<?xml version="1.0" encoding="UTF-8"?>
<updates>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18134</id>
    <title>Moderate: kernel security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-06-08 10:12:39"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)
  * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
  * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)
  * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)
  * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)
  * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)
  * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)
  * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)
  * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)
  * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)
  * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)
  * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)
  * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)
  * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
  * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
  * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)
  * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)
  * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
  * kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210)
  * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257)
  * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)
  * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)
  * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
  * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
  * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18134" id="RHSA-2026:18134" type="rhsa" title="RHSA-2026:18134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56633" id="CVE-2024-56633" type="cve" title="CVE-2024-56633"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-21839" id="CVE-2025-21839" type="cve" title="CVE-2025-21839"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-37980" id="CVE-2025-37980" type="cve" title="CVE-2025-37980"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38015" id="CVE-2025-38015" type="cve" title="CVE-2025-38015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38097" id="CVE-2025-38097" type="cve" title="CVE-2025-38097"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38166" id="CVE-2025-38166" type="cve" title="CVE-2025-38166"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38202" id="CVE-2025-38202" type="cve" title="CVE-2025-38202"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38267" id="CVE-2025-38267" type="cve" title="CVE-2025-38267"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38275" id="CVE-2025-38275" type="cve" title="CVE-2025-38275"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38279" id="CVE-2025-38279" type="cve" title="CVE-2025-38279"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38345" id="CVE-2025-38345" type="cve" title="CVE-2025-38345"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38346" id="CVE-2025-38346" type="cve" title="CVE-2025-38346"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38405" id="CVE-2025-38405" type="cve" title="CVE-2025-38405"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38441" id="CVE-2025-38441" type="cve" title="CVE-2025-38441"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38470" id="CVE-2025-38470" type="cve" title="CVE-2025-38470"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-39866" id="CVE-2025-39866" type="cve" title="CVE-2025-39866"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40034" id="CVE-2025-40034" type="cve" title="CVE-2025-40034"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40134" id="CVE-2025-40134" type="cve" title="CVE-2025-40134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40210" id="CVE-2025-40210" type="cve" title="CVE-2025-40210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40257" id="CVE-2025-40257" type="cve" title="CVE-2025-40257"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40320" id="CVE-2025-40320" type="cve" title="CVE-2025-40320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23040" id="CVE-2026-23040" type="cve" title="CVE-2026-23040"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23111" id="CVE-2026-23111" type="cve" title="CVE-2026-23111"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23210" id="CVE-2026-23210" type="cve" title="CVE-2026-23210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23243" id="CVE-2026-23243" type="cve" title="CVE-2026-23243"/>
      <reference href="https://bugzilla.redhat.com/2334549" id="2334549" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2350585" id="2350585" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2367614" id="2367614" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2373343" id="2373343" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376060" id="2376060" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376065" id="2376065" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376382" id="2376382" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379178" id="2379178" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379187" id="2379187" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379199" id="2379199" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379237" id="2379237" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379239" id="2379239" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383399" id="2383399" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383478" id="2383478" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383906" id="2383906" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2396940" id="2396940" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2406782" id="2406782" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2414468" id="2414468" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2416307" id="2416307" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2418880" id="2418880" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2419945" id="2419945" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436806" id="2436806" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439687" id="2439687" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439895" id="2439895" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448594" id="2448594" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18134.html" id="ALSA-2026:18134" type="self" title="ALSA-2026:18134"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="kernel-devel" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.7.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">00c249ef56f725f5bc0c715786c60e1d4450fafd8298fae20f860781dd957236</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.7.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">23c1a4918a16e29c872c22ce626b772e19fade6d7a99dbf25c76b961ebfa9f06</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.7.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">78db96b63b180a526d27658a5f66bd367e0d516ce72b83b9aa8ec6f642d3b051</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.7.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">89d0a5771601d2a944bd7ab993eeca787fa90434c2be0fefd564e445d2f47e6f</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.7.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">aee6a113ac1b79fc108d0bb2e605bdf7cecb0bc345fe2bf36fae217aff323acf</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.7.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bfef2f66e2a3c43eab464b8a7a88e5bb1e29cf71cc5b9bc85000d81f0595cc87</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.7.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c87121c99170b0691980bcc67e10983a5b313f925ba02d17581579b6ec00b843</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.7.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c906dd0538092bc645d256010a8a94252ac0c63c965e8bb6f9827f78b086e8b0</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.7.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cc099b6d02fe43771c72d9a39c2f29d95db9552daab3139c0df2bda2caa20299</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.7.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e2602013cdcbaf36c66c812eefbe6720d81305e1160fe2068e660dc3c14ad3fb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18142</id>
    <title>Low: NetworkManager security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:32:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>NetworkManager security update</summary>
    <description>NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.  

Security Fix(es):  

  * networkmanagr: NetworkManager File Access (CVE-2025-9615)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18142" id="RHSA-2026:18142" type="rhsa" title="RHSA-2026:18142"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-9615" id="CVE-2025-9615" type="cve" title="CVE-2025-9615"/>
      <reference href="https://bugzilla.redhat.com/2391503" id="2391503" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18142.html" id="ALSA-2026:18142" type="self" title="ALSA-2026:18142"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="NetworkManager-ppp" version="1.56.0" release="1.el10" epoch="1" arch="x86_64" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-ppp-1.56.0-1.el10.x86_64.rpm</filename>
          <sum type="sha256">3438308b6a9d5ab359c27f7a24fbd746f30cd77067ed89c0a315895c7ddc77a2</sum>
        </package>
        <package name="NetworkManager-config-connectivity-redhat" version="1.56.0" release="1.el10" epoch="1" arch="noarch" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-config-connectivity-redhat-1.56.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">3c3510b6b69347004ae5092b71485721e86928b812cdbbb21a7a13cf2a6cf1ec</sum>
        </package>
        <package name="NetworkManager-ovs" version="1.56.0" release="1.el10" epoch="1" arch="x86_64" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-ovs-1.56.0-1.el10.x86_64.rpm</filename>
          <sum type="sha256">ca5a190a8c2045429296fe17e38b21e582a0c4f50bb9e7febd938562cc7bbca0</sum>
        </package>
        <package name="NetworkManager-cloud-setup" version="1.56.0" release="1.el10" epoch="1" arch="x86_64" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-cloud-setup-1.56.0-1.el10.x86_64.rpm</filename>
          <sum type="sha256">d18dad6691a473b3b0ce4ffe407a8357f7d72bb57f03e48d2b50b66fcab2744c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18143</id>
    <title>Moderate: p11-kit security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:34"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>p11-kit security update</summary>
    <description>The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.  

Security Fix(es):  

  * p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters (CVE-2026-2100)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18143" id="RHSA-2026:18143" type="rhsa" title="RHSA-2026:18143"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2100" id="CVE-2026-2100" type="cve" title="CVE-2026-2100"/>
      <reference href="https://bugzilla.redhat.com/2437308" id="2437308" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18143.html" id="ALSA-2026:18143" type="self" title="ALSA-2026:18143"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="p11-kit-server" version="0.26.2" release="1.el10" epoch="0" arch="x86_64" src="p11-kit-0.26.2-1.el10.src.rpm">
          <filename>p11-kit-server-0.26.2-1.el10.x86_64.rpm</filename>
          <sum type="sha256">94e98530ead1b3e830ba31c086539f45869a90eda72b2249b4a8acd342c2afef</sum>
        </package>
        <package name="p11-kit-devel" version="0.26.2" release="1.el10" epoch="0" arch="x86_64" src="p11-kit-0.26.2-1.el10.src.rpm">
          <filename>p11-kit-devel-0.26.2-1.el10.x86_64.rpm</filename>
          <sum type="sha256">e163486a8a18542a024532bebaa7604bf45e6fd15f7e78f09114294478823dee</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18160</id>
    <title>Moderate: libssh security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libssh security update</summary>
    <description>libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.  

Security Fix(es):  

  * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)
  * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)
  * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)
  * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)
  * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18160" id="RHSA-2026:18160" type="rhsa" title="RHSA-2026:18160"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0964" id="CVE-2026-0964" type="cve" title="CVE-2026-0964"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0965" id="CVE-2026-0965" type="cve" title="CVE-2026-0965"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0966" id="CVE-2026-0966" type="cve" title="CVE-2026-0966"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0967" id="CVE-2026-0967" type="cve" title="CVE-2026-0967"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0968" id="CVE-2026-0968" type="cve" title="CVE-2026-0968"/>
      <reference href="https://bugzilla.redhat.com/2433121" id="2433121" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436979" id="2436979" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436980" id="2436980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436981" id="2436981" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436982" id="2436982" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18160.html" id="ALSA-2026:18160" type="self" title="ALSA-2026:18160"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libssh-devel" version="0.12.0" release="2.el10" epoch="0" arch="x86_64" src="libssh-0.12.0-2.el10.src.rpm">
          <filename>libssh-devel-0.12.0-2.el10.x86_64.rpm</filename>
          <sum type="sha256">c607b128073e57795ba7a576a747bb792f7ae6e9287cca7bc4488efeec45da7b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18326</id>
    <title>Moderate: libvirt security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:35:08"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libvirt security update</summary>
    <description>Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.  

Security Fix(es):  

  * libvirt: Denial of service in XML parsing (CVE-2025-12748)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18326" id="RHSA-2026:18326" type="rhsa" title="RHSA-2026:18326"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-12748" id="CVE-2025-12748" type="cve" title="CVE-2025-12748"/>
      <reference href="https://bugzilla.redhat.com/2413801" id="2413801" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18326.html" id="ALSA-2026:18326" type="self" title="ALSA-2026:18326"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libvirt-daemon-log" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-log-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">07313288a8746419a0ff9118c4999185f8a87ac850e5ee56d506ef38d175900c</sum>
        </package>
        <package name="libvirt-daemon-driver-nodedev" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-nodedev-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">0d21e4c8def275fb79001b1c2f569f3f935d0a4ae54649aafc0ec7a0898a1c1d</sum>
        </package>
        <package name="libvirt-daemon-driver-storage" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">194a5085c95ba600eb93f1f6b77d1a704c47bab3e403aec62732d935de4c055f</sum>
        </package>
        <package name="libvirt-daemon-driver-secret" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-secret-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">1ba52d1515fc54f1b1a53efecb7b4d747cff2bbb72c0d9e9d6bd1e40687c71a4</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-disk" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-disk-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">408a1857a55f8c0b28bfc023ccb7d324333157efe0ac5f7d6b25c50c2eacf0ff</sum>
        </package>
        <package name="libvirt-client-qemu" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-client-qemu-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">40f13ef7e99f2cdb0b415e61c0926025e4478bd90aba701ad6d63110f021bfd6</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-rbd" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-rbd-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">43d742fb43074593b66e3b5d90f96fe6e62f3854630e1f8e358cb45a0f62524f</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-scsi" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-scsi-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">54b3eeb7c4e583eeee9caa4422d6932403145ffd3d9e485a481d29b1f14f3f2a</sum>
        </package>
        <package name="libvirt-libs" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-libs-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">5832a6c4de9fc7d99a247813b2acc6d7d6f24d5aeca2168523e3582e7a6ad68b</sum>
        </package>
        <package name="libvirt-daemon-driver-network" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-network-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">5c878a55bec9d04f1d2b6eb8fb47f701ad640cbd23df17faf81c37d2edb66763</sum>
        </package>
        <package name="libvirt-ssh-proxy" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-ssh-proxy-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">60e26a039c79bb9e97101b588e2c295c5e760c2d12435e522eaf5b1ead6d1c13</sum>
        </package>
        <package name="libvirt-daemon-config-nwfilter" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-config-nwfilter-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">61faa084e1906472f7c8c03cfb3ff605c7fd720b37c236f57647a497b13fadb7</sum>
        </package>
        <package name="libvirt-daemon-common" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-common-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">63b2e0f66705ad9c7884363b422e9c4bf20651f6cea843bacd922b74611f390d</sum>
        </package>
        <package name="libvirt-daemon-proxy" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-proxy-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">65017bcb0fc3abb8897c5c7f251f041d2c66ab1a5599f4cda571899e2a534326</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-logical" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-logical-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">6549612c559b3aac11221dff6844e44681900a9f8c8f50773f48d2f98df7ea06</sum>
        </package>
        <package name="libvirt-daemon-driver-qemu" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-qemu-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">689199bb5b1183f55af014e0c51b6db9375ce2954d644fffb303643eab481c09</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-core" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-core-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">80f7ead2181c43896e70ce44ed82b1b608a964147f15a038cd0750a21bb649d4</sum>
        </package>
        <package name="libvirt-daemon-kvm" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-kvm-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">8b88f63610b6bdc6b4eaad16ea9d244a8be90b430ba978ae5add06bb3b9f0236</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-iscsi" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-iscsi-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">8f11dcd7e3b752f398713233e4c951bcf9c65b7055f4da79e7748e808f9f62d8</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-mpath" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-storage-mpath-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">99f6cdac997338fcdadd4e09d969efce0176214e107e650507d96844c8a987cc</sum>
        </package>
        <package name="libvirt-client" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-client-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">9c5f81b2e93180dcd350561d75f241aa7b31fb80cee44a105f00d73584c35cae</sum>
        </package>
        <package name="libvirt-daemon" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">c1022224a201b92ecffaa6a4b644fcc07d425c832d12d48b7295fed876674724</sum>
        </package>
        <package name="libvirt-daemon-lock" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-lock-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">c4a29683157a888a5a979f8ab976359b385121837f40e2ffed24a121ec7cf08b</sum>
        </package>
        <package name="libvirt-daemon-driver-interface" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-interface-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">d66585349e21f034fb385028070c94e8995b5b9c4baa46f507ed1382a29059f8</sum>
        </package>
        <package name="libvirt-nss" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-nss-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">d9fb1da417920c9705f172120edae2cef5d5665bc4d09cd65b4d67efb0929ee9</sum>
        </package>
        <package name="libvirt-daemon-driver-nwfilter" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-driver-nwfilter-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">dd06a554b468de7a40311c2f6ecd5d0a83e8cb1d42c055153f424a0b7f7d2bc9</sum>
        </package>
        <package name="libvirt-daemon-plugin-lockd" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-plugin-lockd-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">df3d9acf2763eb49b548c4bd9ee21555022c4a3a842e80a854ebe300c2e29c82</sum>
        </package>
        <package name="libvirt-daemon-config-network" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-config-network-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">ea8b0a0ac906f8acb5f0022558dde7a756c63d45c53c934b2950dba3bfb51132</sum>
        </package>
        <package name="libvirt" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-11.10.0-12.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">f23a9bdf72311432698de9b1c5f83d04be8d765f6976b78861bc8d91a73e2726</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18421</id>
    <title>Moderate: luksmeta security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:34"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>luksmeta security update</summary>
    <description>LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux.  

Security Fix(es):  

  * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18421" id="RHSA-2026:18421" type="rhsa" title="RHSA-2026:18421"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-11568" id="CVE-2025-11568" type="cve" title="CVE-2025-11568"/>
      <reference href="https://bugzilla.redhat.com/2404244" id="2404244" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18421.html" id="ALSA-2026:18421" type="self" title="ALSA-2026:18421"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libluksmeta" version="10" release="1.el10" epoch="0" arch="x86_64" src="luksmeta-10-1.el10.src.rpm">
          <filename>libluksmeta-10-1.el10.x86_64.rpm</filename>
          <sum type="sha256">0a1d73dd5d0e1144bb9f53fe1e7ccad42f0657a7e911b9164baaed5e76b87289</sum>
        </package>
        <package name="luksmeta" version="10" release="1.el10" epoch="0" arch="x86_64" src="luksmeta-10-1.el10.src.rpm">
          <filename>luksmeta-10-1.el10.x86_64.rpm</filename>
          <sum type="sha256">c34991f0171ee8800e4ae2df4138968ccfeb6f8af51407ad02fe2c19f2ed5872</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18465</id>
    <title>Important: edk2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>edk2 security update</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   

Security Fix(es):  

  * edk2: EDK2: Improper Input Validation allows arbitrary command execution (CVE-2025-2296)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18465" id="RHSA-2026:18465" type="rhsa" title="RHSA-2026:18465"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-2296" id="CVE-2025-2296" type="cve" title="CVE-2025-2296"/>
      <reference href="https://bugzilla.redhat.com/2420637" id="2420637" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18465.html" id="ALSA-2026:18465" type="self" title="ALSA-2026:18465"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="edk2-ovmf" version="20251114" release="5.el10_2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">0440f37c3dfa7d8ed89074f19a592ec31ae69caf218c9c023a8e521cbedd1c05</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18479</id>
    <title>Important: qemu-kvm security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>qemu-kvm security update</summary>
    <description>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.  

