libinput security update

1.30.1-2 - CVE-2026-50292: sanitize phys before printing it in libinput-device-group Resolves: RHEL-182371...

libxml2 security update

2.12.5-10.2 - Fix CVE-2025-6170 RHEL-182007 2.12.5-10.1 - Fix CVE-2024-34459 RHEL-177890...

python3.12 security update

3.12.13-2.0.1.el102.1 - Remove upstream URL reference 3.12.13-2.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193771...

aardvark-dns security update

2:1.17.1-1 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.17.1 - Resolves: RHEL-170143...

fence-agents security update

4.16.0-21.2 - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 4.16.0-21.1 - bundled pyasn1: replace with dependency to fix CVE-2026-30922 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-157187, RHEL-155668...

PackageKit security update

1.2.8-8.0.1 - remove RHEL vendor patch PackageKit-0.3.8-RHEL-Vendor.conf.patch...

yggdrasil-worker-package-manager security update

0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild...

kernel security update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

frr security update

10.4.4-1 - Resolves: RHEL-166035 - Bump FRR to 10.4.3 to fix EVPN problems...

libsolv security update

0.7.33-5 - Fix a buffer overflow when decompressing solv pages CVE-2026-48864 RHEL-178270 0.7.33-4 - Cope with integer overflow in data size arithmetics in repoaddsolv CVE-2026-9149 RHEL-178267 0.7.33-3 - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian repository CVE-2026-91...

dovecot security update

1:2.3.21-19 - update release for rebuild 1:2.3.21-18 - fix CVE-2026-27858: denial of service via crafted message before authentication RHEL-161626 - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command RHEL-162274 - fix CVE-2026-27857: denia...

glib2 security update

2.80.4-13 - Fix CVE-2025-14087 and CVE-2025-14512...

gdk-pixbuf2 security update

2.42.12-5 - jpeg: Reject unsupported number of components...

python3.14-urllib3 security update

2.6.3-2 - Security fix for CVE-2026-44431 and CVE-2026-44432 - Resolves: RHEL-184903 - Resolves: RHEL-185128...

libsndfile security update

1.2.2-6.1 - apply patch for CVE-2026-37555 Resolves: ?RHEL-174531...

perl-IO-Compress security update

2.212-512.1 - Fix CVE-2026-48962: remove use of eval in File::GlobMapper - Resolves: RHEL-180415...

ruby4.0 security update

4.0.3-35 - Fix Net::IMAP ResponseReader quadratic complexity vulnerability CVE-2026-42245 Includes core fix plus additional performance optimizations Resolves: RHEL-181675 - Fix Net::IMAP STARTTLS stripping vulnerability CVE-2026-42246 Resolves: RHEL-181767 - Fix Net::IMAP command injection...

ruby security update

3.3.10-13 - Fix DoS via crafted IMAP responses in net-imap. CVE-2026-42245 Resolves: RHEL-181687 - Fix information disclosure via MITM attack bypassing TLS in net-imap. CVE-2026-42246 Resolves: RHEL-181775 - Fix command injection via Symbol arguments in net-imap. CVE-2026-42258 Resolves: RHEL-181...

flatpak security update

1.16.0-9.1 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170157...

perl-XML-LibXML security update

1:2.0210-4.1 - Fix out-of-bounds heap read on truncated UTF-8 sequences CVE-2026-8177 - Resolves: RHEL-186521...

glibc security, bug fix, and enhancement update

2.39-126.0.1 - Forward port Oracle changes to 2.39-126. - Reviewed-by: Jose E. Marchesi Oracle history: Jul-15-2026 Cupertino Miranda - 2.39-124.0.1 - Forward port Oracle changes to 2.39-124. - Reviewed-by: Jose E. Marchesi May-19-2026 Cupertino Miranda - 2.39-121.0.1 - Forward port Oracle change...

freeipmi security update

1.6.18-1 - Update to 1.6.18...

gstreamer1-plugins-ugly-free security update

1.26.7-2.1 - Fix CVE-2026-53703: multiple security issues in rmdemux Resolves: RHEL-184439...

gstreamer1-plugins-bad-free security update

1.26.7-2.4 - Fix bytes/bits confusion in AV1 tile data size parsing CVE-2026-52718 Resolves: RHEL-184391 1.26.7-2.3 - Fix for CVE-2026-52719 Resolves: RHEL-184406 1.26.7-2.2 - Fix integer overflows in VMnc decoder CVE-2026-52722 Resolves: RHEL-184425 1.26.7-2.1 - Fix for CVE-2026-52720: validate...

gstreamer1-plugins-good security update

1.26.7-2.1 - Fix integer overflow vulnerabilities in wavpack decoder CVE-2026-53705 Resolves: RHEL-184480...

nodejs22 security, bug fix, and enhancement update

1:22.23.1-2 - CVE-2026-42338 ip-address HTML escaping fix. 1:22.23.1-1 - Update to version 22.23.1 1:22.22.2-2 - De-bundle c-ares, libuv - we waited for c-ares for about 4 months, so added conditional flag in case it falls behind in future again, same for libuv...

python-markdown security update

3.5.1-6.1 - Fix CVE-2025-69534 RHEL-153740...

