ALSA-2026:89905 Moderate: freeipmi security, bug fix, and enhancement update

The freeipmi packages contain an Intelligent Platform Management Interface IPMI remote console and system management software based on the IPMI specification. Security Fixes: FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses CVE-2026-85504 FreeIPMI:...

ALSA-2026:89082 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: tcp: restrict SOATTACHFILTER to priv users CVE-2026-53236 kernel: fuse: re-lock request before replacing page cache folio...

ALSA-2026:89083 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tcp: restrict SOATTACHFILTER to priv users CVE-2026-53236 kernel: fuse: re-lock request before replacing page cache folio CVE-2026-53388 kernel: writeback: fix race between...

ALSA-2026:88550 Critical: ca-certificates security update

The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure PKI. Security Fixes: ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 For...

ALSA-2026:A013 Important: php:8.0 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

ALSA-2026:A014 Important: php:8.1 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

ALSA-2026:A012 Important: php:7.3 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

ALSA-2026:A011 Important: php:7.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

ALSA-2026:88211 Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw CVE-2026-599...

ALSA-2026:88455 Critical: ca-certificates security update

The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure PKI. Security Fixes: ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 For...

ALSA-2026:88360 Important: postgresql18-pgvector security update

Open-source vector similarity search for Postgres. Supports L2 distance, inner product, and cosine distance Security Fixes: pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 For more details about the security issues, including the...

ALSA-2026:88202 Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: The podman run command can be instructed to disable almost all sandboxing -...

ALSA-2026:88189 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer...

ALSA-2026:88354 Critical: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer...

ALSA-2026:88280 Important: golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fixes: net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial o...

ALSA-2026:88459 Critical: ca-certificates security update

The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure PKI. Security Fixes: ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 For...

ALSA-2026:87805 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets CVE-2025-22063 kernel: calipso: Don't call calipso functions for AFINET sk. CVE-2025-38147 kernel: ALSA: hda/cs35l41...

ALSA-2026:88421 Important: qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fixes: qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack i...

ALSA-2026:88207 Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fixes: iperf3: iperf3: Denial of Service via UDP receive worker infinite loop CVE-2026-102253 For more details about the...

ALSA-2026:88229 Important: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer overflow in moddavfs...

ALSA-2026:88359 Important: postgresql16-pgvector security update

Open-source vector similarity search for Postgres. Supports L2 distance, inner product, and cosine distance Security Fixes: pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 For more details about the security issues, including the...

ALSA-2026:88477 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: calipso: Don't call calipso functions for AFINET sk. CVE-2025-38147 kernel: ipv4: raw: reject IPHDRINCL packets with ihl 5 CVE-2026-64114 kernel: net/smc: reject CHID-0 ACCEPT that matche...

ALSA-2026:88247 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read in XMLParseBuffer CVE-2026-77214 For more details about the security issues, includin...

ALSA-2026:88336 Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667...

ALSA-2026:88164 Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fixes: libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion CVE-2026-63276...

ALSA-2026:88316 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer...

ALSA-2026:88188 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extensio...

ALSA-2026:88262 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

ALSA-2026:88248 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read in XMLParseBuffer CVE-2026-77214 For more details about the security issues, includin...

ALSA-2026:87375 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: raw: reject IPHDRINCL packets with ihl msiperm after freeing it on init failure CVE-2026-89777 For more details about the security issues, including the impact, a CVSS score,...

ALSA-2026:87374 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: ipv4: raw: reject IPHDRINCL packets with ihl msiperm after freeing it on init failure CVE-2026-89777 For more details about the...

ALSA-2026:86981 Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

ALSA-2026:86982 Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

ALSA-2026:87070 Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87082 Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase:...

ALSA-2026:86921 Important: librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 For more details about the security issues, including the impact, a CVSS score,...

ALSA-2026:87151 Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:86907 Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests...

ALSA-2026:86970 Moderate: cockpit-machines security update

Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list...

ALSA-2026:86594 Critical: .NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:86706 Moderate: jackson-core security update

Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes: com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89407 com.fasterxml.jackson.core/jackson-core:...

ALSA-2026:86983 Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fixes:...

ALSA-2026:87071 Important: php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

ALSA-2026:86841 Important: librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 For more details about the security issues, including the impact, a CVSS score,...

ALSA-2026:86842 Important: librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 For more details about the security issues, including the impact, a CVSS score,...

ALSA-2026:86971 Moderate: cockpit-machines security update

Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list...

ALSA-2026:87072 Important: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87079 Important: php:8.3 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87073 Important: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87080 Important: php:7.4 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Out-of-bounds read via empty HTTP redirect Location header CVE-2026-93682 php: PHP: Archive entry injection via integer overflow in TAR parser CVE-2026-6103 php: PHP: Denial of Service...