Security Fix(es):  

  * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)
  * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)
  * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699)
  * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695)
  * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18479" id="RHSA-2026:18479" type="rhsa" title="RHSA-2026:18479"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11692" id="CVE-2024-11692" type="cve" title="CVE-2024-11692"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11694" id="CVE-2024-11694" type="cve" title="CVE-2024-11694"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11695" id="CVE-2024-11695" type="cve" title="CVE-2024-11695"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11696" id="CVE-2024-11696" type="cve" title="CVE-2024-11696"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11697" id="CVE-2024-11697" type="cve" title="CVE-2024-11697"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-11699" id="CVE-2024-11699" type="cve" title="CVE-2024-11699"/>
      <reference href="https://bugzilla.redhat.com/2328941" id="2328941" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328943" id="2328943" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328946" id="2328946" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328947" id="2328947" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328948" id="2328948" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2328950" id="2328950" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18479.html" id="ALSA-2026:18479" type="self" title="ALSA-2026:18479"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="qemu-pr-helper" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-pr-helper-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">019407cb3652942e54dcf50f6482c8df79876d1e4ef5138242294e94cc93a83f</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">08853c2463e96d9daef009ebb0ed3d641fc541c7214266b5d7409625afcd964c</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-vga" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-display-virtio-vga-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">0d1d5d8e50aaa3ce6c7408f4b8869f0583fbf67659ccfb8715a4e3cb9ac61456</sum>
        </package>
        <package name="qemu-kvm-core" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-core-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">125aaaef99bfeab8ec08b1f3e21c4eb6b65a6acb209f474c6ffcf0be2f7e5836</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu-pci" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">1b81cdf5f300587129ffec89daf2dd673ce0e475f440ee5abb50f2800610e2c6</sum>
        </package>
        <package name="qemu-kvm" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">2637aae0447c4e4f8f4197b6ff8a719a6a3e6cd5af196c3261cdf831d7068f2c</sum>
        </package>
        <package name="qemu-img" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-img-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">3607c03d618999bed5ff9839d53a67e09d62209ca58953536f691edb348b4163</sum>
        </package>
        <package name="qemu-kvm-device-usb-redirect" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">45a016929648b5f37b38d47da5ad2aaeafccefc173aaec86fce7cd4843f964ef</sum>
        </package>
        <package name="qemu-kvm-ui-opengl" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-ui-opengl-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">544918e25b8280c527b878d5c78ed1251f7c6df68a7be3de54115f384cdee24c</sum>
        </package>
        <package name="qemu-kvm-docs" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-docs-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">69268a26048e75b9aacc653782a915cc782dcf60e1168e39d82a0ede4ad1c6d8</sum>
        </package>
        <package name="qemu-kvm-block-curl" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-block-curl-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">6d5c0bead0b505adb2feaddbf521789a4e21dacb53a55f4be13c81414f89dc79</sum>
        </package>
        <package name="qemu-kvm-block-rbd" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-block-rbd-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">aaaaa67d0d0959db2062837b837c18c45d541523a66fee882d7f5fbd83fcf31b</sum>
        </package>
        <package name="qemu-kvm-audio-pa" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-audio-pa-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">ab1169e7182ea9c590ec54a72885372c0d40d6af5b957d1213ea08ad90410529</sum>
        </package>
        <package name="qemu-kvm-common" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-common-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">c1fa996b6f2fc6019b2beb88e7e6bb78cfcce63193674f2bdc4bb3175b830069</sum>
        </package>
        <package name="qemu-guest-agent" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-guest-agent-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">c894655255fb8e3e391db8abf1b7bb2bed01c50c331d05fe625f4505b38903bf</sum>
        </package>
        <package name="qemu-kvm-ui-egl-headless" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-ui-egl-headless-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">d698d480a433a89fcbe4cf83b812c5886cead0d72ce5b2183be2e0cb279406ce</sum>
        </package>
        <package name="qemu-kvm-tools" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-tools-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">ed9d3e6c114aa069d9d38066dbbf3e3875b64018942dbc136b2b997f278b65fa</sum>
        </package>
        <package name="qemu-kvm-device-usb-host" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-device-usb-host-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">fd6c6875935d98c771dda60be1f87d2fb9cece2cd1bea63fd6ccd627ed103256</sum>
        </package>
        <package name="qemu-kvm-block-blkio" version="10.1.0" release="16.el10_2.alma.1" epoch="18" arch="x86_64" src="qemu-kvm-10.1.0-16.el10_2.alma.1.src.rpm">
          <filename>qemu-kvm-block-blkio-10.1.0-16.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">ffba073828bb140038d0be2d25e8ea5c17368841123e133550b230fd5260f4b0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18480</id>
    <title>Important: linux-sgx security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:31:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>linux-sgx security update</summary>
    <description>The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.  

Security Fix(es):  

  * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)
  * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)
  * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)
  * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)
  * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18480" id="RHSA-2026:18480" type="rhsa" title="RHSA-2026:18480"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13465" id="CVE-2025-13465" type="cve" title="CVE-2025-13465"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-15284" id="CVE-2025-15284" type="cve" title="CVE-2025-15284"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23745" id="CVE-2026-23745" type="cve" title="CVE-2026-23745"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23950" id="CVE-2026-23950" type="cve" title="CVE-2026-23950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-24842" id="CVE-2026-24842" type="cve" title="CVE-2026-24842"/>
      <reference href="https://bugzilla.redhat.com/2425946" id="2425946" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2430538" id="2430538" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431036" id="2431036" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431740" id="2431740" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2433645" id="2433645" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18480.html" id="ALSA-2026:18480" type="self" title="ALSA-2026:18480"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="sgx-pccs" version="2.26" release="7.el10" epoch="0" arch="x86_64" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-pccs-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">061406e4ebdae896c33cb24ce58c84305be8bdc927e07895efaccbccc8773c10</sum>
        </package>
        <package name="sgx-libs" version="2.26" release="7.el10" epoch="0" arch="x86_64" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-libs-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">3c0019d46d6d208b14fa1a899f2327c3933145a477d8ed32d147801168f12a52</sum>
        </package>
        <package name="sgx-pckid-tool" version="2.26" release="7.el10" epoch="0" arch="x86_64" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-pckid-tool-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">761fe8b7880d7a0af547d953f1c3a25db4457726b00830d39fbfcc79e498c539</sum>
        </package>
        <package name="sgx-mpa" version="2.26" release="7.el10" epoch="0" arch="x86_64" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-mpa-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">799458814cf4fdf8a1cd3b6382b879e67cfe96399512dd7e3037f5e56db696dc</sum>
        </package>
        <package name="sgx-pccs-admin" version="2.26" release="7.el10" epoch="0" arch="x86_64" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-pccs-admin-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">b93c1fe22b4d05127fd74158ada58105609963eda5a2997c177bf425c6e80232</sum>
        </package>
        <package name="sgx-common" version="2.26" release="7.el10" epoch="0" arch="x86_64" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>sgx-common-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">bb83d06edeb75a24e1a304a330eef52aab0f0d3c0f9ba104535f5bfd0a1890c4</sum>
        </package>
        <package name="tdx-qgs" version="2.26" release="7.el10" epoch="0" arch="x86_64" src="linux-sgx-2.26-7.el10.src.rpm">
          <filename>tdx-qgs-2.26-7.el10.x86_64.rpm</filename>
          <sum type="sha256">e19a53bb9a7559a70a1bbf0c0b8266080ea12e02324ce995c1df264d0a91df3c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18556</id>
    <title>Moderate: unbound security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:31:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: DNSBomb vulnerability (CVE-2024-33655)
  * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18556" id="RHSA-2026:18556" type="rhsa" title="RHSA-2026:18556"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-33655" id="CVE-2024-33655" type="cve" title="CVE-2024-33655"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-11411" id="CVE-2025-11411" type="cve" title="CVE-2025-11411"/>
      <reference href="https://bugzilla.redhat.com/2279942" id="2279942" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2405706" id="2405706" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18556.html" id="ALSA-2026:18556" type="self" title="ALSA-2026:18556"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="python3-unbound" version="1.24.2" release="7.el10" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">00a57486f9906dfb43ce758200996ea9dc60e7a750809dd67d145d6b0ece216b</sum>
        </package>
        <package name="unbound" version="1.24.2" release="7.el10" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">020ef012c871596263a61b7f9c34d75653f070e652912c23bf2236a644c82c30</sum>
        </package>
        <package name="unbound-dracut" version="1.24.2" release="7.el10" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">46e5662c790d5e5922e47b31bd1673c620a91fc7188b097434012c30294b7012</sum>
        </package>
        <package name="unbound-anchor" version="1.24.2" release="7.el10" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">4ef01c97d514326b6fdf5e1924f9925ae8edd4d66b4ee1b50bd7c0fe2cb96e1c</sum>
        </package>
        <package name="unbound-utils" version="1.24.2" release="7.el10" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">bf05a9c700945765e97e802cc4be73bdf7f666eb0d8038a7a7c7efb50a7aaf49</sum>
        </package>
        <package name="unbound-libs" version="1.24.2" release="7.el10" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10.x86_64.rpm</filename>
          <sum type="sha256">fe7ba640e0f9c9de0f6f5ee758564bdc97f115df0c107e7f6e000cda64d78d88</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19009</id>
    <title>Important: postgresql18 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql18 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)
  * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)
  * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)
  * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)
  * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19009" id="RHSA-2026:19009" type="rhsa" title="RHSA-2026:19009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2007" id="CVE-2026-2007" type="cve" title="CVE-2026-2007"/>
      <reference href="https://bugzilla.redhat.com/2439320" id="2439320" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439322" id="2439322" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439324" id="2439324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439325" id="2439325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439326" id="2439326" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19009.html" id="ALSA-2026:19009" type="self" title="ALSA-2026:19009"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="postgresql18-plperl" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-plperl-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">240d7786d198eaa6e419c3a862b6f34e5abc0bbfca03f78ce640037a0af6afcd</sum>
        </package>
        <package name="postgresql18-upgrade-devel" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-upgrade-devel-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">370853b18de9d2a9e6db6c7a4c755faf9eccc6a66e1f8e376cbd892751520dab</sum>
        </package>
        <package name="postgresql18-private-libs" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-private-libs-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">510019abfe1a7b35bb5596a04e3602385b3ce95ae97d375961433671db234da5</sum>
        </package>
        <package name="postgresql18" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">59292720d92065b565fd34480338fd88c9a75e0cd98c3389321a58f624acf128</sum>
        </package>
        <package name="postgresql18-contrib" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-contrib-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">69afef75e9d40200542a42714bc72c9347c4fb950b7c772ee8d5200d43d9a26b</sum>
        </package>
        <package name="postgresql18-private-devel" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-private-devel-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">811eea74fa445fce6ce35efee85166a97dbb5e1a1e977f5fbca7446ae885690c</sum>
        </package>
        <package name="postgresql18-plpython3" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-plpython3-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">82437c661bbe1ce45f3847633526d6bfa78fa11b5c1d4786681b0a1d5a68ed08</sum>
        </package>
        <package name="postgresql18-docs" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-docs-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">aef0ca8fd56c9f54ca4cdc6cdd3c9eb437e7e6a1108cc69b41ae622b2e779ea1</sum>
        </package>
        <package name="postgresql18-static" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-static-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c309699d9267eeae9448180ee67d790b1c27df5dcbbcb479100256f90fcd82cd</sum>
        </package>
        <package name="postgresql18-server-devel" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-server-devel-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d7fae7f6ed9198789364b4fd9a77befc981852c5a2a85e35e8a810405fb3c252</sum>
        </package>
        <package name="postgresql18-upgrade" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-upgrade-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e909783ef347b94c235b380c3e683a1c36d6710d39ce28c0c482bca198552d97</sum>
        </package>
        <package name="postgresql18-server" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-server-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f944a430dec703e3599c7cd911f41a3c5a511cfcdcaafe47c588336aa8605325</sum>
        </package>
        <package name="postgresql18-test" version="18.3" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-test-18.3-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ff72d3aede7142fc0cd5d564d191c812f9253a04094b4b395431710564470edb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19010</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql16 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)
  * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)
  * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)
  * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19010" id="RHSA-2026:19010" type="rhsa" title="RHSA-2026:19010"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006"/>
      <reference href="https://bugzilla.redhat.com/2439322" id="2439322" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439324" id="2439324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439325" id="2439325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439326" id="2439326" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19010.html" id="ALSA-2026:19010" type="self" title="ALSA-2026:19010"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="postgresql-pltcl" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-pltcl-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">214e6614ed732101546586826916d14a65862c7e2eaa82af0210bb06396de703</sum>
        </package>
        <package name="postgresql-docs" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-docs-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">22cb29b2e98cc5b165d7128d32e0d7caa40bc8df25f0589600dd19db30e6c2ec</sum>
        </package>
        <package name="postgresql-contrib" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-contrib-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">436ab742b527c33727d4b9fce04cedc763b0e4ef8fad9f6734395a630f590c29</sum>
        </package>
        <package name="postgresql-plpython3" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-plpython3-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">46e03cc72a4792b4272a2e592df3064cf7789a77f5c372f900c450ae0658c721</sum>
        </package>
        <package name="postgresql-upgrade" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">63842e1189221377406fe9d85130de2272e63176d417e98ae6fabc69f87f54b6</sum>
        </package>
        <package name="postgresql-private-libs" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-private-libs-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">653c9382933888377365eba1d97981a181c318a50394fe04e8609492fb383641</sum>
        </package>
        <package name="postgresql-test" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-test-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6cb048bd071dfc3fff1126b1e912b030f559e9b3c6af805346b54ae9f2420025</sum>
        </package>
        <package name="postgresql-plperl" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-plperl-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">70eddceaf52c2d6993e5e7f98d747adb3f3f6db532864645104ea1f09f132cf2</sum>
        </package>
        <package name="postgresql-static" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-static-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">abe095fbc9e5b78d04056eb5c216f4bc5a7705a34fa17feea55bdd6f62f7d38d</sum>
        </package>
        <package name="postgresql-private-devel" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-private-devel-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b513d82f857892970b7b2c61fee7eb058161ad932d4663b3a6034e8029eefad5</sum>
        </package>
        <package name="postgresql-server" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-server-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bb2d285106c8a7221f87828dfa9110a4fa48d8e7177c1dae25b99a6aa78d3a03</sum>
        </package>
        <package name="postgresql-server-devel" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-server-devel-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">beae32951c406228fa99a461812e271c3af1a85de4be4120e12b80a780130877</sum>
        </package>
        <package name="postgresql" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ee6441f5f49bc6cb06667cd6e53f1b724206d699dd9f696ae2371379bdea6c7a</sum>
        </package>
        <package name="postgresql-upgrade-devel" version="16.13" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-devel-16.13-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ef1311081d4a59b1d70f3a92684ec4376549a8e0a4529e54247354e94e68b0d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19013</id>
    <title>Moderate: delve security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>delve security update</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.  

Security Fix(es):  

  * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
  * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
  * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19013" id="RHSA-2026:19013" type="rhsa" title="RHSA-2026:19013"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121"/>
      <reference href="https://bugzilla.redhat.com/2418462" id="2418462" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2434432" id="2434432" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2437111" id="2437111" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19013.html" id="ALSA-2026:19013" type="self" title="ALSA-2026:19013"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="delve" version="1.26.1" release="1.el10_2" epoch="0" arch="x86_64" src="delve-1.26.1-1.el10_2.src.rpm">
          <filename>delve-1.26.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fdd1f76cfb1db500a9b0a858bde68244fab9f21a06fee432c5cd59073928d1d3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19017</id>
    <title>Important: podman security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:31:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19017" id="RHSA-2026:19017" type="rhsa" title="RHSA-2026:19017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455470" id="2455470" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19017.html" id="ALSA-2026:19017" type="self" title="ALSA-2026:19017"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="podman-docker" version="5.8.2" release="1.el10_2.alma.1" epoch="7" arch="noarch" src="podman-5.8.2-1.el10_2.alma.1.src.rpm">
          <filename>podman-docker-5.8.2-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">167be1b8d65574dac9045abe3e1e0b9208ed8e6c2c2c8b29b83d77c4173a468f</sum>
        </package>
        <package name="podman-remote" version="5.8.2" release="1.el10_2.alma.1" epoch="7" arch="x86_64" src="podman-5.8.2-1.el10_2.alma.1.src.rpm">
          <filename>podman-remote-5.8.2-1.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">4e9ab108eadcb092cc949a6135909529f29e4aa3efbb284d36cec19acfe33dfa</sum>
        </package>
        <package name="podman" version="5.8.2" release="1.el10_2.alma.1" epoch="7" arch="x86_64" src="podman-5.8.2-1.el10_2.alma.1.src.rpm">
          <filename>podman-5.8.2-1.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">5f60e31511c2a9881ec7d094b998e29af0c86f4c7131db9f2535856ef3ed4b40</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19019</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
  * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19019" id="RHSA-2026:19019" type="rhsa" title="RHSA-2026:19019"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0865" id="CVE-2026-0865" type="cve" title="CVE-2026-0865"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5713" id="CVE-2026-5713" type="cve" title="CVE-2026-5713"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100"/>
      <reference href="https://bugzilla.redhat.com/2431367" id="2431367" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2444691" id="2444691" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448168" id="2448168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448181" id="2448181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449649" id="2449649" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457409" id="2457409" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457932" id="2457932" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458239" id="2458239" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19019.html" id="ALSA-2026:19019" type="self" title="ALSA-2026:19019"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="python3.14-devel" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.4-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">96cfc783fb249cd33a9d10011db15d39d02a525042749ee867d31874146748db</sum>
        </package>
        <package name="python3.14" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-3.14.4-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a419081d6eb80de49b5cdddb742e9658f2b0bb239871ec95035a9a334eae49d4</sum>
        </package>
        <package name="python3.14-libs" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.4-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b39c79a16c94e1572d13ad550390e8267f75bc8cfbfd82a5ed990d2e1e8fe182</sum>
        </package>
        <package name="python3.14-tkinter" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.4-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e56a3ff5b354152aded87036e4b7368cf6f57fa510139e68f5e348342de81b59</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19020</id>
    <title>Moderate: crun security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>crun security update</summary>
    <description>crun is a OCI runtime  

Security Fix(es):  

  * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19020" id="RHSA-2026:19020" type="rhsa" title="RHSA-2026:19020"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-30892" id="CVE-2026-30892" type="cve" title="CVE-2026-30892"/>
      <reference href="https://bugzilla.redhat.com/2451576" id="2451576" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19020.html" id="ALSA-2026:19020" type="self" title="ALSA-2026:19020"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="crun-krun" version="1.27" release="2.el10_2" epoch="0" arch="x86_64" src="crun-1.27-2.el10_2.src.rpm">
          <filename>crun-krun-1.27-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0f68485548ad60490166d6095233bc07f6576d232be65065f267ca42de77d422</sum>
        </package>
        <package name="crun" version="1.27" release="2.el10_2" epoch="0" arch="x86_64" src="crun-1.27-2.el10_2.src.rpm">
          <filename>crun-1.27-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">738f83807e3eb007fc5867fdd825dc06c307c1bb30ffbfbe09383cecf94f8b40</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19022</id>
    <title>Important: golang security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>golang security update</summary>
    <description>The golang packages provide the Go programming language compiler.  

