mysql:8.4 security, bug fix, and enhancement update

mecab 0.996-2.12 - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: 2180411 0.996-2 - Rebuild to fix the issue described in 2000986 - Resolves: 2000986 0.996-1.9 - Release bump for rebuilding on new arches...

java-21-openjdk security update

1:21.0.12.1.1-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.12.1.1-1.1 - Update to jdk-21.0.12.1+1 GA - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - This tarball is embargoed until 2026-08-18 @ 1pm PT. - Resolves: RHEL-235610...

java-17-openjdk security update

17.0.20.1.1-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.20.1.1-1.1 - Update to jdk-17.0.20.1+1 GA - Add to .gitignore openjdk-17.0.20.1+1.tar.xz - Set patchver to 1 - Set buildver to 1 - Update sources to openjdk-17.0.20.1+1.tar.xz - This tarball is embargoed until 2026-08-18 @ 1p...

sssd security update

1.16.5-10.0.7.16 - Fix CVE-2026-14474 and CVE-2026-14476 Orabug: 39831149 1.16.5-10.0.5.16 - krb5: disable Kerberos localauth an2ln plugin for AD/IPA Orabug: 38621159...

java-25-openjdk security update

1:25.0.4.1.1-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:25.0.4.1.1-1.1 - Update to jdk-25.0.4.1+1 GA - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - This tarball is embargoed until 2026-08-18 @ 1p...

java-1.8.0-openjdk security update

1.8.0.504.b01-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.504.b01-1.1 - Update to 8u504-b01 GA. - Update release notes for 8u504-b01. - Bump FreeType version to 2.14.3 following JDK-8385390 - Sync the copy of the portable specfile with the latest update - This tarball is embargoe...

perl-Date-Manip security update

6.60-3.1 - Fix CVE-2026-60075: prevent ReDoS via crafted strings with long interior whitespace runs in date/time parsing - Resolves: RHEL-239807...

ansible-core security update

2.16.16-2.0.1.el102.1 - exclude telemetry from Oracle Linux 1:2.16.16-2.1 - Fix CVE-2026-11332 ansible-galaxy role installs could allow arbitrary git configuration injection via malformed role requirements RHEL-194128...

mysql:8.4 security, bug fix, and enhancement update

mecab 0.996-3.4 - Bump version for package rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo - Resolves: 2182069 0.996-3.3 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz1991688 0.996-3.2 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related:...

perl-Date-Manip security update

6.94-5.1 - Fix CVE-2026-60075: prevent quadratic-cost regex DoS in date/time parsing by rejecting overly long input strings Resolves: RHEL-239790...

pcp security update

6.3.7-8.0.1.el98.4 - Adds interval option support in PCP nfsiostat tool Orabug: 39068870 - Introduces proc.numamaps metrics in linuxproc PMDA Orabug: 39096683 - adds numastat process option in the tool - Added support for size based cleanup for pcp archives Orabug: 38757778 - Implement sorting...

glib2 security update

2.80.4-21 - Fix CVE-2026-15588: limit D-Bus auth line read length 2.80.4-20 - Fix CVE-2026-58011: range validation in gdatetimeaddfull 2.80.4-19 - Fix CVE-2026-58012: buffer overflow in gregex.c with GREGEXRAW 2.80.4-18 - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking 2.80.4-17 ...

gstreamer1-plugins-bad-free security update

1.16.1-9.0.1.el810.2 - Update origin URL Orabug: 36209826 1.16.1-9.2 - Fix IMA ADPCM input size check in adpcmdec CVE-2026-19387 Resolves: RHEL-235503 1.16.1-9.1 - Fix buffer overflow in DTLS certificate subject DN handling CVE-2026-59692 Resolves: RHEL-193570...

php8.4 security, bug fix, and enhancement update

8.4.24-2 - rebase to 8.4.24...

gstreamer1-plugins-good security update

1.16.1-7.3 - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239048 1.16.1-7.2 - Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders Resolves: RHEL-224145 1.16.1-7.1 - Fix multiple security issues in AVI demuxer CVE-2026-73433 Resolves: RHEL-239068...

yggdrasil security update

0.4.9.2-2 - Rebuild yggdrasil against updated golang...

ansible-core security update

1:2.14.18-3.1 - Fix CVE-2026-11332 prevent arbitrary git configuration via role requirements RHEL-194134...

