc632980e375064fc77ea20c938a8cd31775890e532fab6276</sum>
        </package>
        <package name="mrtg-selinux" arch="noarch" epoch="0" version="2.17.10" release="12.el10_2.1" src="mrtg-2.17.10-12.el10_2.1.src.rpm">
          <filename>mrtg-selinux-2.17.10-12.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">4a250ed1928deb97c7e9478eabb338c5ec835c56f1163f792aa0825f0aa21863</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:58571</id>
    <title>Moderate: qemu-kvm security, bug fix, and enhancement update</title>
    <issued date="2026-08-24 12:08:18" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:58571 (https://access.redhat.com/errata/RHSA-2026:58571), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qemu-kvm.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

* qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914)

Bug Fix(es) and Enhancement(s):

* qemu-kvm hung during drain after double pause [rhel-10.2.z] (JIRA:Rocky Linux-190702)

* qemu-img create/convert fails on target block device with 4k sector size [rhel-10.2.z] (JIRA:Rocky Linux-207389)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48914" id="CVE-2026-48914" type="cve" title="CVE-2026-48914" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488283" id="2488283" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:58571" id="RLSA-2026:58571" type="self" title="RLSA-2026:58571" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:58571" id="RHSA-2026:58571" type="vendor" title="Red Hat RHSA-2026:58571" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qemu-kvm-ui-egl-headless" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-ui-egl-headless-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">076439ae4e24ff0f67595dd9d171b60fc080f0ccd319af32ef9cee5df5532933</sum>
        </package>
        <package name="qemu-img" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-img-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">2c54570126f9e096bd55730e11ef0f51cb3a09c9250f2ba171c54b99d095e8a8</sum>
        </package>
        <package name="qemu-kvm-ui-opengl" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-ui-opengl-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">ae4352673da03a7ebd50aaf2b5802684bb0621cdab447dd360e640209d8ca5b8</sum>
        </package>
        <package name="qemu-kvm-block-curl" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-block-curl-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">415b071c4cbc2ff854717ba337353ec23ecf8fd63964f580d51d00325d6da57c</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-vga" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-vga-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">a0135834aa0ab236ba68e6b82d6aae94942cb13d3e40b72ac95faa1b2e5dfa02</sum>
        </package>
        <package name="qemu-kvm-block-rbd" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-block-rbd-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">e5fd63434b1900267a33569e0a11964c20fab3675768c2bd6f0dcaaccf938d40</sum>
        </package>
        <package name="qemu-kvm-block-blkio" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-block-blkio-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">08fdd7b4c99038cbdadc0be0492bfa29828527dc1c493e426a90b2eaf7b7584c</sum>
        </package>
        <package name="qemu-kvm-device-usb-host" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-device-usb-host-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">6080ea55fef8a341bb18402d0bc24b68ef386f18622ecdfb09a5756704d2f38b</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">ed84e88cf5315463a81cbdc48d14e91fa716cb332d48b98a4222f121a1c175fa</sum>
        </package>
        <package name="qemu-kvm-docs" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-docs-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">d912438ffb56b9c4cca9264ee2ee945ebf76c7db9b0b4ca78bc5e49763331e20</sum>
        </package>
        <package name="qemu-kvm-audio-pa" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-audio-pa-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">6bc0600a3170263079e1b4e6d2765a206753b786a53ba5472733e37783d79142</sum>
        </package>
        <package name="qemu-kvm-core" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-core-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">05e9fa4d47aa870d06ea85439993583d5b30dea1255fbbbb2582e169e10ee46c</sum>
        </package>
        <package name="qemu-guest-agent" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-guest-agent-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">19d7cc0d34b0cc91b89fa117bfb08a00cc9f671467289ea28a9d4398f37a6703</sum>
        </package>
        <package name="qemu-kvm-common" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-common-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">54c5135c332f6cabeec42ed58c50962260a46c88828212c62cd505a85a6a46f3</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu-pci" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">c101d14322d964ce5bc0956a93ad7bd16169076c3c4c148a302e31c6d72e1454</sum>
        </package>
        <package name="qemu-kvm-device-usb-redirect" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">52e4e941cb9e32c25fbfeace1ad3d8dbecdea8a91a743110ecbc3974e2f5645f</sum>
        </package>
        <package name="qemu-kvm" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">bb12478882394b58d1744c272456ffe01bef6d49bc5b295d9c42822e7476f7bb</sum>
        </package>
        <package name="qemu-pr-helper" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-pr-helper-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">608a1047d1cebba5bc45eb1559cf503f9e7b3037a122159c6a3b0b007e38b65d</sum>
        </package>
        <package name="qemu-kvm-tools" arch="x86_64" epoch="8" version="10.1.0" release="16.el10_2.5" src="qemu-kvm-10.1.0-16.el10_2.5.src.rpm">
          <filename>qemu-kvm-tools-10.1.0-16.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">27a833c518f27a12765da2fc5c88546c6662971154429b09f0a29d28854b8e8b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:58819</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-08-25 12:07:46" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:58819 (https://access.redhat.com/errata/RHSA-2026:58819), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

* ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14257" id="CVE-2026-14257" type="cve" title="CVE-2026-14257" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54272" id="CVE-2026-54272" type="cve" title="CVE-2026-54272" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69152" id="CVE-2026-69152" type="cve" title="CVE-2026-69152" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69192" id="CVE-2026-69192" type="cve" title="CVE-2026-69192" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2510722" id="2510722" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2507593" id="2507593" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2506433" id="2506433" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2510801" id="2510801" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:58819" id="RLSA-2026:58819" type="self" title="RLSA-2026:58819" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:58819" id="RHSA-2026:58819" type="vendor" title="Red Hat RHSA-2026:58819" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs24" arch="x86_64" epoch="1" version="24.18.0" release="5.el10_2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-24.18.0-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">51f8f20f3a611f28cb8f73e4144e3c86ed5e0523a4c248b1b80729736f16f4b5</sum>
        </package>
        <package name="nodejs24-full-i18n" arch="x86_64" epoch="1" version="24.18.0" release="5.el10_2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-full-i18n-24.18.0-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">36de343ecff938cc474e493ac7c21ed2aeb390732ea4eb9a8bf7ddae6aae0b09</sum>
        </package>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.18.0" release="5.el10_2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-docs-24.18.0-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">0ddc4acc78f88d95f8818b91c710f50dbfceca7910dc72ec87a64afa12e640fa</sum>
        </package>
        <package name="nodejs24-devel" arch="x86_64" epoch="1" version="24.18.0" release="5.el10_2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-devel-24.18.0-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">df5c7fda2ab8f0f3b3d8069ab51625219294f425021f26372002a26ae4e9975e</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.16.0" release="1.24.18.0.5.el10_2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch.rpm</filename>
          <sum type="sha256">9626bdcdc96e4257368dbb67fed3cbb5b287d553d8a85a7349a4b5947885eebf</sum>
        </package>
        <package name="nodejs24-libs" arch="x86_64" epoch="1" version="24.18.0" release="5.el10_2" src="nodejs24-24.18.0-5.el10_2.src.rpm">
          <filename>nodejs24-libs-24.18.0-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e181249afa05a294f0a288cb542632c02852db29dbc6b6a3f2cdc6dd0a1d1698</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:58899</id>
    <title>Important: firefox security update</title>
    <issued date="2026-08-25 12:07:46" />
    <updated date="2026-08-26 06:10:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:58899 (https://access.redhat.com/errata/RHSA-2026:58899), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component (CVE-2026-74983)

* firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934)

* firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953)

* firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987)

* firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948)

* firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-74943)

* firefox: thunderbird: Information disclosure in the DOM: UI Events &amp; Focus Handling component (CVE-2026-74971)

* firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component (CVE-2026-74941)

* firefox: Privilege escalation in the Shell Integration component (CVE-2026-74965)

* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-74946)

* firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973)

* firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-74949)

* firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990)

* firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936)

* firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-74940)

* firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-74969)

* firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976)

* firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974)

* firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957)

* firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component (CVE-2026-74967)

* firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942)

* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939)

* firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972)

* firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945)

* firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963)

* firefox: thunderbird: Use-after-free in the DOM: Core &amp; HTML component (CVE-2026-74944)

* firefox: Integer overflow in the Graphics component (CVE-2026-74964)

* firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962)

* firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74934" id="CVE-2026-74934" type="cve" title="CVE-2026-74934" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74935" id="CVE-2026-74935" type="cve" title="CVE-2026-74935" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74936" id="CVE-2026-74936" type="cve" title="CVE-2026-74936" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74939" id="CVE-2026-74939" type="cve" title="CVE-2026-74939" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74940" id="CVE-2026-74940" type="cve" title="CVE-2026-74940" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74941" id="CVE-2026-74941" type="cve" title="CVE-2026-74941" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74942" id="CVE-2026-74942" type="cve" title="CVE-2026-74942" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74943" id="CVE-2026-74943" type="cve" title="CVE-2026-74943" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74944" id="CVE-2026-74944" type="cve" title="CVE-2026-74944" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74945" id="CVE-2026-74945" type="cve" title="CVE-2026-74945" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74946" id="CVE-2026-74946" type="cve" title="CVE-2026-74946" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74948" id="CVE-2026-74948" type="cve" title="CVE-2026-74948" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74949" id="CVE-2026-74949" type="cve" title="CVE-2026-74949" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74953" id="CVE-2026-74953" type="cve" title="CVE-2026-74953" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74957" id="CVE-2026-74957" type="cve" title="CVE-2026-74957" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74959" id="CVE-2026-74959" type="cve" title="CVE-2026-74959" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74960" id="CVE-2026-74960" type="cve" title="CVE-2026-74960" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74962" id="CVE-2026-74962" type="cve" title="CVE-2026-74962" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74963" id="CVE-2026-74963" type="cve" title="CVE-2026-74963" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74964" id="CVE-2026-74964" type="cve" title="CVE-2026-74964" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74965" id="CVE-2026-74965" type="cve" title="CVE-2026-74965" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74967" id="CVE-2026-74967" type="cve" title="CVE-2026-74967" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74969" id="CVE-2026-74969" type="cve" title="CVE-2026-74969" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74971" id="CVE-2026-74971" type="cve" title="CVE-2026-74971" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74972" id="CVE-2026-74972" type="cve" title="CVE-2026-74972" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74973" id="CVE-2026-74973" type="cve" title="CVE-2026-74973" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74974" id="CVE-2026-74974" type="cve" title="CVE-2026-74974" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74976" id="CVE-2026-74976" type="cve" title="CVE-2026-74976" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74983" id="CVE-2026-74983" type="cve" title="CVE-2026-74983" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74987" id="CVE-2026-74987" type="cve" title="CVE-2026-74987" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74990" id="CVE-2026-74990" type="cve" title="CVE-2026-74990" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517866" id="2517866" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517874" id="2517874" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517834" id="2517834" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517845" id="2517845" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517859" id="2517859" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517825" id="2517825" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517849" id="2517849" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517840" id="2517840" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517831" id="2517831" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517820" id="2517820" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517826" id="2517826" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517846" id="2517846" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517836" id="2517836" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517841" id="2517841" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517863" id="2517863" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517872" id="2517872" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517833" id="2517833" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517868" id="2517868" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517823" id="2517823" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517853" id="2517853" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517822" id="2517822" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517870" id="2517870" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517819" id="2517819" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517862" id="2517862" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517851" id="2517851" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517839" id="2517839" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517860" id="2517860" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517856" id="2517856" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517837" id="2517837" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517858" id="2517858" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2517835" id="2517835" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:58899" id="RLSA-2026:58899" type="self" title="RLSA-2026:58899" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:58899" id="RHSA-2026:58899" type="vendor" title="Red Hat RHSA-2026:58899" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.14.0" release="1.el10_2" src="firefox-140.14.0-1.el10_2.src.rpm">
          <filename>firefox-140.14.0-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fd16b193630a92fa8e25361bbc39848d32f37b2535f3e431bfa2417aa0f0b9a0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:58928</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-08-25 12:07:46" />
    <updated date="2026-08-26 06:10:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:58928 (https://access.redhat.com/errata/RHSA-2026:58928), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python3.14.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11940" id="CVE-2026-11940" type="cve" title="CVE-2026-11940" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2491848" id="2491848" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:58928" id="RLSA-2026:58928" type="self" title="RLSA-2026:58928" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:58928" id="RHSA-2026:58928" type="vendor" title="Red Hat RHSA-2026:58928" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3.14-libs" arch="x86_64" epoch="0" version="3.14.7" release="2.el10_2" src="python3.14-3.14.7-2.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">428794d6ac6f13c1d922568671aaa6f803a879f149e52c5198c2137c848eb48d</sum>
        </package>
        <package name="python3.14-devel" arch="x86_64" epoch="0" version="3.14.7" release="2.el10_2" src="python3.14-3.14.7-2.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">01f627d9af54a8d843b89d717e122e6912530b6f57821f39cd6351261fc51436</sum>
        </package>
        <package name="python3.14-tkinter" arch="x86_64" epoch="0" version="3.14.7" release="2.el10_2" src="python3.14-3.14.7-2.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">09313e7d0547373bc4cbc91911488d8f0d84b5974979d58445c50cd906adca5d</sum>
        </package>
        <package name="python3.14" arch="x86_64" epoch="0" version="3.14.7" release="2.el10_2" src="python3.14-3.14.7-2.el10_2.src.rpm">
          <filename>python3.14-3.14.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a93652cf130f770dd123b68c81dc63230113fe3cbb72f67ba8f093ee491b4326</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:59097</id>
    <title>Important: gstreamer1-plugins-base security update</title>
    <issued date="2026-08-25 12:07:46" />
    <updated date="2026-08-26 06:10:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:59097 (https://access.redhat.com/errata/RHSA-2026:59097), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

* gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18297" id="CVE-2026-18297" type="cve" title="CVE-2026-18297" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2520572" id="2520572" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:59097" id="RLSA-2026:59097" type="self" title="RLSA-2026:59097" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:59097" id="RHSA-2026:59097" type="vendor" title="Red Hat RHSA-2026:59097" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-base-devel" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.1" src="gstreamer1-plugins-base-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-base-devel-1.26.7-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">b3bd0f809d14100fdd0932daa87e7a1bc6f7c6248d59874a674ec9f2e3a951ab</sum>
        </package>
        <package name="gstreamer1-plugins-base-tools" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.1" src="gstreamer1-plugins-base-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-base-tools-1.26.7-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">7d91f0f7dfff21a8ccd09a84f5c32c87d3f5daa64fc9a57390b9b6124c1af846</sum>
        </package>
        <package name="gstreamer1-plugins-base" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.1" src="gstreamer1-plugins-base-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-base-1.26.7-2.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">a84c79111d6ecbbf21f54efdda715fcbcbcfc48b7316973a67e691f774f1d955</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:59133</id>
    <title>Important: gstreamer1-plugins-good security update</title>
    <issued date="2026-08-25 12:07:46" />
    <updated date="2026-08-26 06:10:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:59133 (https://access.redhat.com/errata/RHSA-2026:59133), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-good.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

* gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)

* gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18296" id="CVE-2026-18296" type="cve" title="CVE-2026-18296" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18298" id="CVE-2026-18298" type="cve" title="CVE-2026-18298" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2520590" id="2520590" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2520580" id="2520580" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:59133" id="RLSA-2026:59133" type="self" title="RLSA-2026:59133" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:59133" id="RHSA-2026:59133" type="vendor" title="Red Hat RHSA-2026:59133" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-good-gtk" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.7" src="gstreamer1-plugins-good-1.26.7-2.el10_2.7.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.7.x86_64.rpm</filename>
          <sum type="sha256">9e3fdd7d764ddd300c97e7da7320e2af2de14bf3ffcad1e2fa040b2cb27a3d9b</sum>
        </package>
        <package name="gstreamer1-plugins-good" arch="x86_64" epoch="0" version="1.26.7" release="2.el10_2.7" src="gstreamer1-plugins-good-1.26.7-2.el10_2.7.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.7.x86_64.rpm</filename>
          <sum type="sha256">9a5d45d7df1babb21bfe8c4acfc4c4908083a40b74e820576804566308178fa5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:59220</id>
    <title>Important: nginx security update</title>
    <issued date="2026-08-25 12:07:46" />
    <updated date="2026-08-26 06:10:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:59220 (https://access.redhat.com/errata/RHSA-2026:59220), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)

* nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56434" id="CVE-2026-56434" type="cve" title="CVE-2026-56434" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60005" id="CVE-2026-60005" type="cve" title="CVE-2026-60005" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500992" id="2500992" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500960" id="2500960" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:59220" id="RLSA-2026:59220" type="self" title="RLSA-2026:59220" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:59220" id="RHSA-2026:59220" type="vendor" title="Red Hat RHSA-2026:59220" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.6" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.6.noarch.rpm</filename>
          <sum type="sha256">7ca1cbfd49937ed24fbe5d644c10b72900a58fae227e2b82113c51f171731c2f</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.6" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">a47298dfca1d48a9d2c6df0247f3f470f5cc9a0a5572b069218c89e588f8dab0</sum>
        </package>
        <package name="nginx" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.6" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">941acd53f884da5310927081e351c79ec11af20788e661ac338d830704b0f2ad</sum>
        </package>
        <package name="nginx-core" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.6" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">9164b892f9a8cecfd5ab39cac4691d2b3514a1fb182447102ffd563e4cdcbfbb</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.6" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.6.noarch.rpm</filename>
          <sum type="sha256">a7020fc6956fa6f8ca78335798dd52b70cb727052ba31cee499cc810262a3675</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.6" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">1e4ffbb41112125111b15c8ac0354ba9d9631c633606537e5cdafbab64c20fd1</sum>
        </package>
        <package name="nginx-mod-mail" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.6" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">7f30ab0d6b994a3e3edc450cd1540bc564bf9acba31634311beae903ee0241c2</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.6" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">7362d949f682eac6c9ec6735f825f0b12a02662b009597d31aaa0ce797ebc800</sum>
        </package>
        <package name="nginx-mod-stream" arch="x86_64" epoch="2" version="1.26.3" release="6.el10_2.6" src="nginx-1.26.3-6.el10_2.6.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.6.x86_64.rpm</filename>
          <sum type="sha256">4bcfc6c1aa268262ad3bab2ad91a2723d93620728294d805a3b6cc811e21ce63</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:59243</id>
    <title>Important: python-pyasn1 security update</title>
    <issued date="2026-08-25 12:07:46" />
    <updated date="2026-08-26 06:10:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:59243 (https://access.redhat.com/errata/RHSA-2026:59243), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-pyasn1.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59886" id="CVE-2026-59886" type="cve" title="CVE-2026-59886" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500041" id="2500041" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:59243" id="RLSA-2026:59243" type="self" title="RLSA-2026:59243" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:59243" id="RHSA-2026:59243" type="vendor" title="Red Hat RHSA-2026:59243" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-pyasn1" arch="noarch" epoch="0" version="0.6.2" release="1.el10_2.1" src="python-pyasn1-0.6.2-1.el10_2.1.src.rpm">
          <filename>python3-pyasn1-0.6.2-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">c7f5a71a6d636d103e6be538aa0a634cbe1479a5b5c61e88572c7d97fbe25929</sum>
        </package>
        <package name="python3-pyasn1-modules" arch="noarch" epoch="0" version="0.6.2" release="1.el10_2.1" src="python-pyasn1-0.6.2-1.el10_2.1.src.rpm">
          <filename>python3-pyasn1-modules-0.6.2-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">9ebe7f2c338cb046ade99d52521199a35e43a52879128bf23b7504c86853240f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22120</id>
    <title>Important: golang security update</title>
    <issued date="2026-08-26 00:08:24" />
    <updated date="2026-08-26 06:10:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation. Advisory content derived from Red Hat RHSA-2026:22120 (https://access.redhat.com/errata/RHSA-2026:22120), © Red Hat, Inc., used under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), with modifications.</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)

* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)

* cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)

* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)

* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)

* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)

* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)

* net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814" id="CVE-2026-33814" type="cve" title="CVE-2026-33814" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817" id="CVE-2026-39817" type="cve" title="CVE-2026-39817" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819" id="CVE-2026-39819" type="cve" title="CVE-2026-39819" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820" id="CVE-2026-39820" type="cve" title="CVE-2026-39820" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823" id="CVE-2026-39823" type="cve" title="CVE-2026-39823" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825" id="CVE-2026-39825" type="cve" title="CVE-2026-39825" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826" id="CVE-2026-39826" type="cve" title="CVE-2026-39826" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836" id="CVE-2026-39836" type="cve" title="CVE-2026-39836" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499" id="CVE-2026-42499" type="cve" title="CVE-2026-42499" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501" id="CVE-2026-42501" type="cve" title="CVE-2026-42501" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467813" id="2467813" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467825" id="2467825" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467811" id="2467811" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467820" id="2467820" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467823" id="2467823" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467815" id="2467815" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467810" id="2467810" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467809" id="2467809" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467822" id="2467822" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467826" id="2467826" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467827" id="2467827" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22120" id="RLSA-2026:22120" type="self" title="RLSA-2026:22120" />
      <reference href="https://access.redhat.com/errata/RHSA-2026:22120" id="RHSA-2026:22120" type="vendor" title="Red Hat RHSA-2026:22120" />
      <reference href="https://creativecommons.org/licenses/by/4.0/" id="CC-BY-4.0" type="other" title="License: CC-BY-4.0" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang-src" arch="noarch" epoch="0" version="1.26.3" release="4.el10_2" src="golang-1.26.3-4.el10_2.src.rpm">
          <filename>golang-src-1.26.3-4.el10_2.noarch.rpm</filename>
          <sum type="sha256">153cd60eadf02f5dfc1f18c705ee535ea0ecc6b1c1cdad07cb433c3cbaef6174</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.26.3" release="4.el10_2" src="golang-1.26.3-4.el10_2.src.rpm">
          <filename>go-toolset-1.26.3-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">98b9e6766e8e1d8d148375464bf3aaa40cfb2c5fae9ac7d2cb94816dc2c6fccb</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.26.3" release="4.el10_2" src="golang-1.26.3-4.el10_2.src.rpm">
          <filename>golang-1.26.3-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6ad8fb114b0760c2d2d2843ad862c194557327aa2e94cca12a4d377994281c9a</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.26.3" release="4.el10_2" src="golang-1.26.3-4.el10_2.src.rpm">
          <filename>golang-misc-1.26.3-4.el10_2.noarch.rpm</filename>
          <sum type="sha256">1ee570427bb147095657c1c2ab705512252433c3eb239c78d63a1030876988fe</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.26.3" release="4.el10_2" src="golang-1.26.3-4.el10_2.src.rpm">
          <filename>golang-docs-1.26.3-4.el10_2.noarch.rpm</filename>
          <sum type="sha256">8f6ed112485b6660020d77ed0c0116c50d2336013fe2ad4bafd1211c1ebbe4ad</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.26.3" release="4.el10_2" src="golang-1.26.3-4.el10_2.src.rpm">
          <filename>golang-tests-1.26.3-4.el10_2.noarch.rpm</filename>
          <sum type="sha256">fec5206501bc9387df09477db267b570a94f3e0564dd66f95c54a949e6463d72</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.26.3" release="4.el10_2" src="golang-1.26.3-4.el10_2.src.rpm">
          <filename>golang-bin-1.26.3-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bbfbfe5f423aa36cf83db63c08125638aed97fa677bd91e9326efab2a473ffa6</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.26.3" release="4.el10_2" src="golang-1.26.3-4.el10_2.src.rpm">
          <filename>golang-race-1.26.3-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bea3f7839e38c9ef8f0e4a38d1a8ac068d4326293441d2b4b8fd62328abbe7ef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>