Security Fix(es):  

  * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19022" id="RHSA-2026:19022" type="rhsa" title="RHSA-2026:19022"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137"/>
      <reference href="https://bugzilla.redhat.com/2445345" id="2445345" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19022.html" id="ALSA-2026:19022" type="self" title="ALSA-2026:19022"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="go-toolset" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="x86_64" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>go-toolset-1.26.2-2.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">2d9c76d3f400e0b41d1e4ede07350c95dcde53f5c01617b0a9ed1d5938cd626b</sum>
        </package>
        <package name="golang" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="x86_64" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-1.26.2-2.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">4c4539f8f8d59c0a9b956e54459e9d1108d2a6d8a21ec3b9b21b4b86a174703d</sum>
        </package>
        <package name="golang-tests" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-tests-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">86ddbd7f00012fa580ea1c9edb33d9e5982eef71b38e0283ad2659fa61352095</sum>
        </package>
        <package name="golang-docs" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-docs-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">a7b9810b608f99d1d4e8dc8771e6e1493f6f39113e88f56ae83bd92548afe904</sum>
        </package>
        <package name="golang-race" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="x86_64" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-race-1.26.2-2.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">d17377ec284e3ce76604023d4c8e3f39a68353d35eb1adf5b7853ee3c0d5c50f</sum>
        </package>
        <package name="golang-src" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-src-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">dbf8e7996f83be39afa1954de0ab45d661a96b356a3e406a1960cd6be572a7bb</sum>
        </package>
        <package name="golang-bin" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="x86_64" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-bin-1.26.2-2.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">f5011855264dbc96a853bb65dbd751834cd91fea68ab46da517aeca25492af7d</sum>
        </package>
        <package name="golang-misc" version="1.26.2" release="2.el10_2.alma.1" epoch="0" arch="noarch" src="golang-1.26.2-2.el10_2.alma.1.src.rpm">
          <filename>golang-misc-1.26.2-2.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">ff930bc6ddd8d4469f1e7d1cab514142b71eff36da84ce419045251ce79e3e17</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19024</id>
    <title>Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:32:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  

Security Fix(es):  

  * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)
  * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)
  * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)
  * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)
  * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)
  * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)
  * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19024" id="RHSA-2026:19024" type="rhsa" title="RHSA-2026:19024"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2920" id="CVE-2026-2920" type="cve" title="CVE-2026-2920"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2921" id="CVE-2026-2921" type="cve" title="CVE-2026-2921"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2922" id="CVE-2026-2922" type="cve" title="CVE-2026-2922"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2923" id="CVE-2026-2923" type="cve" title="CVE-2026-2923"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3082" id="CVE-2026-3082" type="cve" title="CVE-2026-3082"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3083" id="CVE-2026-3083" type="cve" title="CVE-2026-3083"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3085" id="CVE-2026-3085" type="cve" title="CVE-2026-3085"/>
      <reference href="https://bugzilla.redhat.com/2447490" id="2447490" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447492" id="2447492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447495" id="2447495" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447496" id="2447496" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447498" id="2447498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447500" id="2447500" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447503" id="2447503" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19024.html" id="ALSA-2026:19024" type="self" title="ALSA-2026:19024"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-good" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64" src="gstreamer1-plugins-good-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2f672bc3b8a2f8e1432df99c390144cdc4f675d1e470a86bb98d075bec7db876</sum>
        </package>
        <package name="gstreamer1-plugins-base-devel" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-devel-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">51659d1333af2b6e8918cde863ce469e28f35d9c2502e45897ecee64a1c6332d</sum>
        </package>
        <package name="gstreamer1-plugins-base" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8dab4520c32b9b62a3f5f69d87d225f7ac5fd19fa6d63e30087eb6a1fca147a3</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64" src="gstreamer1-plugins-good-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">957657a78fe6c2ec4627feaf8b9b60341ff008d4c593a36f1bf52afdf36eee10</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">abc591f87981eb884ad4a7e3f8bd2a045b1b65c424b6997b62e69a0c8d79b4af</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b189e3ef8c523c8b14721721ca61210c34570f1b21b5a529f6f1541f0f1e6152</sum>
        </package>
        <package name="gstreamer1-plugins-base-tools" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-tools-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c1930b08fa8b00aa87df7d9383a55bb0b7da9b4e62d0a6fd437b346141cc56c1</sum>
        </package>
        <package name="gstreamer1-plugins-ugly-free" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64" src="gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c5a052a420b71f51fc8bfd95051eebe031837c7f27e5d2902e6ba7ccd3e8e21d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19031</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>skopeo security update</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.   

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19031" id="RHSA-2026:19031" type="rhsa" title="RHSA-2026:19031"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19031.html" id="ALSA-2026:19031" type="self" title="ALSA-2026:19031"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="skopeo" version="1.22.2" release="1.el10_2" epoch="2" arch="x86_64" src="skopeo-1.22.2-1.el10_2.src.rpm">
          <filename>skopeo-1.22.2-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">14df06458d2b470469c3ec314e1b2d4e040b85c0125514c6dbc9aee750153ee2</sum>
        </package>
        <package name="skopeo-tests" version="1.22.2" release="1.el10_2" epoch="2" arch="x86_64" src="skopeo-1.22.2-1.el10_2.src.rpm">
          <filename>skopeo-tests-1.22.2-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b408ff83cb742c221395cd23e7e5003b19adf86d8f1d8e5e644bad2f671ba930</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19032</id>
    <title>Important: buildah security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>buildah security update</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19032" id="RHSA-2026:19032" type="rhsa" title="RHSA-2026:19032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19032.html" id="ALSA-2026:19032" type="self" title="ALSA-2026:19032"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="buildah-tests" version="1.43.1" release="1.el10_2" epoch="2" arch="x86_64" src="buildah-1.43.1-1.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">25f3126c617444344bdfdbced9605da3cc77363fb7d862315b28d69509e3840f</sum>
        </package>
        <package name="buildah" version="1.43.1" release="1.el10_2" epoch="2" arch="x86_64" src="buildah-1.43.1-1.el10_2.src.rpm">
          <filename>buildah-1.43.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3896046979f4d2edacd39a6a1e88764371abafe3766ffd7819927f3f26067e3e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19034</id>
    <title>Moderate: python-tornado security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>python-tornado security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19034" id="RHSA-2026:19034" type="rhsa" title="RHSA-2026:19034"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31958" id="CVE-2026-31958" type="cve" title="CVE-2026-31958"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35536" id="CVE-2026-35536" type="cve" title="CVE-2026-35536"/>
      <reference href="https://bugzilla.redhat.com/2446765" id="2446765" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454716" id="2454716" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19034.html" id="ALSA-2026:19034" type="self" title="ALSA-2026:19034"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="python3-tornado" version="6.5.5" release="1.el10_2" epoch="0" arch="x86_64" src="python-tornado-6.5.5-1.el10_2.src.rpm">
          <filename>python3-tornado-6.5.5-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">286cda998fc032588262e4117c2e4504fade173da29106c96ccd74eefe18ff7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19042</id>
    <title>Low: python-jwcrypto security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>python-jwcrypto security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19042" id="RHSA-2026:19042" type="rhsa" title="RHSA-2026:19042"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39373" id="CVE-2026-39373" type="cve" title="CVE-2026-39373"/>
      <reference href="https://bugzilla.redhat.com/2456187" id="2456187" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19042.html" id="ALSA-2026:19042" type="self" title="ALSA-2026:19042"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="python3-jwcrypto" version="1.5.6" release="5.el10_2" epoch="0" arch="noarch" src="python-jwcrypto-1.5.6-5.el10_2.src.rpm">
          <filename>python3-jwcrypto-1.5.6-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">db89aecbcd378aa983e05761a6b2cbca01c3a05e38a708730a9029e277498a12</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19053</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:03"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>freeipmi security update</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.  

Security Fix(es):  

  * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19053" id="RHSA-2026:19053" type="rhsa" title="RHSA-2026:19053"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33554" id="CVE-2026-33554" type="cve" title="CVE-2026-33554"/>
      <reference href="https://bugzilla.redhat.com/2450778" id="2450778" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19053.html" id="ALSA-2026:19053" type="self" title="ALSA-2026:19053"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="freeipmi-ipmidetectd" version="1.6.17" release="1.el10_2" epoch="0" arch="x86_64" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-ipmidetectd-1.6.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">194fa009ba341b2be80a5a9db856b6d495b835b10ea66d566dfc6323ea32f415</sum>
        </package>
        <package name="freeipmi" version="1.6.17" release="1.el10_2" epoch="0" arch="x86_64" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-1.6.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1fe0f71039e8a256f6be6c80e04c2c924b57e77df1874cc6c8960f2ad5d622e8</sum>
        </package>
        <package name="freeipmi-ipmiseld" version="1.6.17" release="1.el10_2" epoch="0" arch="x86_64" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-ipmiseld-1.6.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">801aea8945583c33b2ec5ed6764d91c6c6093d57e36a4c1f565ca9bc75838460</sum>
        </package>
        <package name="freeipmi-bmc-watchdog" version="1.6.17" release="1.el10_2" epoch="0" arch="x86_64" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-bmc-watchdog-1.6.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e97e49495fb178e3c5e5258b92969677d6c91581371448a3a55708dc19522c65</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19054</id>
    <title>Important: tomcat security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:35:39"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>tomcat security update</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  

Security Fix(es):  

  * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19054" id="RHSA-2026:19054" type="rhsa" title="RHSA-2026:19054"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-24734" id="CVE-2026-24734" type="cve" title="CVE-2026-24734"/>
      <reference href="https://bugzilla.redhat.com/2440426" id="2440426" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19054.html" id="ALSA-2026:19054" type="self" title="ALSA-2026:19054"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="tomcat-jsp-3.1-api" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">032f9dfd26c60d1d72b363ff2061d11662e957528f62a47531f5bbf5f865b387</sum>
        </package>
        <package name="tomcat" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">30074a00cdb2fd116e1a86d0dd4fde4c0ee1ad6c1d76871cede1af36c10ad784</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">910908c4cbeb19192b15b52ff7bcb553a79de45a9fd931d50fa458956364dc8c</sum>
        </package>
        <package name="tomcat-el-5.0-api" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">a4ea29cfcc7dc0b39309a55f0cb9f6825d1b6965da13f87f41af81d7293301e1</sum>
        </package>
        <package name="tomcat-lib" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-lib-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">bf8d00201d00c1d371bcb29fde0b79354efbec1bdd757baaebc03477a5d83d5c</sum>
        </package>
        <package name="tomcat-docs-webapp" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">cd1899698b4ef517e177bafdcbdb1e1542a1f0c867d8b7fefb87b3e46b4b54bf</sum>
        </package>
        <package name="tomcat-admin-webapps" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">d5a2b5453e34039aa491637abe23194a845e0a52cb69be855ed09fbc360ed9f7</sum>
        </package>
        <package name="tomcat-webapps" version="10.1.49" release="1.el10_2.1.alma.1" epoch="1" arch="noarch" src="tomcat-10.1.49-1.el10_2.1.alma.1.src.rpm">
          <filename>tomcat-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">fdbfa914a61bc11297a055cca8ba8bb8c9d37d90b771583e8b8b87d3a7a388c7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19061</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:32:13"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
  * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19061" id="RHSA-2026:19061" type="rhsa" title="RHSA-2026:19061"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4437" id="CVE-2026-4437" type="cve" title="CVE-2026-4437"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4438" id="CVE-2026-4438" type="cve" title="CVE-2026-4438"/>
      <reference href="https://bugzilla.redhat.com/2449777" id="2449777" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449783" id="2449783" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19061.html" id="ALSA-2026:19061" type="self" title="ALSA-2026:19061"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="glibc-devel" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-devel-2.39-121.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">23920bd9da79447108eda8c3f29ac120f218403daf13404222d658fa0111eeb1</sum>
        </package>
        <package name="glibc-utils" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-utils-2.39-121.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">3520be7c4040a2b074aab5dad5d0af9c69cc98de23d8e79a203ba5c96b102c33</sum>
        </package>
        <package name="glibc-doc" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-121.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">8e5944044c77883ffcdf699a95b72c6bb5ec1b40fe769362ba84948c5c446f4b</sum>
        </package>
        <package name="glibc-locale-source" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-locale-source-2.39-121.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">f57b60462f5cf2cbddf8a92820f559c456d89fb5bff11e96d1fff60a54a296de</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19064</id>
    <title>Important: python3.12 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:31:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.12 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
  * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
  * cpython: Out-of-memory when loading Plist (CVE-2025-13837)
  * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
  * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19064" id="RHSA-2026:19064" type="rhsa" title="RHSA-2026:19064"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13837" id="CVE-2025-13837" type="cve" title="CVE-2025-13837"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-15282" id="CVE-2025-15282" type="cve" title="CVE-2025-15282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-59375" id="CVE-2025-59375" type="cve" title="CVE-2025-59375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-6075" id="CVE-2025-6075" type="cve" title="CVE-2025-6075"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0672" id="CVE-2026-0672" type="cve" title="CVE-2026-0672"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100"/>
      <reference href="https://bugzilla.redhat.com/2395108" id="2395108" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2408891" id="2408891" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2418084" id="2418084" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431366" id="2431366" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431374" id="2431374" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2444691" id="2444691" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448168" id="2448168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448181" id="2448181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449649" id="2449649" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457409" id="2457409" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457932" id="2457932" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19064.html" id="ALSA-2026:19064" type="self" title="ALSA-2026:19064"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="python3-devel" version="3.12.13" release="2.el10_2" epoch="0" arch="x86_64" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-devel-3.12.13-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1a7e22608ac7a0f520c10ac9641d22b50c494d380e84630ee13af03c19d31661</sum>
        </package>
        <package name="python-unversioned-command" version="3.12.13" release="2.el10_2" epoch="0" arch="noarch" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python-unversioned-command-3.12.13-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">e02dd9af1061d81e9eb4f3b2ab2cee1f8bcaa3917c0c834b9885fbcb4199da2e</sum>
        </package>
        <package name="python3-tkinter" version="3.12.13" release="2.el10_2" epoch="0" arch="x86_64" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-tkinter-3.12.13-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ea31967685c55af2685b76aed6d8f63186709d9fd309a2c2799cd7a3f531873e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19066</id>
    <title>Moderate: openssl security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>openssl security update</summary>
    <description>OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  

Security Fix(es):  

  * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19066" id="RHSA-2026:19066" type="rhsa" title="RHSA-2026:19066"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31790" id="CVE-2026-31790" type="cve" title="CVE-2026-31790"/>
      <reference href="https://bugzilla.redhat.com/2451094" id="2451094" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19066.html" id="ALSA-2026:19066" type="self" title="ALSA-2026:19066"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="openssl-devel" version="3.5.5" release="2.el10_2.alma.1" epoch="1" arch="x86_64" src="openssl-3.5.5-2.el10_2.alma.1.src.rpm">
          <filename>openssl-devel-3.5.5-2.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">b3b352d7984dd897ded2e210ecdaac4a2e4bde5fb81367a84e5adc78646f062a</sum>
        </package>
        <package name="openssl-perl" version="3.5.5" release="2.el10_2.alma.1" epoch="1" arch="x86_64" src="openssl-3.5.5-2.el10_2.alma.1.src.rpm">
          <filename>openssl-perl-3.5.5-2.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">fb1af0b4d391b0c87f7d4d97cae5d301e0bda6691e96552325ef1531c13a3662</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19067</id>
    <title>Important: sudo security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:16"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>sudo security update</summary>
    <description>The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.  

Security Fix(es):  

  * sudo: Sudo: Privilege escalation due to failure in privilege drop calls (CVE-2026-35535)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19067" id="RHSA-2026:19067" type="rhsa" title="RHSA-2026:19067"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35535" id="CVE-2026-35535" type="cve" title="CVE-2026-35535"/>
      <reference href="https://bugzilla.redhat.com/2454714" id="2454714" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19067.html" id="ALSA-2026:19067" type="self" title="ALSA-2026:19067"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="sudo-python-plugin" version="1.9.17" release="4.p2.el10_2" epoch="0" arch="x86_64" src="sudo-1.9.17-4.p2.el10_2.src.rpm">
          <filename>sudo-python-plugin-1.9.17-4.p2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2f888765cd59b453a48ea721166cc80e1c0f1caa5a45bd4f17ff373af0b34b6a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19068</id>
    <title>Moderate: systemd security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:32:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>systemd security update</summary>
    <description>The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.  