.NET 9.0 security, bug fix, and enhancement update

9.0.120-1.0.1 - Add support for Oracle Linux 9.0.120-1 - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235476...

.NET 10.0 security, bug fix, and enhancement update

10.0.111-1.0.1 - Add support for Oracle Linux 10.0.111-1 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235482...

pam security update

1.3.1-40.0.1 - pamlimits: fix use after free in pamsmopensession Orabug: 36272695 1.3.1-40 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191699...

nodejs:24 security update

nodejs 1:24.18.0-6 - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 memory exhaustion via deeply chained brace groups. as well as CVE-2026-14257 fixed in 5.0.8. 1:24.18.0-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:24.18.0-4 - deps: update sqlite to 3.53.4...

.NET 10.0 security, bug fix, and enhancement update

10.0.111-1.0.1 - Add support for Oracle Linux 10.0.111-1 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235481...

pcp security update

7.0.3-5.0.1 - Fix unterminated backtick in pmloggerjanitor fix not to terminate unauthorized process patch Orabug: 39270658 - Adds interval option support in PCP nfsiostat tool Orabug: 39068870 - Introduces proc.numamaps metrics in linuxproc PMDA Orabug: 39096683 - adds numastat process option in...

pcp security update

5.3.7-22.0.12.el810.5 - Implemented units header in csv output using pmrepOrabug: 39064482 - Adds interval option support in PCP nfsiostat tool Orabug: 38902336 - Introduces proc.numamaps metrics in linuxproc PMDA Orabug: 38509848 - adds numastat process option in the tool - Added support for siz...

nghttp2 security update

1.33.0-6.3 - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055...

mysql8.4 security, bug fix, and enhancement update

8.4.11-1 - Rebase to 8.4.11...

sg3_utils security, bug fix, and enhancement update

1.44-6.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188162...

nodejs:22 security update

nodejs 1:22.23.1-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223914 RHEL-223798 1:22.23.1-3 - deps: update sqlite to 3.53.4 Fix: CVE-2026-11824, CVE-2026-11822 nodejs-nodemon nodejs-packag...

python3 security update

3.6.8-78.0.1 - Add Oracle Linux distribution in platform.py Orabug: 20812544 3.6.8.openela.0 - Add openela to supported dists 3.6.8-78 - Security fix for CVE-2026-11940 Resolves: RHEL-227194...

attr security update

2.6.0-1 - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr RHEL-186121 - fix couple of rpminspect warnings...

gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update

gstreamer1-plugins-bad-free 1.22.12-7.4 - Fix ADPCM decoder negotiation and input size check CVE-2026-19387 Resolves: RHEL-235496 gstreamer1-plugins-ugly-free 1.22.12-6.2 - Fix integer overflows during bounds checks in asfdemux - Resolves: RHEL-235519...

gstreamer1-plugins-bad-free security update

1.26.7-2.7 - Fix ADPCM decoder input validation CVE-2026-19387 Resolves: RHEL-235500 1.26.7-2.5 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats CVE-2026-59691 Resolves: RHEL-193550 1.26.7-2.4 - Fix bytes/bits confusion in AV1 tile data size parsing CVE-2026-52718 Resolves...

389-ds:1.4 security update

1.4.3.39-26 - Bump version to 1.4.3.39-26 - Resolves: RHEL-183073 - EMBARGOED CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check rhel-8.10.z - Resolves: RHEL-190782 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref contro...

libXfont2 security update

2.0.3-2.3 - CVE fix for: CVE-2026-59679 Resolves: https://redhat.atlassian.net/browse/RHEL-221956 2.0.3-2.2 - CVE fix for: CVE-2026-44950 Resolves: https://redhat.atlassian.net/browse/RHEL-222015...

unbound security update

1.24.2-18 - Add unit tests for CVE-2026-44690,55973 1.24.2-17 - Fix CVE-2026-55973: dns-error-reporting stack buffer overflow 1.24.2-16 - Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning...