.NET 8.0 security update

8.0.128-1.0.1 - Add support for Oracle Linux 8.0.128-1 - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 8.0.127-1 - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173924...

libtasn1 security update

4.20.0-5 - Fix for CVE-2025-13151 stack buffer overflow 4.20.0-4 - Switch to autosetup 4.20.0-3 - plans/ci: modify plan names 4.20.0-2 - Properly check valgrind arches...

coreutils security update

9.5-8.0.1 - clean up empty file if cp is failed Orabug 15973168 9.5-8 - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification RHEL-180649...

libexif security update

0.6.24-9.1 - Fix integer underflow in MakerNote decoding CVE-2026-40386 Resolves: RHEL-170240...

dnsmasq security update

2.90-7 - Prevent overflow in extractname function CVE-2026-2291 - Prevent DoS in DNSSEC validation CVE-2026-4890 - Prevent out-of-bounds read in DNSSEC validation CVE-2026-4891 - Prevent out-of-bounds write in DHCPv6 server CVE-2026-4892 - Prevent source check avoidance by RFC 7871 client-subnet...

rrdtool security update

1.8.0-21 - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173264...

python3.12 security update

3.12.13-3.0.1.el98.1 - Remove upstream URL reference 3.12.13-3.1 - Security fix for CVE-2026-15308 Resolves: RHEL-RHEL-193793...

mariadb10.11 security, bug fix, and enhancement update

3:10.11.18-1 - Rebase to 10.11.18 3:10.11.17-1 - Rebase to 10.11.17 3:10.11.16-1 - Rebase to 10.11.16...

poppler security update

24.02.0-7.el102.2 - Fix integer overflow in tilingPatternFill CVE-2026-10118 - Bump NVR for MR - Resolves: RHEL-180565 24.02.0-7.el102.1 - Fix integer overflow in tilingPatternFill CVE-2026-10118 - Resolves: RHEL-180565...

wireshark security update

4.4.2-10.0.1 - Fix post script to not fail during initial installation Orabug: 37565359 1:4.4.2-10 - Resolves: RHEL-173221 - CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory 1:4.4.2-9 - Resolves: RHEL-173218 - CVE-2026-5405 Heap-based Buffer Overflow 1:4.4.2-8 - Resolves:...

jq security update

1.7.1-13 - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions 1.7.1-12 - Fix CVE-2026-39979 out-of-bounds read in jvparsesized...

grafana security update

10.2.6-27 - Resolves: RHEL-183694: CVE-2026-39821 10.2.6-26 - Resolves RHEL-161791: CVE-2026-27877 - Resolves RHEL-166459: CVE-2026-32282 - Resolves RHEL-167494: CVE-2026-32283...

php security update

8.3.31-1 - rebase to 8.3.31 - add tmpfiles.d configuration file for ImageMode...

mysql8.4 security update

8.4.9-1 - Rebase to 8.4.9 8.4.8-2 - Revert to soft static allocation of MariaDB and MySQL sysusers.d files...

vim security update

9.1.083-9.0.1.el102.7 - Remove upstream references Orabug: 31197557 2:9.1.083-9.7 - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete 2:9.1.083-9.6 - RHEL-185867 CVE-2026-47167 vim: Code...

expat security update

2.7.3-57 - expat: backport CVE-2026-45186 fix attribute collision check DoS 2.7.3-56 - Rebase to 2.7.3 and add VCS tag Thu Jun 05 2025 [email protected] - https://issues.redhat.com/browse/RHELMISC-13073 Fri Mar 28 2025 Tomas Korbar - Fix behavior change caused by fix for CVE-2024-8176 Fri Mar 1...

cifs-utils security, bug fix, and enhancement update

7.0-5 - resolves: RHEL-192933 - fix krb5 mount regression 7.0-4 - cifs.upcall: remove getpwuid dependency - cifs.upcall: fix compiler warning with -Wvla - Resolves: RHEL-185759 - Fix CVE-2026-12505 7.0-3 - docs: update echointerval description - Resolves: RHEL-80397 7.0-2 - mount.cifs.rst: add...

Unbreakable Enterprise kernel security update

6.12.0-204.92.4.3 - xfrm: hold dev ref until after transportfinish NFHOOK Qi Tang Orabug: 39727259 CVE-2026-31663 - xfrm: hold device only for the asynchronous decryption Jianbo Liu Orabug: 39727259 - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry Hyunwoo Kim...

glibc security update

2.39-121.0.1 - Forward port Oracle changes to 2.39-121. - Reviewed-by: David Faust Oracle history: April-2-2026 Cupertino Miranda - 2.39-113.0.1 - Reverted to version 2.39-113. - Reviewed-by: David Faust February-3-2026 Cupertino Miranda - 2.39-99.0.1 - Forward port Oracle changes to 2.39-99. -...

perl-XML-LibXML security update

1:2.0132-3 - Fix out-of-bounds heap read via truncated UTF-8 in node name validation CVE-2026-8177 - Resolves: RHEL-186519...

maven:3.9 security update

aopalliance 0:1.0-49 - Update javapackages test plan to f42 0:1.0-40 - Rebuilt for https://fedoraproject.org/wiki/Fedora41MassRebuild 0:1.0-39 - Rebuilt for java-21-openjdk as system jdk 0:1.0-38 - bump of release for for java-21-openjdk as system jdk 0:1.0-37 - Rebuilt for...

openssl security update

3.5.5-2.0.1 - Replace upstream references Orabug: 34340177 - Update FIPS provider name Orabug: 35824276 1:3.5.5-2 - Fix CVE-2026-31790 Resolves: RHEL-161574 1:3.5.5-1 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-122599 Resolves: RHEL-141987 Resolves: RHEL-142009 Resolves: RHEL-142022 Resolves:...