Security Fix(es):  

  * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19068" id="RHSA-2026:19068" type="rhsa" title="RHSA-2026:19068"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29111" id="CVE-2026-29111" type="cve" title="CVE-2026-29111"/>
      <reference href="https://bugzilla.redhat.com/2450505" id="2450505" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19068.html" id="ALSA-2026:19068" type="self" title="ALSA-2026:19068"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="systemd-devel" version="257" release="23.el10_2.1.alma.1" epoch="0" arch="x86_64" src="systemd-257-23.el10_2.1.alma.1.src.rpm">
          <filename>systemd-devel-257-23.el10_2.1.alma.1.x86_64.rpm</filename>
          <sum type="sha256">05e89297e3e630d704e3c39cea1d2b9560319ce71a86ebd238f51849216c0ee8</sum>
        </package>
        <package name="systemd-journal-remote" version="257" release="23.el10_2.1.alma.1" epoch="0" arch="x86_64" src="systemd-257-23.el10_2.1.alma.1.src.rpm">
          <filename>systemd-journal-remote-257-23.el10_2.1.alma.1.x86_64.rpm</filename>
          <sum type="sha256">16d884f462c3e5aa9e6b4c62a2cf2cc59988e96c2dd8eb2058787056488eae46</sum>
        </package>
        <package name="systemd-ukify" version="257" release="23.el10_2.1.alma.1" epoch="0" arch="noarch" src="systemd-257-23.el10_2.1.alma.1.src.rpm">
          <filename>systemd-ukify-257-23.el10_2.1.alma.1.noarch.rpm</filename>
          <sum type="sha256">b19a2e5d5ceb000880e9a0b2e332123c6cc5f6052003d8b27a6230bc528bca3a</sum>
        </package>
        <package name="systemd-boot-unsigned" version="257" release="23.el10_2.1.alma.1" epoch="0" arch="x86_64" src="systemd-257-23.el10_2.1.alma.1.src.rpm">
          <filename>systemd-boot-unsigned-257-23.el10_2.1.alma.1.x86_64.rpm</filename>
          <sum type="sha256">bae592b4124c378dff5d9a95638a24fd613d9a25e8730255502794ca1d9c2591</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19069</id>
    <title>Important: openssh security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>openssh security update</summary>
    <description>OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.  

Security Fix(es):  

  * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode (CVE-2026-35385)
  * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414)
  * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage (CVE-2026-35387)
  * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388)
  * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19069" id="RHSA-2026:19069" type="rhsa" title="RHSA-2026:19069"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35385" id="CVE-2026-35385" type="cve" title="CVE-2026-35385"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35386" id="CVE-2026-35386" type="cve" title="CVE-2026-35386"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35387" id="CVE-2026-35387" type="cve" title="CVE-2026-35387"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35388" id="CVE-2026-35388" type="cve" title="CVE-2026-35388"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35414" id="CVE-2026-35414" type="cve" title="CVE-2026-35414"/>
      <reference href="https://bugzilla.redhat.com/2454469" id="2454469" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454490" id="2454490" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454494" id="2454494" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454500" id="2454500" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454506" id="2454506" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19069.html" id="ALSA-2026:19069" type="self" title="ALSA-2026:19069"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="openssh-keysign" version="9.9p1" release="23.el10_2.alma.1" epoch="0" arch="x86_64" src="openssh-9.9p1-23.el10_2.alma.1.src.rpm">
          <filename>openssh-keysign-9.9p1-23.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">4a880d720190ca15e5e4f3e932e58c360e7bf319585d6ffe730ab640839a7ff6</sum>
        </package>
        <package name="openssh-askpass" version="9.9p1" release="23.el10_2.alma.1" epoch="0" arch="x86_64" src="openssh-9.9p1-23.el10_2.alma.1.src.rpm">
          <filename>openssh-askpass-9.9p1-23.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">b9ac604bea64327c679924f7ac326fac8d9df879b61f96a1c60d72d0e013c3c9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19073</id>
    <title>Important: vim security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>vim security update</summary>
    <description>Vim (Vi IMproved) is an updated and improved version of the vi editor.  

Security Fix(es):  

  * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19073" id="RHSA-2026:19073" type="rhsa" title="RHSA-2026:19073"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34982" id="CVE-2026-34982" type="cve" title="CVE-2026-34982"/>
      <reference href="https://bugzilla.redhat.com/2455400" id="2455400" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19073.html" id="ALSA-2026:19073" type="self" title="ALSA-2026:19073"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="vim-X11" version="9.1.083" release="9.el10_2.2" epoch="2" arch="x86_64" src="vim-9.1.083-9.el10_2.2.src.rpm">
          <filename>vim-X11-9.1.083-9.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">4d687421ca6f05aea96701c400060ed0c178cdcadd8507d5564ead082afd9f2c</sum>
        </package>
        <package name="xxd" version="9.1.083" release="9.el10_2.2" epoch="2" arch="x86_64" src="vim-9.1.083-9.el10_2.2.src.rpm">
          <filename>xxd-9.1.083-9.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">4e4203c30d23229391460b8d138ce65a86729fab9a5d91e9107d8f60c8847a2b</sum>
        </package>
        <package name="vim-enhanced" version="9.1.083" release="9.el10_2.2" epoch="2" arch="x86_64" src="vim-9.1.083-9.el10_2.2.src.rpm">
          <filename>vim-enhanced-9.1.083-9.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">7bae5df13bba050eb1e1257782506c985cd42439f4db284073ccef15827ddde9</sum>
        </package>
        <package name="vim-common" version="9.1.083" release="9.el10_2.2" epoch="2" arch="x86_64" src="vim-9.1.083-9.el10_2.2.src.rpm">
          <filename>vim-common-9.1.083-9.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">cd95cc9d18e60de2ac8954e67d2686ea395660154712fd539cb540b8d461dfa2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19074</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060)
  * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
  * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677)
  * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19074" id="RHSA-2026:19074" type="rhsa" title="RHSA-2026:19074"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23060" id="CVE-2026-23060" type="cve" title="CVE-2026-23060"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31431" id="CVE-2026-31431" type="cve" title="CVE-2026-31431"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31677" id="CVE-2026-31677" type="cve" title="CVE-2026-31677"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43284" id="CVE-2026-43284" type="cve" title="CVE-2026-43284"/>
      <reference href="https://bugzilla.redhat.com/2436779" id="2436779" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460538" id="2460538" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461763" id="2461763" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467771" id="2467771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19074.html" id="ALSA-2026:19074" type="self" title="ALSA-2026:19074"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="python3-perf" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.7.3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0ac797587a557f630ab490c93eee1f7ce2e1aec56f029aea06c326461c5b100d</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>perf-6.12.0-211.7.3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">191139077ac1bf1db360f16370078f1874674406aac5c0dee448fd27190794aa</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.7.3.el10_2.noarch.rpm</filename>
          <sum type="sha256">2a68239ba7e1ffded8f59859942aad0efdfdc10912c47834975a6dd22a799961</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.7.3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">561727f230fb475bf2dbb8d6ebb11682085b6201d8484916de086b836a7fed33</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.7.3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8b8d20f1eaeb36cbcf352fa867e45e6e3ab896d2b5c9bedc41cd6f46101b1984</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.7.3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">926eb82f2e8ce404ce3c5a8cb9e1c5691aa690c22ca13fa2820403abd7296c41</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.7.3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">937f0b13e81173ad0230ca5358667e1f82750e314b4e21b762b0c1c3e470dd2b</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.7.3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">96622442f0884219b0096631c3b982eed1843752ecc98bf35e1797895712c7f3</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.7.3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a7ce6d44decd3ba91de695dbea6e579d99f6c984dd0ffd3ce2aaa0c6b14c9467</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>rv-6.12.0-211.7.3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e444dd01fac7526decec93ea7f20ac752dedcb9e8b8370fc7f9db69b8a8bbd4e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19125</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>xorg-x11-server-Xwayland security update</summary>
    <description>Xwayland is an X server for running X clients under Wayland.  

Security Fix(es):  

  * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)
  * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)
  * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19125" id="RHSA-2026:19125" type="rhsa" title="RHSA-2026:19125"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33999" id="CVE-2026-33999" type="cve" title="CVE-2026-33999"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34001" id="CVE-2026-34001" type="cve" title="CVE-2026-34001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34003" id="CVE-2026-34003" type="cve" title="CVE-2026-34003"/>
      <reference href="https://bugzilla.redhat.com/2451106" id="2451106" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451109" id="2451109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451113" id="2451113" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19125.html" id="ALSA-2026:19125" type="self" title="ALSA-2026:19125"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="xorg-x11-server-Xwayland" version="24.1.9" release="4.el10_2" epoch="0" arch="x86_64" src="xorg-x11-server-Xwayland-24.1.9-4.el10_2.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.9-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c29aa5563aedb6371b31718c3023398e0da04c0fe226a40d37740d4b58dc72ca</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19126</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>yggdrasil security update</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19126" id="RHSA-2026:19126" type="rhsa" title="RHSA-2026:19126"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19126.html" id="ALSA-2026:19126" type="self" title="ALSA-2026:19126"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="yggdrasil" version="0.4.9" release="4.el10_2" epoch="0" arch="x86_64" src="yggdrasil-0.4.9-4.el10_2.src.rpm">
          <filename>yggdrasil-0.4.9-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bc54535ff17a4f1ce9e0152de2c7eb6d75ae436c6fc922f7b314e1efc965c823</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19127</id>
    <title>Important: gdk-pixbuf2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:29:29"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gdk-pixbuf2 security update</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.  

Security Fix(es):  

  * gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19127" id="RHSA-2026:19127" type="rhsa" title="RHSA-2026:19127"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5201" id="CVE-2026-5201" type="cve" title="CVE-2026-5201"/>
      <reference href="https://bugzilla.redhat.com/2453291" id="2453291" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19127.html" id="ALSA-2026:19127" type="self" title="ALSA-2026:19127"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="gdk-pixbuf2-devel" version="2.42.12" release="4.el10_2.5" epoch="0" arch="x86_64" src="gdk-pixbuf2-2.42.12-4.el10_2.5.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">6d46cc96c2a1a13b50dd29ae33201fee65beaf77dc4c1c80eb4fee2ecf0c7b89</sum>
        </package>
        <package name="gdk-pixbuf2" version="2.42.12" release="4.el10_2.5" epoch="0" arch="x86_64" src="gdk-pixbuf2-2.42.12-4.el10_2.5.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">8faf4d4846d44d8590a0ae5c79a77a3d0eae8916f39a33e7f0c09f3f15002a8b</sum>
        </package>
        <package name="gdk-pixbuf2-modules" version="2.42.12" release="4.el10_2.5" epoch="0" arch="x86_64" src="gdk-pixbuf2-2.42.12-4.el10_2.5.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_2.5.x86_64.rpm</filename>
          <sum type="sha256">907ab9e417d7d57f4d32ff6df4de7f485b4bfa5b82d3126edbbda8a14425cc73</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19128</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>yggdrasil-worker-package-manager security update</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19128" id="RHSA-2026:19128" type="rhsa" title="RHSA-2026:19128"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19128.html" id="ALSA-2026:19128" type="self" title="ALSA-2026:19128"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="yggdrasil-worker-package-manager" version="0.2.3" release="6.el10_2" epoch="0" arch="x86_64" src="yggdrasil-worker-package-manager-0.2.3-6.el10_2.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-6.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6d2acb944b80190afddecd088d3f82c3dfe519078946776a8db3cba8933b1b14</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19130</id>
    <title>Important: libcap security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libcap security update</summary>
    <description>Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.  

Security Fix(es):  

  * libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19130" id="RHSA-2026:19130" type="rhsa" title="RHSA-2026:19130"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4878" id="CVE-2026-4878" type="cve" title="CVE-2026-4878"/>
      <reference href="https://bugzilla.redhat.com/2451615" id="2451615" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19130.html" id="ALSA-2026:19130" type="self" title="ALSA-2026:19130"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libcap-devel" version="2.69" release="7.el10_2.1" epoch="0" arch="x86_64" src="libcap-2.69-7.el10_2.1.src.rpm">
          <filename>libcap-devel-2.69-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">0547999f208af95e59f024af2bba6860eb43072e6e3bbb99c13b3b8a7c4d72e8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19133</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>git-lfs security update</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19133" id="RHSA-2026:19133" type="rhsa" title="RHSA-2026:19133"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19133.html" id="ALSA-2026:19133" type="self" title="ALSA-2026:19133"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="git-lfs" version="3.7.1" release="4.el10_2" epoch="0" arch="x86_64" src="git-lfs-3.7.1-4.el10_2.src.rpm">
          <filename>git-lfs-3.7.1-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ce94d6594cbfc1d2fce8cb89fea5f278c0221705f9759bdf78ac06efdff77407</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19134</id>
    <title>Important: grafana security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:49"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>grafana security update</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.   

Security Fix(es):  

  * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)
  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19134" id="RHSA-2026:19134" type="rhsa" title="RHSA-2026:19134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27877" id="CVE-2026-27877" type="cve" title="CVE-2026-27877"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2452293" id="2452293" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19134.html" id="ALSA-2026:19134" type="self" title="ALSA-2026:19134"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="grafana-selinux" version="10.2.6" release="26.el10_2" epoch="0" arch="x86_64" src="grafana-10.2.6-26.el10_2.src.rpm">
          <filename>grafana-selinux-10.2.6-26.el10_2.x86_64.rpm</filename>
          <sum type="sha256">05b7c2c7debc56987ea4810bf0a635acb444d0fc160cf44c1f5ccc841c6c9e0c</sum>
        </package>
        <package name="grafana" version="10.2.6" release="26.el10_2" epoch="0" arch="x86_64" src="grafana-10.2.6-26.el10_2.src.rpm">
          <filename>grafana-10.2.6-26.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1494970d1e99faa361f5d5b8c991b15845b03b92b489403a0bb338ac7281b592</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19135</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>opentelemetry-collector security update</summary>
    <description>Collector with the supported components for a AlmaLinux build of OpenTelemetry  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
  * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19135" id="RHSA-2026:19135" type="rhsa" title="RHSA-2026:19135"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33186" id="CVE-2026-33186" type="cve" title="CVE-2026-33186"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33810" id="CVE-2026-33810" type="cve" title="CVE-2026-33810"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449833" id="2449833" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455470" id="2455470" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456335" id="2456335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19135.html" id="ALSA-2026:19135" type="self" title="ALSA-2026:19135"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="opentelemetry-collector" version="0.144.0" release="2.el10_2" epoch="0" arch="x86_64" src="opentelemetry-collector-0.144.0-2.el10_2.src.rpm">
          <filename>opentelemetry-collector-0.144.0-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">28c150841225f1dce46474ad85da323c22b060a3641bd87ab82f902f2ff3e095</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19136</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>grafana-pcp security update</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.  

Security Fix(es):  

  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19136" id="RHSA-2026:19136" type="rhsa" title="RHSA-2026:19136"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456336" id="2456336" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19136.html" id="ALSA-2026:19136" type="self" title="ALSA-2026:19136"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="grafana-pcp" version="5.3.0" release="5.el10_2" epoch="0" arch="x86_64" src="grafana-pcp-5.3.0-5.el10_2.src.rpm">
          <filename>grafana-pcp-5.3.0-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ef04b532f3c0efdc45bd37a02599b65bfdcc0842d2dabac2a08fd94c67609c45</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19137</id>
    <title>Important: go-fdo-server security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>go-fdo-server security update</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.  

Security Fix(es):  

  * github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19137" id="RHSA-2026:19137" type="rhsa" title="RHSA-2026:19137"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33816" id="CVE-2026-33816" type="cve" title="CVE-2026-33816"/>
      <reference href="https://bugzilla.redhat.com/2455972" id="2455972" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19137.html" id="ALSA-2026:19137" type="self" title="ALSA-2026:19137"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="go-fdo-server-rendezvous" version="1.0.1" release="1.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">2f723b54c36ddf004e4bea960e425128bf2d983f8a3113e157997f07bad4fa7a</sum>
        </package>
        <package name="go-fdo-server" version="1.0.1" release="1.el10_2" epoch="0" arch="x86_64" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-1.0.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4e4fb74f429d74df1306269d2e2420e7c56b3e85e8ae93e0444ee4a7e5617934</sum>
        </package>
        <package name="go-fdo-server-owner" version="1.0.1" release="1.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">4fdde5d0f325c9777d1a0493b93f5f958290c8b3b8c46095516d2e7e8ea2d03e</sum>
        </package>
        <package name="go-fdo-server-manufacturer" version="1.0.1" release="1.el10_2" epoch="0" arch="noarch" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">503719bae2e16f1ef8bfb6389d8210cb55c14a40a4f7f7f00e40c82bfd1f8095</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19139</id>
    <title>Important: go-fdo-client security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>go-fdo-client security update</summary>
    <description>go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.  