libXfont2 security update

2.0.3-12.3 - CVE fix for: CVE-2026-59679 Resolves: https://redhat.atlassian.net/browse/RHEL-221957 2.0.3-12.2 - CVE fix for: CVE-2026-44950 Resolves: https://redhat.atlassian.net/browse/RHEL-222029...

bind security update

9.18.33-15.0.1.el102.10 - Hard require needed openssl-libs Orabug: 38742109 - Fix warning when changing device file permissions Orabug: 36518580 32:9.18.33-15.10 - Validate NSEC3 signer matches owning zone CVE-2026-10723 32:9.18.33-15.9 - Reject out-of-zone NSEC next owner names CVE-2026-13321...

haproxy security update

1.8.27-5.2 - Fix NULL pointer dereference in hpackdhtinsert CVE-2026-55204, RHEL-211083...

haproxy security update

3.0.5-6.2 - Fix uint16t overflow in FCGI demux record length CVE-2026-55203 Resolves: RHEL-211068 - Fix NULL pointer dereference in hpackdhtinsert CVE-2026-55204 Resolves: RHEL-211081...

389-ds-base security update

3.2.0-9 - Bump version to 3.2.0-9 - Resolves: RHEL-183075 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check rhel-10.2.z - Resolves: RHEL-190776 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parse...

gstreamer1-plugins-ugly-free security update

1.26.7-2.2 - Fix CVE-2026-19389: integer overflow vulnerabilities in asfdemux Resolves: RHEL-235515...

unbound security update

1.16.2-5.14 - Add unit test for CVE-2026-44690 from upstream. 1.16.2-5.13 - Fix CVE-2026-44690 RHEL-212801...

bind9.18 security update

32:9.18.29-14.8 - Fix NSEC3 signer validation CVE-2026-10723, RHEL-215704 32:9.18.29-14.7 - Reject out-of-zone NSEC next owner names CVE-2026-13321, RHEL-213314 32:9.18.29-14.6 - Fix cache exhaustion via dnsslabheaders CVE-2026-11622, RHEL-213389 32:9.18.29-14.5 - Reject invalid signed wildcard...

libXfont2 security update

2.0.6-5.3 - CVE fix for: CVE-2026-59679 Resolves: https://redhat.atlassian.net/browse/RHEL-221949 2.0.6-5.2 - CVE fix for: CVE-2026-44950 Resolves: https://redhat.atlassian.net/browse/RHEL-222024...

glib2 security update

2.68.4-19.9 - Fix CVE-2026-15588: limit D-Bus auth line read length 2.68.4-19.8 - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Resolves: RHEL-212157 2.68.4-19.7 - Fix CVE-2026-58012: buffer overflow in gregex.c with GREGEXRAW - Resolves: RHEL-212217 2.68.4-19.6 - Fix...

gstreamer1-plugins-good security update

1.26.7-2.5 - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239045 1.26.7-2.4 - Fix out-of-bounds reads when parsing FUJIFILM strd metadata in AVI files CVE-2026-73433 Resolves: RHEL-239062...

curl security update

8.12.1-4.4 - fix proxy environment variable change detection CVE-2026-8927 8.12.1-4.el102.3 - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak via redirect and netrc CVE-2026-3783 - fix proxy connection reuse with wrong credentials CVE-2026-3784...

nodejs22 security update

1:22.23.1-4.0.1 - Add c-ares as dependency orabug 39781219 1:22.23.1-6 - Fix for CVE-2026-69152 1:22.23.1-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:22.23.1-4 - Fix CVE-2026-13149 npm/brace-expansion 1:22.23.1-3 - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 node-tar...

haproxy security update

2.8.14-3.2 - Fix NULL pointer dereference in hpackdhtinsert CVE-2026-55204 Resolves: RHEL-211082 2.8.14-3.1 - Fix uint16t overflow in FCGI demux record length CVE-2026-55203 Resolves: RHEL-211062...

389-ds-base security update

2.8.0-9 - Resolves: RHEL-183082 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check rhel-9.8.z - Resolves: RHEL-190775 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser rhel-9.8.z - Resolves:...