ALSA-2026:69113 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

ALSA-2026:69098 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page CVE-2026-19154 chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium CVE-2026-19173...

ALSA-2026:69259 Moderate: tomcat update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication...

ALSA-2026:69125 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: curl: Information...

ALSA-2026:69277 Important: corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fixes: corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly CVE-2026-81665 For more details about the security issues, including...

ALSA-2026:69126 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...

ALSA-2026:69130 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...

ALSA-2026:69462 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Use-after-free in the SVG component CVE-2026-92024 firefox: thunderbird: Mitigation bypass in the Remote Settings Client component CVE-2026-92019...

ALSA-2026:69293 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

ALSA-2026:69387 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS...

ALSA-2026:69308 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: mime: golang: Golang MIME: Denial of Service via...

ALSA-2026:69099 Important: yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that matc...

ALSA-2026:68676 Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:68786 Important: perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System DNS resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fixes: perl-Net-DNS: Net::DNS: Denial of Service...

ALSA-2026:68787 Important: perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System DNS resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fixes: perl-Net-DNS: Net::DNS: Denial of Service...

ALSA-2026:68532 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: ipvlan: Make the addrslock be per port CVE-2026-23103 kernel: xfrm: hold dev ref until after transportfinish NFHOOK CVE-2026-31663...

ALSA-2026:68692 Important: sudo security, bug fix, and enhancement update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fixes: sudo: Sudo: Policy bypass allows unauthorized...

ALSA-2026:68660 Moderate: tomcat security, bug fix, and enhancement update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication...

ALSA-2026:68570 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow CVE-2026-23172 kernel: xfrm: hold dev ref until after transportfinish NFHOOK CVE-2026-31663 kernel: RDMA/rxe: Fix race...

ALSA-2026:68549 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM: Workers component CVE-2026-16365 firefox: thunderbird: Sandbox escape in the Remote Settings Client component...

ALSA-2026:68531 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipvlan: Make the addrslock be per port CVE-2026-23103 kernel: xfrm: hold dev ref until after transportfinish NFHOOK CVE-2026-31663 kernel: netfilter: nfconntrackh323: fix OOB read in...

ALSA-2026:68507 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number CVE-2024-58007 kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow CVE-2026-23172 kernel: net: ena:...

ALSA-2026:68677 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-41293...

ALSA-2026:68651 Moderate: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

ALSA-2026:68292 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

ALSA-2026:68235 Important: libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications...

ALSA-2026:68291 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

ALSA-2026:68233 Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:68316 Moderate: .NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:68234 Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denia...

ALSA-2026:68011 Important: microcode_ctl security, bug fix, and enhancement update

The microcodectl packages provide microcode updates for Intel and AMD processors. Security Fixes: kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling CVE-2025-35973 kernel: microcodectl: Intel Xeon 6 Processors: Privilege escalation via improper memory...

ALSA-2026:67873 Important: corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fixes: corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly CVE-2026-81665 For more details about the security issues, including...

ALSA-2026:67886 Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fixes: coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input...

ALSA-2026:67979 Important: microcode_ctl security, bug fix, and enhancement update

The microcodectl packages provide microcode updates for Intel and AMD processors. Security Fixes: kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling CVE-2025-35973 kernel: microcodectl: Intel Xeon 6 Processors: Privilege escalation via improper memory...

ALSA-2026:68266 Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation CVE-2026-15711 For more details about the security issues, including the impact, a...

ALSA-2026:67910 Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...

ALSA-2026:67832 Important: tesseract security update

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fixes: tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata CVE-2026-73066 For more...

ALSA-2026:67943 Important: python-lxml security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:67909 Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...

ALSA-2026:67831 Important: tesseract security update

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fixes: tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata CVE-2026-73066 For more...

ALSA-2026:67872 Important: corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fixes: corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly CVE-2026-81665 For more details about the security issues, including...

ALSA-2026:67848 Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector an...

ALSA-2026:67908 Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...

ALSA-2026:67613 Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:67614 Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:67528 Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:67524 Moderate: .NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:67525 Moderate: .NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:67530 Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:67469 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast addre...