Security Fix(es):  

  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19139" id="RHSA-2026:19139" type="rhsa" title="RHSA-2026:19139"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19139.html" id="ALSA-2026:19139" type="self" title="ALSA-2026:19139"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="go-fdo-client" version="1.0.0" release="3.el10_2" epoch="0" arch="x86_64" src="go-fdo-client-1.0.0-3.el10_2.src.rpm">
          <filename>go-fdo-client-1.0.0-3.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d560a2e6b331eda4286e82d45bba304b719b7970b551a7392d8361fb2773da6d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19141</id>
    <title>Important: PackageKit security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:44"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>PackageKit security update</summary>
    <description>PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.  

Security Fix(es):  

  * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19141" id="RHSA-2026:19141" type="rhsa" title="RHSA-2026:19141"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41651" id="CVE-2026-41651" type="cve" title="CVE-2026-41651"/>
      <reference href="https://bugzilla.redhat.com/2460604" id="2460604" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19141.html" id="ALSA-2026:19141" type="self" title="ALSA-2026:19141"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="PackageKit-glib" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-glib-1.2.8-8.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9410cb402d71aa8225233362d3be16c92a377fcb89a4d5e2133eb273516c90fb</sum>
        </package>
        <package name="PackageKit-gstreamer-plugin" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-gstreamer-plugin-1.2.8-8.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d1988ae31f13acab71799cc25662488fbef0cedf1616446247b824ef3288e2b9</sum>
        </package>
        <package name="PackageKit-command-not-found" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-command-not-found-1.2.8-8.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e90089024171aa84617fe4330196b142c1a837501e6ef35e1f886a4acd82dade</sum>
        </package>
        <package name="PackageKit-gtk3-module" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-gtk3-module-1.2.8-8.el10_2.x86_64.rpm</filename>
          <sum type="sha256">edabd805ef5a5bcd8d611d9db50689367ea9daf6f62e6244fab293e1d90021b5</sum>
        </package>
        <package name="PackageKit" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-1.2.8-8.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f8b4164943f6c44db1977eb7da1163a223797ff5e6c5d93a70977f2a5a54cd36</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19143</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:51"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libsoup3 security update</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.  

Security Fix(es):  

  * libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)
  * libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19143" id="RHSA-2026:19143" type="rhsa" title="RHSA-2026:19143"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4271" id="CVE-2026-4271" type="cve" title="CVE-2026-4271"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5119" id="CVE-2026-5119" type="cve" title="CVE-2026-5119"/>
      <reference href="https://bugzilla.redhat.com/2448044" id="2448044" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452932" id="2452932" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19143.html" id="ALSA-2026:19143" type="self" title="ALSA-2026:19143"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libsoup3-devel" version="3.6.5" release="3.el10_2.11" epoch="0" arch="x86_64" src="libsoup3-3.6.5-3.el10_2.11.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_2.11.x86_64.rpm</filename>
          <sum type="sha256">3eac197ea71f50a431f9d006cd3c3c7f3a17cf39b27ecd63a6f1bd19912eac46</sum>
        </package>
        <package name="libsoup3" version="3.6.5" release="3.el10_2.11" epoch="0" arch="x86_64" src="libsoup3-3.6.5-3.el10_2.11.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_2.11.x86_64.rpm</filename>
          <sum type="sha256">b7634121742c3f218f724ae568a845757fe715cb5acd1b194b2e1da355c15af9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19145</id>
    <title>Important: krb5 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>krb5 security update</summary>
    <description>Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).  

Security Fix(es):  

  * krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356)
  * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19145" id="RHSA-2026:19145" type="rhsa" title="RHSA-2026:19145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40355" id="CVE-2026-40355" type="cve" title="CVE-2026-40355"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40356" id="CVE-2026-40356" type="cve" title="CVE-2026-40356"/>
      <reference href="https://bugzilla.redhat.com/2463368" id="2463368" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463370" id="2463370" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19145.html" id="ALSA-2026:19145" type="self" title="ALSA-2026:19145"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="krb5-devel" version="1.21.3" release="10.el10_2" epoch="0" arch="x86_64" src="krb5-1.21.3-10.el10_2.src.rpm">
          <filename>krb5-devel-1.21.3-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ad22f25fc84a3696d7b10b42b928b37d7cd86161e4e28079e5fa20bae12a3e48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19148</id>
    <title>Moderate: glib2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glib2 security update</summary>
    <description>GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.  

Security Fix(es):  

  * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087)
  * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19148" id="RHSA-2026:19148" type="rhsa" title="RHSA-2026:19148"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-14087" id="CVE-2025-14087" type="cve" title="CVE-2025-14087"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-14512" id="CVE-2025-14512" type="cve" title="CVE-2025-14512"/>
      <reference href="https://bugzilla.redhat.com/2419093" id="2419093" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2421339" id="2421339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19148.html" id="ALSA-2026:19148" type="self" title="ALSA-2026:19148"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="glib2-devel" version="2.80.4" release="12.el10_2.13" epoch="0" arch="x86_64" src="glib2-2.80.4-12.el10_2.13.src.rpm">
          <filename>glib2-devel-2.80.4-12.el10_2.13.x86_64.rpm</filename>
          <sum type="sha256">2ad258f5b9473f4a290f97ff23bc5e8ce37a75431b92fc6619e2724b0034ba96</sum>
        </package>
        <package name="glib2-tests" version="2.80.4" release="12.el10_2.13" epoch="0" arch="x86_64" src="glib2-2.80.4-12.el10_2.13.src.rpm">
          <filename>glib2-tests-2.80.4-12.el10_2.13.x86_64.rpm</filename>
          <sum type="sha256">3494f9ab3615e77930e9be8c0b062caa477a32b42f933e8b859eca069cd36e7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19149</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dovecot security update</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   

Security Fix(es):  

  * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)
  * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)
  * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19149" id="RHSA-2026:19149" type="rhsa" title="RHSA-2026:19149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-59032" id="CVE-2025-59032" type="cve" title="CVE-2025-59032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27857" id="CVE-2026-27857" type="cve" title="CVE-2026-27857"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27858" id="CVE-2026-27858" type="cve" title="CVE-2026-27858"/>
      <reference href="https://bugzilla.redhat.com/2452172" id="2452172" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452175" id="2452175" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452179" id="2452179" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19149.html" id="ALSA-2026:19149" type="self" title="ALSA-2026:19149"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="dovecot-mysql" version="2.3.21" release="19.el10_2" epoch="1" arch="x86_64" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-mysql-2.3.21-19.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9cc4f475bec6141a8019b2677d0f56e29f67daace9d24190de3b05d3c841fa92</sum>
        </package>
        <package name="dovecot-pigeonhole" version="2.3.21" release="19.el10_2" epoch="1" arch="x86_64" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-pigeonhole-2.3.21-19.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a5e4de560b44dfce218ba307862f96ae70f46cea4bb46e8f3f0cfdc5577a7e45</sum>
        </package>
        <package name="dovecot" version="2.3.21" release="19.el10_2" epoch="1" arch="x86_64" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-2.3.21-19.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d124991608546945f628b861555da467f0a2aa9b090a9082b76f1b542b7eb487</sum>
        </package>
        <package name="dovecot-pgsql" version="2.3.21" release="19.el10_2" epoch="1" arch="x86_64" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-pgsql-2.3.21-19.el10_2.x86_64.rpm</filename>
          <sum type="sha256">deec3c7c1cbcfcc3992e5f4615f18e78d43a31bb729c8241ea9d8b444b9479ab</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19150</id>
    <title>Important: libtiff security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:53"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libtiff security update</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.  

Security Fix(es):  

  * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19150" id="RHSA-2026:19150" type="rhsa" title="RHSA-2026:19150"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4775" id="CVE-2026-4775" type="cve" title="CVE-2026-4775"/>
      <reference href="https://bugzilla.redhat.com/2450768" id="2450768" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19150.html" id="ALSA-2026:19150" type="self" title="ALSA-2026:19150"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libtiff" version="4.6.0" release="8.el10_2.1" epoch="0" arch="x86_64" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-4.6.0-8.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">5d469c5afe4c676a72d019ae15dea2ed137134916910ea16f1f36e9a86ce3587</sum>
        </package>
        <package name="libtiff-devel" version="4.6.0" release="8.el10_2.1" epoch="0" arch="x86_64" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-devel-4.6.0-8.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">e253d8e9afc51f587f90dc591f2aef077e3a2e8d8d3f8a2d02ba6e8fe97b8c5d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19152</id>
    <title>Important: rsync security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>rsync security update</summary>
    <description>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  

Security Fix(es):  

  * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19152" id="RHSA-2026:19152" type="rhsa" title="RHSA-2026:19152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41035" id="CVE-2026-41035" type="cve" title="CVE-2026-41035"/>
      <reference href="https://bugzilla.redhat.com/2458898" id="2458898" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19152.html" id="ALSA-2026:19152" type="self" title="ALSA-2026:19152"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="rsync-rrsync" version="3.4.1" release="6.el10_2" epoch="0" arch="noarch" src="rsync-3.4.1-6.el10_2.src.rpm">
          <filename>rsync-rrsync-3.4.1-6.el10_2.noarch.rpm</filename>
          <sum type="sha256">6ce73c87a6758941f9efbd47f3a5dd2a2ea31d8602fe86d9b50d137c2939e69a</sum>
        </package>
        <package name="rsync-daemon" version="3.4.1" release="6.el10_2" epoch="0" arch="noarch" src="rsync-3.4.1-6.el10_2.src.rpm">
          <filename>rsync-daemon-3.4.1-6.el10_2.noarch.rpm</filename>
          <sum type="sha256">9f76d6a1f61310d5e7fb2cad97fccf750d8a2777db08a53fec77160350cf917f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19153</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>thunderbird security update</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.  

Security Fix(es):  

  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)
  * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)
  * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)
  * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19153" id="RHSA-2026:19153" type="rhsa" title="RHSA-2026:19153"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7320" id="CVE-2026-7320" type="cve" title="CVE-2026-7320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7321" id="CVE-2026-7321" type="cve" title="CVE-2026-7321"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7322" id="CVE-2026-7322" type="cve" title="CVE-2026-7322"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7323" id="CVE-2026-7323" type="cve" title="CVE-2026-7323"/>
      <reference href="https://bugzilla.redhat.com/2463481" id="2463481" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463483" id="2463483" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463484" id="2463484" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463485" id="2463485" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19153.html" id="ALSA-2026:19153" type="self" title="ALSA-2026:19153"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="thunderbird" version="140.10.1" release="1.el10_2.alma.1" epoch="0" arch="x86_64" src="thunderbird-140.10.1-1.el10_2.alma.1.src.rpm">
          <filename>thunderbird-140.10.1-1.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">83ce7a155936d4eca0a89c96ee01a8a60a4988f2acf4bd063c561c34ba81665b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19154</id>
    <title>Important: giflib security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>giflib security update</summary>
    <description>giflib is a library for reading and writing gif images.  

Security Fix(es):  

  * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19154" id="RHSA-2026:19154" type="rhsa" title="RHSA-2026:19154"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23868" id="CVE-2026-23868" type="cve" title="CVE-2026-23868"/>
      <reference href="https://bugzilla.redhat.com/2446207" id="2446207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19154.html" id="ALSA-2026:19154" type="self" title="ALSA-2026:19154"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="giflib" version="5.2.1" release="24.el10_2" epoch="0" arch="x86_64" src="giflib-5.2.1-24.el10_2.src.rpm">
          <filename>giflib-5.2.1-24.el10_2.x86_64.rpm</filename>
          <sum type="sha256">75d4b7762abb03ead78c2cc0ea18620f29eb19a6625519610a781bff3721cd8f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19157</id>
    <title>Important: firefox security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)
  * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)
  * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)
  * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19157" id="RHSA-2026:19157" type="rhsa" title="RHSA-2026:19157"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7320" id="CVE-2026-7320" type="cve" title="CVE-2026-7320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7321" id="CVE-2026-7321" type="cve" title="CVE-2026-7321"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7322" id="CVE-2026-7322" type="cve" title="CVE-2026-7322"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7323" id="CVE-2026-7323" type="cve" title="CVE-2026-7323"/>
      <reference href="https://bugzilla.redhat.com/2463481" id="2463481" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463483" id="2463483" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463484" id="2463484" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463485" id="2463485" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19157.html" id="ALSA-2026:19157" type="self" title="ALSA-2026:19157"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.10.1" release="1.el10_2" epoch="0" arch="x86_64" src="firefox-140.10.1-1.el10_2.src.rpm">
          <filename>firefox-140.10.1-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">94f3749f671f521421481372e361390d6e0121e162780d3ea2bb50ddecb185cc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19158</id>
    <title>Important: dnsmasq security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dnsmasq security update</summary>
    <description>The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.  

Security Fix(es):  

  * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)
  * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)
  * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)
  * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)
  * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)
  * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19158" id="RHSA-2026:19158" type="rhsa" title="RHSA-2026:19158"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2291" id="CVE-2026-2291" type="cve" title="CVE-2026-2291"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4890" id="CVE-2026-4890" type="cve" title="CVE-2026-4890"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4891" id="CVE-2026-4891" type="cve" title="CVE-2026-4891"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4892" id="CVE-2026-4892" type="cve" title="CVE-2026-4892"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4893" id="CVE-2026-4893" type="cve" title="CVE-2026-4893"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5172" id="CVE-2026-5172" type="cve" title="CVE-2026-5172"/>
      <reference href="https://bugzilla.redhat.com/2439088" id="2439088" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458516" id="2458516" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458517" id="2458517" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458518" id="2458518" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458519" id="2458519" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458521" id="2458521" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19158.html" id="ALSA-2026:19158" type="self" title="ALSA-2026:19158"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="dnsmasq-utils" version="2.90" release="7.el10_2" epoch="0" arch="x86_64" src="dnsmasq-2.90-7.el10_2.src.rpm">
          <filename>dnsmasq-utils-2.90-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">733dbe00db109745abce1fa55f5389f4a59b10c0ba6770b4c75423926f274ed2</sum>
        </package>
        <package name="dnsmasq" version="2.90" release="7.el10_2" epoch="0" arch="x86_64" src="dnsmasq-2.90-7.el10_2.src.rpm">
          <filename>dnsmasq-2.90-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9dbfedf67bf7ffe5f3ddbfceac450734e61bcfccbeef8bb5d6b11272275f8d31</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19159</id>
    <title>Critical: nginx security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:34:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19159" id="RHSA-2026:19159" type="rhsa" title="RHSA-2026:19159"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42945" id="CVE-2026-42945" type="cve" title="CVE-2026-42945"/>
      <reference href="https://bugzilla.redhat.com/2477116" id="2477116" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19159.html" id="ALSA-2026:19159" type="self" title="ALSA-2026:19159"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="nginx-mod-mail" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">0f6860591b566cc94b3ec5dff79ff0744d8c7c8a25ee4d645e2e49cb78e75a3d</sum>
        </package>
        <package name="nginx-mod-http-image-filter" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">2dd703c5f301e797b8915fc72bb4cd792840bae317a80f63bef52030bdccdfcf</sum>
        </package>
        <package name="nginx-core" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">300eb6e84d90e76cd26041ae3e3dee83f7d735b3e30d9dd2719dc8b71ad04fef</sum>
        </package>
        <package name="nginx-all-modules" version="1.26.3" release="6.el10_2.3" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">3f0c16ba9b852a8917cd5d6999e2c127f547446efc3c0f2cf3c5eefc43e389c4</sum>
        </package>
        <package name="nginx-mod-stream" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">4897b357b35b3b1497fce5cd01d3020f45e7cbf8bb3df2399332c76ff8650140</sum>
        </package>
        <package name="nginx" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">7bd438bd307d99a8bfcfbcab324f672b1a2097782ffffc62208b1b9f16a20127</sum>
        </package>
        <package name="nginx-filesystem" version="1.26.3" release="6.el10_2.3" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">8890f406349040013ca50201c62964d631bbd50b288c439c5ab1bfd5bafc9330</sum>
        </package>
        <package name="nginx-mod-http-perl" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">8c6ccb50d90e017fb6c8e15ba103e8ff9e5d8baf3ac8201297b51246e75e9a3f</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">a10d24d420e8b83a2a4b2865250d6df6e79abb51a572000b40c10b4005bef82a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19160</id>
    <title>Important: firefox security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: Other issue in the WebRTC component (CVE-2026-8094)
  * firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092)
  * firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19160" id="RHSA-2026:19160" type="rhsa" title="RHSA-2026:19160"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8090" id="CVE-2026-8090" type="cve" title="CVE-2026-8090"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8092" id="CVE-2026-8092" type="cve" title="CVE-2026-8092"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8094" id="CVE-2026-8094" type="cve" title="CVE-2026-8094"/>
      <reference href="https://bugzilla.redhat.com/2467706" id="2467706" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467708" id="2467708" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467709" id="2467709" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19160.html" id="ALSA-2026:19160" type="self" title="ALSA-2026:19160"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.10.2" release="1.el10_2" epoch="0" arch="x86_64" src="firefox-140.10.2-1.el10_2.src.rpm">
          <filename>firefox-140.10.2-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">95275af175e5b4eeaff079107605f2bf7d1d6ee9dea2094126953baa2cb5d7d0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19560</id>
    <title>Important: libsndfile security update</title>
    <issued date="2026-05-20 00:00:00"/>
    <updated date="2026-05-26 12:29:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libsndfile security update</summary>
    <description>libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV.   

Security Fix(es):  

  * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19560" id="RHSA-2026:19560" type="rhsa" title="RHSA-2026:19560"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-37555" id="CVE-2026-37555" type="cve" title="CVE-2026-37555"/>
      <reference href="https://bugzilla.redhat.com/2463856" id="2463856" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19560.html" id="ALSA-2026:19560" type="self" title="ALSA-2026:19560"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libsndfile-utils" version="1.2.2" release="6.el10_2.1" epoch="0" arch="x86_64" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-utils-1.2.2-6.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">2b28c1eb585e12ff7af87cf528adbc9af44d709c338ddf5805787cd3e31610dd</sum>
        </package>
        <package name="libsndfile" version="1.2.2" release="6.el10_2.1" epoch="0" arch="x86_64" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-1.2.2-6.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">fa12754c51bf06eac550fbe5ac1a335448839c75f4bc4eb86a276f904dde370a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19569</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-20 00:00:00"/>
    <updated date="2026-06-07 18:12:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
  * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)
  * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
  * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741)
  * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)
  * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401)
  * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
  * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
  * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)
  * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)
  * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)
  * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300)
  * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19569" id="RHSA-2026:19569" type="rhsa" title="RHSA-2026:19569"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56603" id="CVE-2024-56603" type="cve" title="CVE-2024-56603"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-39766" id="CVE-2025-39766" type="cve" title="CVE-2025-39766"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68724" id="CVE-2025-68724" type="cve" title="CVE-2025-68724"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68741" id="CVE-2025-68741" type="cve" title="CVE-2025-68741"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23270" id="CVE-2026-23270" type="cve" title="CVE-2026-23270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23401" id="CVE-2026-23401" type="cve" title="CVE-2026-23401"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31402" id="CVE-2026-31402" type="cve" title="CVE-2026-31402"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31408" id="CVE-2026-31408" type="cve" title="CVE-2026-31408"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31607" id="CVE-2026-31607" type="cve" title="CVE-2026-31607"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43128" id="CVE-2026-43128" type="cve" title="CVE-2026-43128"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43284" id="CVE-2026-43284" type="cve" title="CVE-2026-43284"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46300" id="CVE-2026-46300" type="cve" title="CVE-2026-46300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46333" id="CVE-2026-46333" type="cve" title="CVE-2026-46333"/>
      <reference href="https://bugzilla.redhat.com/2334439" id="2334439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2394648" id="2394648" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2424886" id="2424886" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2425046" id="2425046" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448745" id="2448745" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2453803" id="2453803" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454844" id="2454844" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455334" id="2455334" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461521" id="2461521" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467144" id="2467144" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467771" id="2467771" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477015" id="2477015" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477802" id="2477802" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19569.html" id="ALSA-2026:19569" type="self" title="ALSA-2026:19569"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="kernel-headers" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.16.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1cffce23405cfc59731c027c536dfe667dbd5536b1ab4f5bc384066785e87055</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.16.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5044939e24abcee8776faa6dbe080a8999c23d5a39682d84edee3656888c8386</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.16.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">64c76a2115e5cc2766a6b2d542617f385807f45f1783668a0a20d3c4bf104f1a</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.16.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">a30d005f590aa010563453b7942bdd2cfa63cee5945427cf1bda74dd421aed6b</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.16.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">be175ae3124b9dfc94b7898105c811d654a00a24e6a53d156cc839b6e501e680</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.16.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cc7e7e49ea48111c4c48c4632d76f45f6972580389461c31cbaa487bfd97b7ad</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.16.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d036bb5d6c0fe98cab057a99e3a03f39cd0921c97701539b51bcfe86a6db2cf5</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.16.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d5b0f9ebc2dd4e282f3cb5cf9469ba8f24e323f241488ea2613d98cedbe89e4f</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.16.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ebc2475f5f944cc4a581bf950481fee53493dca82e6447fb2a77525cb6879d66</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.16.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f4bb9d8d576d087002b35e7fb1664d1f5f3561701e91674c57fc5247c5dba0ab</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20594</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-05-27 13:09:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20594" id="RHSA-2026:20594" type="rhsa" title="RHSA-2026:20594"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4046" id="CVE-2026-4046" type="cve" title="CVE-2026-4046"/>
      <reference href="https://bugzilla.redhat.com/2453117" id="2453117" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20594.html" id="ALSA-2026:20594" type="self" title="ALSA-2026:20594"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="glibc-devel" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="x86_64" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-devel-2.39-124.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">233dbb230a9bee4102903df8b741cd006dd7088907579d700d1c9324bb3e8bea</sum>
        </package>
        <package name="glibc-locale-source" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="x86_64" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-locale-source-2.39-124.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">40783a9a37504001415947d2758edf9c2b269ef423a3370e0760d8d45bc758a2</sum>
        </package>
        <package name="glibc-utils" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="x86_64" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-utils-2.39-124.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">6a78e76a00a637aab55ba3cdf6090b86b1078a3c9ff5aae99e3b81364c12ef8e</sum>
        </package>
        <package name="glibc-doc" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="noarch" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-doc-2.39-124.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">c589ecc76ade948f7fc3324ba9ed3bd004cb7f413e99688e10998fd997695708</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20606</id>
    <title>Important: ruby4.0 security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-06-04 10:20:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ruby4.0 security update</summary>
    <description>Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.  

Security Fix(es):  

  * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)
  * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20606" id="RHSA-2026:20606" type="rhsa" title="RHSA-2026:20606"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33210" id="CVE-2026-33210" type="cve" title="CVE-2026-33210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41316" id="CVE-2026-41316" type="cve" title="CVE-2026-41316"/>
      <reference href="https://bugzilla.redhat.com/2449871" id="2449871" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461369" id="2461369" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20606.html" id="ALSA-2026:20606" type="self" title="ALSA-2026:20606"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="ruby4.0" version="4.0.3" release="34.el10_2" epoch="0" arch="x86_64" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-4.0.3-34.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5dfc9420bf129a7360045e7311d5d5894fe8048692c68094eaedd7a48292a159</sum>
        </package>
        <package name="ruby4.0-rubygem-mysql2" version="0.5.7" release="34.el10_2" epoch="0" arch="x86_64" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-mysql2-0.5.7-34.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6ba090e1344a07de7a1020980f5954d4eb369e2f76979f22d91d7c9f1493e76c</sum>
        </package>
        <package name="ruby4.0-rubygem-pg" version="1.6.3" release="34.el10_2" epoch="0" arch="x86_64" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-pg-1.6.3-34.el10_2.x86_64.rpm</filename>
          <sum type="sha256">91196d5689b51e27522e96f59dc022f84c67583951e5afab27d63033ac5d7c24</sum>
        </package>
        <package name="ruby4.0-devel" version="4.0.3" release="34.el10_2" epoch="0" arch="x86_64" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-devel-4.0.3-34.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fb7962b02c51276b445d1373cc1cd0894c3a399b2c95202c193c4252e88d1e32</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20693</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-05-27 12:56:49"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>mysql8.4 security update</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.  

Security Fix(es):  

  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004)
  * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238)
  * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236)
  * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304)
  * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20693" id="RHSA-2026:20693" type="rhsa" title="RHSA-2026:20693"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-21998" id="CVE-2026-21998" type="cve" title="CVE-2026-21998"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22001" id="CVE-2026-22001" type="cve" title="CVE-2026-22001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22002" id="CVE-2026-22002" type="cve" title="CVE-2026-22002"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22004" id="CVE-2026-22004" type="cve" title="CVE-2026-22004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22005" id="CVE-2026-22005" type="cve" title="CVE-2026-22005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22009" id="CVE-2026-22009" type="cve" title="CVE-2026-22009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22015" id="CVE-2026-22015" type="cve" title="CVE-2026-22015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22017" id="CVE-2026-22017" type="cve" title="CVE-2026-22017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34270" id="CVE-2026-34270" type="cve" title="CVE-2026-34270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34271" id="CVE-2026-34271" type="cve" title="CVE-2026-34271"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34276" id="CVE-2026-34276" type="cve" title="CVE-2026-34276"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34303" id="CVE-2026-34303" type="cve" title="CVE-2026-34303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34304" id="CVE-2026-34304" type="cve" title="CVE-2026-34304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34308" id="CVE-2026-34308" type="cve" title="CVE-2026-34308"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35236" id="CVE-2026-35236" type="cve" title="CVE-2026-35236"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35237" id="CVE-2026-35237" type="cve" title="CVE-2026-35237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35238" id="CVE-2026-35238" type="cve" title="CVE-2026-35238"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35239" id="CVE-2026-35239" type="cve" title="CVE-2026-35239"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35240" id="CVE-2026-35240" type="cve" title="CVE-2026-35240"/>
      <reference href="https://bugzilla.redhat.com/2460274" id="2460274" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460275" id="2460275" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460276" id="2460276" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460279" id="2460279" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460295" id="2460295" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460312" id="2460312" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460315" id="2460315" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460316" id="2460316" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460323" id="2460323" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460324" id="2460324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460325" id="2460325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460326" id="2460326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460329" id="2460329" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460335" id="2460335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460342" id="2460342" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460344" id="2460344" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460348" id="2460348" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460356" id="2460356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460358" id="2460358" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20693.html" id="ALSA-2026:20693" type="self" title="ALSA-2026:20693"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="mysql8.4" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="x86_64" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-8.4.9-1.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">02025d4dda7536494fdf8f075d64c8cdf063cf78b5fc0651e751e422bccfd394</sum>
        </package>
        <package name="mysql8.4-common" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-common-8.4.9-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">0d7ccc94e1089ffb6b3fbcd721eec0fed9e1f3494a20fd6d6458a4b6df88a845</sum>
        </package>
        <package name="mysql8.4-errmsg" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.9-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">1be911010c4913a85c01b874457f48ba4933cb9701ec3fe5760128223f810f45</sum>
        </package>
        <package name="mysql8.4-server" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="x86_64" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-server-8.4.9-1.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">56754d6f774d38000071d28999b8f59a84b68711e527887ef9543c752c27d366</sum>
        </package>
        <package name="mysql8.4-libs" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="x86_64" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-libs-8.4.9-1.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">8cbff422a640f21b93c9ced9b8e7573f53e0fc09108e19135e19036fe04cfe52</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21286</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-05-27 00:00:00"/>
    <updated date="2026-05-28 12:38:34"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 8.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):  

  * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)
  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21286" id="RHSA-2026:21286" type="rhsa" title="RHSA-2026:21286"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34043" id="CVE-2026-34043" type="cve" title="CVE-2026-34043"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899"/>
      <reference href="https://bugzilla.redhat.com/2453284" id="2453284" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476605" id="2476605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21286.html" id="ALSA-2026:21286" type="self" title="ALSA-2026:21286"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="dotnet-apphost-pack-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.27-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">28a47238213578c9246611dc38dd10ebbd21588f6910154766ecd0f5d32d1028</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.27-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">42e162af24604895f70a89c5fb76da147946186a7d1deba5bb5fe5f9a9e855ab</sum>
        </package>
        <package name="dotnet-templates-8.0" version="8.0.127" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.127-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">72e7209c1c1f192573785e4648b39233e486c22a0772b2ae0439cb7952ea58ba</sum>
        </package>
        <package name="dotnet-sdk-8.0" version="8.0.127" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.127-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">79fdd6537dc4b2018c063c0d48b0799cd219511cd19c13a0269cf2adb4fced4d</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" version="8.0.127" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.127-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8959f81ed4672d401fda0620b925f057c6d6693f732bf5552872a7fa3437c2bc</sum>
        </package>
        <package name="dotnet-runtime-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.27-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a7d04c93f73c3f3f031608991479b15b9267a03d5ab16498d75beca4de4c7ba0</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.27-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ad8a6b30bc7dee784a6441062ec36690c8d00db0bb626cadbfe408836256397d</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.27-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ad9ccc9918b763b10e7b58896754fd993708bee096b6da633b7034b2d621e54c</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.27-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">add6d568c8d5729db9d04301581e286fb8bb56191d767822f480a519ae5c1abd</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.27-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f8c2eb826ad0d76b32966a1d05041a1efce7c156e3164048a553f401eb6e630c</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" version="8.0.27" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.27-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fc5309d5d11e0e985f3b9846d5272a908bf18de6c6fd39c1d60ecd9a35dccae4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21380</id>
    <title>Important: firefox security update</title>
    <issued date="2026-05-27 00:00:00"/>
    <updated date="2026-05-29 09:42:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)
  * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)
  * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)
  * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)
  * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975)
  * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)
  * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968)
  * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)
  * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958)
  * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)
  * firefox: Privilege escalation in the Security component (CVE-2026-8970)
  * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)
  * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)
  * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)
  * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)
  * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)
  * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)
  * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21380" id="RHSA-2026:21380" type="rhsa" title="RHSA-2026:21380"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8388" id="CVE-2026-8388" type="cve" title="CVE-2026-8388"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8391" id="CVE-2026-8391" type="cve" title="CVE-2026-8391"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8401" id="CVE-2026-8401" type="cve" title="CVE-2026-8401"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8946" id="CVE-2026-8946" type="cve" title="CVE-2026-8946"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8947" id="CVE-2026-8947" type="cve" title="CVE-2026-8947"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8950" id="CVE-2026-8950" type="cve" title="CVE-2026-8950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8953" id="CVE-2026-8953" type="cve" title="CVE-2026-8953"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8954" id="CVE-2026-8954" type="cve" title="CVE-2026-8954"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8955" id="CVE-2026-8955" type="cve" title="CVE-2026-8955"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8956" id="CVE-2026-8956" type="cve" title="CVE-2026-8956"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8957" id="CVE-2026-8957" type="cve" title="CVE-2026-8957"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8958" id="CVE-2026-8958" type="cve" title="CVE-2026-8958"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8961" id="CVE-2026-8961" type="cve" title="CVE-2026-8961"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8962" id="CVE-2026-8962" type="cve" title="CVE-2026-8962"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8968" id="CVE-2026-8968" type="cve" title="CVE-2026-8968"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8970" id="CVE-2026-8970" type="cve" title="CVE-2026-8970"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8974" id="CVE-2026-8974" type="cve" title="CVE-2026-8974"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8975" id="CVE-2026-8975" type="cve" title="CVE-2026-8975"/>
      <reference href="https://bugzilla.redhat.com/2476469" id="2476469" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476475" id="2476475" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476492" id="2476492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479839" id="2479839" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479840" id="2479840" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479842" id="2479842" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479846" id="2479846" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479847" id="2479847" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479848" id="2479848" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479849" id="2479849" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479852" id="2479852" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479853" id="2479853" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479855" id="2479855" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479860" id="2479860" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479871" id="2479871" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479873" id="2479873" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479876" id="2479876" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479880" id="2479880" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21380.html" id="ALSA-2026:21380" type="self" title="ALSA-2026:21380"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.11.0" release="1.el10_2" epoch="0" arch="x86_64" src="firefox-140.11.0-1.el10_2.src.rpm">
          <filename>firefox-140.11.0-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0b380eed69d054c22a6380859c53ca98c0bb2b8b647549eae0dcb08b061e579a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21433</id>
    <title>Important: httpd security update</title>
    <issued date="2026-05-27 00:00:00"/>
    <updated date="2026-05-28 12:35:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>httpd security update</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  

Security Fix(es):  

  * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
  * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
  * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
  * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
  * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21433" id="RHSA-2026:21433" type="rhsa" title="RHSA-2026:21433"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-28780" id="CVE-2026-28780" type="cve" title="CVE-2026-28780"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33007" id="CVE-2026-33007" type="cve" title="CVE-2026-33007"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33857" id="CVE-2026-33857" type="cve" title="CVE-2026-33857"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34032" id="CVE-2026-34032" type="cve" title="CVE-2026-34032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34059" id="CVE-2026-34059" type="cve" title="CVE-2026-34059"/>
      <reference href="https://bugzilla.redhat.com/2464940" id="2464940" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464952" id="2464952" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464953" id="2464953" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2465299" id="2465299" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2466913" id="2466913" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21433.html" id="ALSA-2026:21433" type="self" title="ALSA-2026:21433"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="mod_session" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_session-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">120860ade7b76f46ace15e1eeb986321e2a46817639186e50eb873191f75be57</sum>
        </package>
        <package name="httpd-devel" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-devel-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">150db8fb127f5cf5220e1772e46aad0d1f9da6b82de35f058551372ce475f2bb</sum>
        </package>
        <package name="httpd-core" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-core-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">24b6219f280d132ead33cd72817118ccb718fa117d81eec5aa870329478394c9</sum>
        </package>
        <package name="mod_ssl" version="2.4.63" release="13.el10_2.1" epoch="1" arch="x86_64" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_ssl-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">5f339d1c35bd2a0bd6c2f541dd9d6fb125aec4b8c1ea929ee9714490b63e2c98</sum>
        </package>
        <package name="mod_ldap" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_ldap-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">75ef1e1d559de5181005a673c97ac20e3bd03d01ba82614ba9a5910ee3a4a44c</sum>
        </package>
        <package name="httpd-tools" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-tools-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">834c2d11f99fca536a267ed1fdeff9c959fe36b8a9c43312a913470290a3eaa7</sum>
        </package>
        <package name="httpd" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">8a619b7ae8f396862ce0cb03d8475586fb8f711cb5b43275aec8012c93218bfb</sum>
        </package>
        <package name="mod_proxy_html" version="2.4.63" release="13.el10_2.1" epoch="1" arch="x86_64" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_proxy_html-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">91032254f4ff3674293cc553b7be162dce727ff9ca865a4dcfa4f4ff13cd55ff</sum>
        </package>
        <package name="mod_lua" version="2.4.63" release="13.el10_2.1" epoch="0" arch="x86_64" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_lua-2.4.63-13.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">ca537fcd6e9ab70a31f5cf0c775bcee0a536164432e075ce73bd4d3ab5aa29dc</sum>
        </package>
        <package name="httpd-filesystem" version="2.4.63" release="13.el10_2.1" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e031b93501860443509180fc94ca9fd2f55bb1e5c48013833c3648cf8b45ea9f</sum>
        </package>
        <package name="httpd-manual" version="2.4.63" release="13.el10_2.1" epoch="0" arch="noarch" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e3cfbdbc5fcf4512653e1a0be2d6396861efc9b9c15498e4543c0fcbc556c07a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21557</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-06-08 09:59:53"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
  * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
  * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
  * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
  * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
  * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
  * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
  * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
  * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)
  * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
  * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
  * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
  * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
  * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
  * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
  * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)
  * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
  * kernel: mm/page_alloc: clear page-&gt;private in free_pages_prepare() (CVE-2026-43303)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21557" id="RHSA-2026:21557" type="rhsa" title="RHSA-2026:21557"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56645" id="CVE-2024-56645" type="cve" title="CVE-2024-56645"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68183" id="CVE-2025-68183" type="cve" title="CVE-2025-68183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23375" id="CVE-2026-23375" type="cve" title="CVE-2026-23375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23392" id="CVE-2026-23392" type="cve" title="CVE-2026-23392"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23455" id="CVE-2026-23455" type="cve" title="CVE-2026-23455"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31684" id="CVE-2026-31684" type="cve" title="CVE-2026-31684"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31685" id="CVE-2026-31685" type="cve" title="CVE-2026-31685"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43006" id="CVE-2026-43006" type="cve" title="CVE-2026-43006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43020" id="CVE-2026-43020" type="cve" title="CVE-2026-43020"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43023" id="CVE-2026-43023" type="cve" title="CVE-2026-43023"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43027" id="CVE-2026-43027" type="cve" title="CVE-2026-43027"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43051" id="CVE-2026-43051" type="cve" title="CVE-2026-43051"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43110" id="CVE-2026-43110" type="cve" title="CVE-2026-43110"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43116" id="CVE-2026-43116" type="cve" title="CVE-2026-43116"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43158" id="CVE-2026-43158" type="cve" title="CVE-2026-43158"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43190" id="CVE-2026-43190" type="cve" title="CVE-2026-43190"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43205" id="CVE-2026-43205" type="cve" title="CVE-2026-43205"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43303" id="CVE-2026-43303" type="cve" title="CVE-2026-43303"/>
      <reference href="https://bugzilla.redhat.com/2334560" id="2334560" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2422699" id="2422699" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451199" id="2451199" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451218" id="2451218" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454810" id="2454810" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461757" id="2461757" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461759" id="2461759" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464369" id="2464369" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464402" id="2464402" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464455" id="2464455" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464462" id="2464462" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464496" id="2464496" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467005" id="2467005" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467014" id="2467014" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467064" id="2467064" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467090" id="2467090" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467210" id="2467210" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468091" id="2468091" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21557.html" id="ALSA-2026:21557" type="self" title="ALSA-2026:21557"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="kernel-devel" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.18.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">08caf980bc4857e1c7641a40f56b730826e5f590192ec241b95346ab0faac527</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.18.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">26867a80d66a188b52dde8805a82f6d83daa698e8c18d4cd065db8991e6aa863</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.18.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5e14c41b3aa5dc4f50f48ccd8e4d9dc90224bc8f3135ce692d4cf9d25931763d</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.18.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">641a5604e601fe456a7637591703aac6288b171a3d258660a22f32e295c71cc3</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.18.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">854278fe146a1c1182457ad64183e27b37d5569bfa1fdb85579d988d55b3da2c</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.18.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a33491dbb0a480beb220468c299e92346b3cb589bcdd187e083cb64a3d158d36</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.18.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c4760e16e10934278ae931e762a9fb9a353253cf1e8b1fa527ed7f3bad6b604a</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.18.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">d65ef7f528d990c65a6b7fb8ffc6e3ded25ceee509be5fa08d627d0c203045e9</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.18.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d676112d2d9e847f60597be4341bb1bbb1f4bc13166f02a2df5a640663f754d7</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.18.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f6f25b43dcd660d561f45dcd6018ca96e3508aec1b1365ca9e21b74dcc50649d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21676</id>
    <title>Important: cockpit security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-28 14:30:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>cockpit security update</summary>
    <description>Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.  

Security Fix(es):  

  * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21676" id="RHSA-2026:21676" type="rhsa" title="RHSA-2026:21676"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4802" id="CVE-2026-4802" type="cve" title="CVE-2026-4802"/>
      <reference href="https://bugzilla.redhat.com/2451155" id="2451155" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21676.html" id="ALSA-2026:21676" type="self" title="ALSA-2026:21676"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="cockpit-packagekit" version="356.2" release="1.el10_2" epoch="0" arch="noarch" src="cockpit-356.2-1.el10_2.src.rpm">
          <filename>cockpit-packagekit-356.2-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">29bea62d6da80ffe7185c0a5c07130c9f8bdd8cf3db5e6956ab11f4675ba353b</sum>
        </package>
        <package name="cockpit-storaged" version="356.2" release="1.el10_2" epoch="0" arch="noarch" src="cockpit-356.2-1.el10_2.src.rpm">
          <filename>cockpit-storaged-356.2-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">db2a2a221c93a54b55c9d8c46acdea7e845e9d978c1572d583e9113742dd59f2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21754</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-29 11:49:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 9.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es):  

  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21754" id="RHSA-2026:21754" type="rhsa" title="RHSA-2026:21754"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899"/>
      <reference href="https://bugzilla.redhat.com/2476605" id="2476605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21754.html" id="ALSA-2026:21754" type="self" title="ALSA-2026:21754"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="aspnetcore-runtime-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0da5677aed7317cf4e692b99f87039833a7a54cf4eb80b6354b725de4f7a13c3</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">145c5d9f71d622c8523e409f4ad5b9936e7cc78e4359a7daf7d1e6362143ce77</sum>
        </package>
        <package name="dotnet-runtime-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">348272494beb45bfe84fca89f2729b130b949395d8361d5080da4dbeb1d2c256</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3f8dc5c0d4e97334af9cbf7e1be1b0857f9676df0cfa41bcfeef2a87bca2c60a</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4218319dc85d8b57ecd98032c60971af5aafc4ae3f41b752fd38b8df67e93a8d</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6206d6f4e709db63e62bfd2658cba6f892cbed48dd1edff54d52d9deb6e8e9e6</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7397b25e901cf63f99a8aef53efe360231ae9bda87a653f748977e17f7e9dcc1</sum>
        </package>
        <package name="dotnet-sdk-9.0" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">96118df3fe3da3125e4b63f109700e215bfd8637318880605ce578e92dd382ba</sum>
        </package>
        <package name="dotnet-templates-9.0" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a6e5433e9bdac3d9679e2d2b030b4e7e20401c861daf4dc2c14e31a2e982888a</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bea4602049b68a802aa26776ad61d3040cc97149e6760cc38dcf53c03c749a8e</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c63f0c2d887f16fa398a214f7311ca7d0b48f0952aa4971bf161798e4e37778c</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" version="9.0.117" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.117-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cc58a24647d9c88c2b57636b38e1aaa18b4effdae8b4b0f4beeb2fd24b46e8b3</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" version="9.0.16" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.16-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d09bb8e99423f37a375eff7f436a4911f5244ba1cca3bd3e9b06f2f7269f1b44</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21757</id>
    <title>Important: flatpak security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-29 12:28:08"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>flatpak security update</summary>
    <description>Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  

Security Fix(es):  

  * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
  * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21757" id="RHSA-2026:21757" type="rhsa" title="RHSA-2026:21757"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34078" id="CVE-2026-34078" type="cve" title="CVE-2026-34078"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34079" id="CVE-2026-34079" type="cve" title="CVE-2026-34079"/>
      <reference href="https://bugzilla.redhat.com/2456276" id="2456276" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456284" id="2456284" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21757.html" id="ALSA-2026:21757" type="self" title="ALSA-2026:21757"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="flatpak-session-helper" version="1.16.0" release="9.el10_2.1" epoch="0" arch="x86_64" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-session-helper-1.16.0-9.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">009148cf7dace481fa7986da224b17ffa99787d388741a02f62ce50926b009ac</sum>
        </package>
        <package name="flatpak-selinux" version="1.16.0" release="9.el10_2.1" epoch="0" arch="noarch" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">22949ff4b832a5fbaf79d354cfc73af59a6746d662dcf4d0c294b24dcd69a9c7</sum>
        </package>
        <package name="flatpak-libs" version="1.16.0" release="9.el10_2.1" epoch="0" arch="x86_64" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-libs-1.16.0-9.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">89994cf375fae9ddab6a1a576062a3e0e12e51c53596300a73438b2fef47c918</sum>
        </package>
        <package name="flatpak" version="1.16.0" release="9.el10_2.1" epoch="0" arch="x86_64" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-1.16.0-9.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">96149e48e94da829daf167ad7f76f85ae02b6597b3d8e40d010448666736677e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22145</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-01 00:00:00"/>
    <updated date="2026-06-03 07:58:16"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 10.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es):  

  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22145" id="RHSA-2026:22145" type="rhsa" title="RHSA-2026:22145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899"/>
      <reference href="https://bugzilla.redhat.com/2476605" id="2476605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22145.html" id="ALSA-2026:22145" type="self" title="ALSA-2026:22145"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="dotnet-runtime-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0bb27b7886456a46c6aeeb1c1ca3832128ef226a5ea29eb259ebc324e83bf429</sum>
        </package>
        <package name="dotnet-host" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">10e767b104f59a4875d125b810eda2e69eec1f32b180a65833d01b837e3b9f62</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">29af4038cbaeb3e9d20aed112507f756ef520422a79c1e7df1d71d537264c2e7</sum>
        </package>
        <package name="dotnet-templates-10.0" version="10.0.108" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.108-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3d9435dbb5958169719599e9242f11544bbe999b898aa2704c986d095583f475</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" version="10.0.108" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.108-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4bacffa257a1ad892cb9d1f1979665005ee34dcadabf248840a0f0f6c131e80f</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" version="10.0.108" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.108-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6a6e67648e28c12406eaedcd379111df5cac205db0f4df69c222495337e5e85b</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7cc9d92edd03f67d5ada22bb4c5501e56561589a436cabe65584f3256dbaf30d</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a958834cf717d29e4a6106bbb0ae2609b9b5ac51eeb9bcbdd380d3300bd8e179</sum>
        </package>
        <package name="dotnet-sdk-10.0" version="10.0.108" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.108-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">acd1f70ad88c634d55a25316cb8028b7d3e65c46589d967ba6a3774d43577878</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bd986c125f591131afe84314d8c0ce722c79a4ee4962c40ae35fd1e403b55d95</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c719ee1ad4ea4f8ac007915be31cdf56d75385b9cb11968d0f991e1469a4a398</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">da48bcad0bd6507586f36c49efa7e8437a1259c226ec338ae3f2005ef646507f</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" version="10.0.8" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.8-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">dfcae1d3c08ea278fbae00761c6d5417d257998c2479af014647d7ce07571e99</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22314</id>
    <title>Moderate: openssl security update</title>
    <issued date="2026-06-01 00:00:00"/>
    <updated date="2026-06-03 07:56:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>openssl security update</summary>
    <description>OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  

Security Fix(es):  

  * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22314" id="RHSA-2026:22314" type="rhsa" title="RHSA-2026:22314"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-28390" id="CVE-2026-28390" type="cve" title="CVE-2026-28390"/>
      <reference href="https://bugzilla.redhat.com/2456314" id="2456314" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22314.html" id="ALSA-2026:22314" type="self" title="ALSA-2026:22314"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="openssl-perl" version="3.5.5" release="3.el10_2.alma.1" epoch="1" arch="x86_64" src="openssl-3.5.5-3.el10_2.alma.1.src.rpm">
          <filename>openssl-perl-3.5.5-3.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">30723d71d0f9295957e1f627634aa4de75a9c7e167c3ffc9490084f62d5180dc</sum>
        </package>
        <package name="openssl-devel" version="3.5.5" release="3.el10_2.alma.1" epoch="1" arch="x86_64" src="openssl-3.5.5-3.el10_2.alma.1.src.rpm">
          <filename>openssl-devel-3.5.5-3.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">824db290b02f56e9c6d021d0fc5d51cf7c6d90e7df7f0488efb5958c49f8412b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22325</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-06-01 00:00:00"/>
    <updated date="2026-06-03 07:54:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>thunderbird security update</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.  

Security Fix(es):  

  * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)
  * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)
  * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)
  * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)
  * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975)
  * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)
  * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968)
  * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)
  * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958)
  * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)
  * firefox: Privilege escalation in the Security component (CVE-2026-8970)
  * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)
  * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)
  * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)
  * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959)
  * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)
  * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)
  * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)
  * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22325" id="RHSA-2026:22325" type="rhsa" title="RHSA-2026:22325"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8388" id="CVE-2026-8388" type="cve" title="CVE-2026-8388"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8391" id="CVE-2026-8391" type="cve" title="CVE-2026-8391"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8401" id="CVE-2026-8401" type="cve" title="CVE-2026-8401"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8946" id="CVE-2026-8946" type="cve" title="CVE-2026-8946"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8947" id="CVE-2026-8947" type="cve" title="CVE-2026-8947"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8950" id="CVE-2026-8950" type="cve" title="CVE-2026-8950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8953" id="CVE-2026-8953" type="cve" title="CVE-2026-8953"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8954" id="CVE-2026-8954" type="cve" title="CVE-2026-8954"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8955" id="CVE-2026-8955" type="cve" title="CVE-2026-8955"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8956" id="CVE-2026-8956" type="cve" title="CVE-2026-8956"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8957" id="CVE-2026-8957" type="cve" title="CVE-2026-8957"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8958" id="CVE-2026-8958" type="cve" title="CVE-2026-8958"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8959" id="CVE-2026-8959" type="cve" title="CVE-2026-8959"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8961" id="CVE-2026-8961" type="cve" title="CVE-2026-8961"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8962" id="CVE-2026-8962" type="cve" title="CVE-2026-8962"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8968" id="CVE-2026-8968" type="cve" title="CVE-2026-8968"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8970" id="CVE-2026-8970" type="cve" title="CVE-2026-8970"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8974" id="CVE-2026-8974" type="cve" title="CVE-2026-8974"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8975" id="CVE-2026-8975" type="cve" title="CVE-2026-8975"/>
      <reference href="https://bugzilla.redhat.com/2476469" id="2476469" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476475" id="2476475" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476492" id="2476492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479839" id="2479839" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479840" id="2479840" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479842" id="2479842" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479846" id="2479846" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479847" id="2479847" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479848" id="2479848" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479849" id="2479849" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479852" id="2479852" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479853" id="2479853" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479855" id="2479855" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479860" id="2479860" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479861" id="2479861" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479871" id="2479871" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479873" id="2479873" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479876" id="2479876" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479880" id="2479880" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22325.html" id="ALSA-2026:22325" type="self" title="ALSA-2026:22325"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="thunderbird" version="140.11.0" release="1.el10_2.alma.1" epoch="0" arch="x86_64" src="thunderbird-140.11.0-1.el10_2.alma.1.src.rpm">
          <filename>thunderbird-140.11.0-1.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">8126f3b01e2322cae3f003bc16ae39de3634f4772f47af7d44d2bcc924c0b748</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22528</id>
    <title>Moderate: mod_http2 security update</title>
    <issued date="2026-06-02 00:00:00"/>
    <updated date="2026-06-03 12:42:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>mod_http2 security update</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.  

Security Fix(es):  

  * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22528" id="RHSA-2026:22528" type="rhsa" title="RHSA-2026:22528"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-53020" id="CVE-2025-53020" type="cve" title="CVE-2025-53020"/>
      <reference href="https://bugzilla.redhat.com/2379343" id="2379343" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22528.html" id="ALSA-2026:22528" type="self" title="ALSA-2026:22528"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="mod_http2" version="2.0.29" release="4.el10_2" epoch="0" arch="x86_64" src="mod_http2-2.0.29-4.el10_2.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0fc8e0c70d9a7e43eae5b53c0e1e55cd429d4a8dc373d34df05bc9188ac59bbe</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22529</id>
    <title>Moderate: libexif security update</title>
    <issued date="2026-06-02 00:00:00"/>
    <updated date="2026-06-04 14:44:27"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libexif security update</summary>
    <description>The libexif packages provide a library for extracting extra information from image files.  

Security Fix(es):  

  * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22529" id="RHSA-2026:22529" type="rhsa" title="RHSA-2026:22529"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40386" id="CVE-2026-40386" type="cve" title="CVE-2026-40386"/>
      <reference href="https://bugzilla.redhat.com/2457689" id="2457689" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22529.html" id="ALSA-2026:22529" type="self" title="ALSA-2026:22529"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libexif" version="0.6.24" release="9.el10_2.1" epoch="0" arch="x86_64" src="libexif-0.6.24-9.el10_2.1.src.rpm">
          <filename>libexif-0.6.24-9.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">bafb41c91c362c01aa3f2f1a88d26710ae9894038393fa438000d4d1f82f573a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22711</id>
    <title>Moderate: vim security update</title>
    <issued date="2026-06-03 00:00:00"/>
    <updated date="2026-06-03 12:43:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>vim security update</summary>
    <description>Vim (Vi IMproved) is an updated and improved version of the vi editor.  

Security Fix(es):  

  * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22711" id="RHSA-2026:22711" type="rhsa" title="RHSA-2026:22711"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35177" id="CVE-2026-35177" type="cve" title="CVE-2026-35177"/>
      <reference href="https://bugzilla.redhat.com/2455542" id="2455542" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22711.html" id="ALSA-2026:22711" type="self" title="ALSA-2026:22711"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="xxd" version="9.1.083" release="9.el10_2.3" epoch="2" arch="x86_64" src="vim-9.1.083-9.el10_2.3.src.rpm">
          <filename>xxd-9.1.083-9.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">04fb1a400acf29da0fff8ea38584b999ea80d0d7a62efdd7d9898958a9cc905f</sum>
        </package>
        <package name="vim-X11" version="9.1.083" release="9.el10_2.3" epoch="2" arch="x86_64" src="vim-9.1.083-9.el10_2.3.src.rpm">
          <filename>vim-X11-9.1.083-9.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">5e7bbafac49f75321c84a0b404cd61c8ddb15b9b32ecf6137b7c91e78758fe64</sum>
        </package>
        <package name="vim-enhanced" version="9.1.083" release="9.el10_2.3" epoch="2" arch="x86_64" src="vim-9.1.083-9.el10_2.3.src.rpm">
          <filename>vim-enhanced-9.1.083-9.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">989a0e01a86edfacb098d37463d4d61d9f430b26066db5856bc306dc2931f1aa</sum>
        </package>
        <package name="vim-common" version="9.1.083" release="9.el10_2.3" epoch="2" arch="x86_64" src="vim-9.1.083-9.el10_2.3.src.rpm">
          <filename>vim-common-9.1.083-9.el10_2.3.x86_64.rpm</filename>
          <sum type="sha256">a3e3a39da4f3a440e44cdb482a81fa40f0a9efcb4d5cb005c20d068126f93051</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22715</id>
    <title>Important: expat security update</title>
    <issued date="2026-06-03 00:00:00"/>
    <updated date="2026-06-04 08:56:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>expat security update</summary>
    <description>Expat is a C library for parsing XML documents.  

Security Fix(es):  

  * libexpat: denial of service via crafted XML input (CVE-2026-45186)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22715" id="RHSA-2026:22715" type="rhsa" title="RHSA-2026:22715"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45186" id="CVE-2026-45186" type="cve" title="CVE-2026-45186"/>
      <reference href="https://bugzilla.redhat.com/2468575" id="2468575" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22715.html" id="ALSA-2026:22715" type="self" title="ALSA-2026:22715"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="expat-devel" version="2.7.3" release="1.el10_2.1" epoch="0" arch="x86_64" src="expat-2.7.3-1.el10_2.1.src.rpm">
          <filename>expat-devel-2.7.3-1.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">e1111821c9444a5474b5de9855e2329ea517889410237bb53540f88a0fa8f930</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22963</id>
    <title>Critical: samba security update</title>
    <issued date="2026-06-03 00:00:00"/>
    <updated date="2026-06-04 10:06:47"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>samba security update</summary>
    <description>Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.  

Security Fix(es):  

  * samba: Missing access check on reparse point operations (CVE-2026-1933)
  * samba: vfs_worm does not block directory modification (CVE-2026-2340)
  * samba: group policy certificate enrollment uses &lt;http://&gt; without validation (CVE-2026-3012)
  * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
  * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
  * samba: Remote Code Execution in SAMR (CVE-2026-4408)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22963" id="RHSA-2026:22963" type="rhsa" title="RHSA-2026:22963"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1933" id="CVE-2026-1933" type="cve" title="CVE-2026-1933"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2340" id="CVE-2026-2340" type="cve" title="CVE-2026-2340"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3012" id="CVE-2026-3012" type="cve" title="CVE-2026-3012"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40170" id="CVE-2026-40170" type="cve" title="CVE-2026-40170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4408" id="CVE-2026-4408" type="cve" title="CVE-2026-4408"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4480" id="CVE-2026-4480" type="cve" title="CVE-2026-4480"/>
      <reference href="https://bugzilla.redhat.com/2447317" id="2447317" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447318" id="2447318" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447319" id="2447319" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452232" id="2452232" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2459061" id="2459061" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479762" id="2479762" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22963.html" id="ALSA-2026:22963" type="self" title="ALSA-2026:22963"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="samba-gpupdate" version="4.23.5" release="109.el10_2" epoch="0" arch="noarch" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-gpupdate-4.23.5-109.el10_2.noarch.rpm</filename>
          <sum type="sha256">02ab33c4186fb468d4de6cffac56cd285836279fe4e2d03245fef1dcf26dd611</sum>
        </package>
        <package name="samba-winbind-krb5-locator" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-winbind-krb5-locator-4.23.5-109.el10_2.x86_64.rpm</filename>
          <sum type="sha256">19d3b3bc02a6ff5ab83f018983609cb0f89e616bf5760b5d96696d38966d4df0</sum>
        </package>
        <package name="samba-winbind-clients" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-winbind-clients-4.23.5-109.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3cec8378e7fe3f5096cb191a321b813f1e18925e2f5294b90c4f9acf4fa9a6d3</sum>
        </package>
        <package name="samba-winexe" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-winexe-4.23.5-109.el10_2.x86_64.rpm</filename>
          <sum type="sha256">80d3a56709dadb80fb0813861704e70927e91a0f3e88b7cc82c4ec4825327ac3</sum>
        </package>
        <package name="samba-krb5-printing" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-krb5-printing-4.23.5-109.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8613872b29e5957a0756d531012359247ac1d759721a16013cfdbdf1fd98900d</sum>
        </package>
        <package name="samba-client" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-client-4.23.5-109.el10_2.x86_64.rpm</filename>
          <sum type="sha256">86fbda1a745879eb13994af7de29c65b032882082cb6563d5254d47f68756e4b</sum>
        </package>
        <package name="samba-vfs-iouring" version="4.23.5" release="109.el10_2" epoch="0" arch="x86_64" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-vfs-iouring-4.23.5-109.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f04c596a994d1f2ed695eaa1cf74ad26da78388bc76b9c10f34e74b511e12a68</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23102</id>
    <title>Important: delve security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-04 10:13:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>delve security update</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.  

Security Fix(es):  

  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23102" id="RHSA-2026:23102" type="rhsa" title="RHSA-2026:23102"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23102.html" id="ALSA-2026:23102" type="self" title="ALSA-2026:23102"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="delve" version="1.26.1" release="2.el10_2" epoch="0" arch="x86_64" src="delve-1.26.1-2.el10_2.src.rpm">
          <filename>delve-1.26.1-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">dd7eddffc1dce8f7da2f915095526a42dbcc884ad14d75b142476bd1715c6687</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23231</id>
    <title>Important: unbound security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-04 11:47:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)
  * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959)
  * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23231" id="RHSA-2026:23231" type="rhsa" title="RHSA-2026:23231"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33278" id="CVE-2026-33278" type="cve" title="CVE-2026-33278"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42944" id="CVE-2026-42944" type="cve" title="CVE-2026-42944"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42959" id="CVE-2026-42959" type="cve" title="CVE-2026-42959"/>
      <reference href="https://bugzilla.redhat.com/2479774" id="2479774" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479806" id="2479806" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479808" id="2479808" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23231.html" id="ALSA-2026:23231" type="self" title="ALSA-2026:23231"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="unbound-dracut" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">1f2b7a0ec44cbed0ba29f3ff4c829d3a740482b208d6aa15738105b3a26d68cb</sum>
        </package>
        <package name="unbound" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">39607ee5f58c1002d2b5973b3440a501eaa5206af5a58285b4f92ec82d6900c4</sum>
        </package>
        <package name="unbound-utils" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">493df831a520b0dbfc33c88b3f651f24536edceb6c2e2433ee0076ba51bb4e8f</sum>
        </package>
        <package name="unbound-anchor" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">4c8837f858f185a685107a2d23cf1f7866f3c890642875e5d018b996ff8a718f</sum>
        </package>
        <package name="python3-unbound" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">7a128194e2c1a158e566d6a179fd766133d46fe09194c4333c70558ed3c43faa</sum>
        </package>
        <package name="unbound-libs" version="1.24.2" release="7.el10_2.1" epoch="0" arch="x86_64" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">a4e30ebdb6e40b3d0538f0bfec0cec51df9b2c4dc67a8b2d2684620454c42116</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23329</id>
    <title>Important: kernel security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-08 10:00:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
  * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
  * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
  * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
  * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
  * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322)
  * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23329" id="RHSA-2026:23329" type="rhsa" title="RHSA-2026:23329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38653" id="CVE-2025-38653" type="cve" title="CVE-2025-38653"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68366" id="CVE-2025-68366" type="cve" title="CVE-2025-68366"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31613" id="CVE-2026-31613" type="cve" title="CVE-2026-31613"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31709" id="CVE-2026-31709" type="cve" title="CVE-2026-31709"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43322" id="CVE-2026-43322" type="cve" title="CVE-2026-43322"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43329" id="CVE-2026-43329" type="cve" title="CVE-2026-43329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46243" id="CVE-2026-46243" type="cve" title="CVE-2026-46243"/>
      <reference href="https://bugzilla.redhat.com/2390372" id="2390372" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2424881" id="2424881" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461480" id="2461480" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464476" id="2464476" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468124" id="2468124" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468131" id="2468131" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481486" id="2481486" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23329.html" id="ALSA-2026:23329" type="self" title="ALSA-2026:23329"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="rv" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.20.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">11196ac54094cf27105e151cc45148fa7fee6ca7dd45f9c77e7972fd5e75c386</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.20.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">284ac60f4eb90a6205a5baf0f3dfb726889d84db56c0da1c7edd204c7d5d58c3</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.20.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4ffc0c9af6ac3b171a92d553a742cdcf5e9ee5e1003b923668f1fbf1d612b02a</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.20.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">581c667d50c3185b4aeafee05d3af4d8ff71c079c22037b8ae2db7c48e9ba331</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.20.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6a497c550a25ec799174818358a000299a5d9f8386756b2ae55e1c7b969dc32b</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.20.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6c8d7fe4f97921bd69aee5fff8d740c3a2ed5ef0eff4bf245ee2785f9d944aad</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.20.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">79b84495712c81dedc46a5c4381fe8bb0f1784fc27bcdd6373a99f9132a0af95</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.20.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8060b40c816f8cd98ed4cd141caebc5a3d0ddbcf8f7141c8fd2a9e4717ae899e</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.20.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">860188de54609c6ccf35f007f84e7478ed0306461b2d41d6363a9f8ece38f0d1</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.20.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">a836026e76d4d01a4cd956f4ff3470e96d192b18c9b27f6d4d5b5e46c6aa8694</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23388</id>
    <title>Important: php security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-05 10:29:27"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>php security update</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.  

Security Fix(es):  

  * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)
  * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)
  * php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)
  * php: NULL pointer dereference in SOAP apache:Map decoder with missing &lt;value&gt; (CVE-2026-7262)
  * php: signed integer overflow in metaphone() (CVE-2026-7568)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23388" id="RHSA-2026:23388" type="rhsa" title="RHSA-2026:23388"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6735" id="CVE-2026-6735" type="cve" title="CVE-2026-6735"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7258" id="CVE-2026-7258" type="cve" title="CVE-2026-7258"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7259" id="CVE-2026-7259" type="cve" title="CVE-2026-7259"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7262" id="CVE-2026-7262" type="cve" title="CVE-2026-7262"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7568" id="CVE-2026-7568" type="cve" title="CVE-2026-7568"/>
      <reference href="https://bugzilla.redhat.com/2468561" id="2468561" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468562" id="2468562" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468564" id="2468564" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468565" id="2468565" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468566" id="2468566" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23388.html" id="ALSA-2026:23388" type="self" title="ALSA-2026:23388"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="php-dbg" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-dbg-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">00d8d0e2460409294998879220617317f17e961869ee0dc4ec2b1bf2e2150639</sum>
        </package>
        <package name="php-intl" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-intl-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1157cc092195febb4c0e9ff2be2a54c46c7f81017594f5d6027638cec9df05f9</sum>
        </package>
        <package name="php-embedded" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-embedded-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">13b1ce13bf2a0b300eb225d56806c87d95b4000fbe3c307707d142f880e44335</sum>
        </package>
        <package name="php-odbc" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-odbc-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">17a9f365fc696479e1838baebf9d2d4f619e990d26a9ff66b9bb3473d6a2c0c5</sum>
        </package>
        <package name="php-opcache" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-opcache-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1da0fda4d1c135bf730ddfd70fa04dcdcc9d784d097a695b4d3f82bb83bfcd1d</sum>
        </package>
        <package name="php-gd" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-gd-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1f79196e05e753b81307ca2033da63b3c7dcaa9c60cff4b6c770e1645094cf22</sum>
        </package>
        <package name="php-pgsql" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-pgsql-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">25374f8bddb3640985f314f77aa93648774d95eb26b892815c39404076afba67</sum>
        </package>
        <package name="php-mbstring" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-mbstring-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">37191858048dafef3a55a9185b8243083bbe94f486c59b60b19f47ad31e635e9</sum>
        </package>
        <package name="php-process" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-process-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4f2e170bb0a8734584b09fa6dca083870932a7595d030176795062510d50974e</sum>
        </package>
        <package name="php-devel" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-devel-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6e819a7e2d7d8237d3c24104e2ed0f6924d2e5efb9dab0cef27f107a99d6885e</sum>
        </package>
        <package name="php-pdo" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-pdo-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7193c3264036813b40588a81e9f449dff3568bf0606ddbe7af2b89d1d86687bb</sum>
        </package>
        <package name="php-gmp" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-gmp-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">72513eb4aa5727c254e42c47e71a784c31e84e8e8fefb8dd0a1b3aee4b93d8a9</sum>
        </package>
        <package name="php-snmp" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-snmp-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">75ad39f3c8848dde0e1c8868a98b1aa7afe6534dbca7e110ca9c10b4802b53ca</sum>
        </package>
        <package name="php-bcmath" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-bcmath-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7862a5edd88540fe43cd248c55322fef0a42267ff253020023b68e20ce422fc9</sum>
        </package>
        <package name="php-cli" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-cli-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a253aed9eb0cb05a0a5b0136fc3ff18f3cdb243e278da1713235bf7010aae873</sum>
        </package>
        <package name="php-fpm" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-fpm-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b1cc5efbb9f3faeba5e6a31e2f974c4ad442ba50b5001d86f2a9377711b2262a</sum>
        </package>
        <package name="php-mysqlnd" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-mysqlnd-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b2c99d90b702bc95134c894f862db3987707ecd4ec44d65e1e3affa849fc879e</sum>
        </package>
        <package name="php-ldap" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-ldap-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b35a6286d4ac3cefe6b49f0ed18704136eb037c211ac272c07f80f669ad9cfe5</sum>
        </package>
        <package name="php-xml" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-xml-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b6aa3af58f40a1a26e02538908fd5c5688f79b387950d1a32b5646fd321c2bc7</sum>
        </package>
        <package name="php-dba" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-dba-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b929b2a71a7c988c6be07ace0db2f4025d0d870ee12739f1451c14c8fa7bdb17</sum>
        </package>
        <package name="php-ffi" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-ffi-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bf7676af7177f7af68a726c4883904fc7e132fe258bbe8540befa28f91b09216</sum>
        </package>
        <package name="php" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d8f6f707ee2aaeadefc19947a5ea8412356dc0d8752ad38e0eb0c22bab2545f3</sum>
        </package>
        <package name="php-enchant" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-enchant-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d99f388948f7b3de56acd9552d0e4d2352a00aa118b31e871a719ebbdf9b4c24</sum>
        </package>
        <package name="php-common" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-common-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f4e2a283149a68ecfea1e7875c8f780fef6aa17499eaa6882208f2b19b4484f5</sum>
        </package>
        <package name="php-soap" version="8.3.31" release="1.el10_2" epoch="0" arch="x86_64" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-soap-8.3.31-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f761e6c9c6cc0e281801885c4facee43e9478643eaa2a800a71053fdf0f5953f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24338</id>
    <title>Important: bind security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-06-08 08:31:29"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>bind security update</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  

Security Fix(es):  

  * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
  * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24338" id="RHSA-2026:24338" type="rhsa" title="RHSA-2026:24338"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3039" id="CVE-2026-3039" type="cve" title="CVE-2026-3039"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5946" id="CVE-2026-5946" type="cve" title="CVE-2026-5946"/>
      <reference href="https://bugzilla.redhat.com/2479767" id="2479767" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479771" id="2479771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24338.html" id="ALSA-2026:24338" type="self" title="ALSA-2026:24338"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="bind-chroot" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-chroot-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">1d9e83dd40920ab55903cbe1ed4d4521de60cf0917572532eeb9412493a7d18b</sum>
        </package>
        <package name="bind-license" version="9.18.33" release="15.el10_2.2" epoch="32" arch="noarch" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-license-9.18.33-15.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">25696570fcae21d95d2b7b7d02efd735482defa1142c62286c36eabb4f6c2997</sum>
        </package>
        <package name="bind-utils" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-utils-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">350cbb289ef6b1987092c1b7bb149ef237d34eac73bfeb70ad7dbdeac66f6144</sum>
        </package>
        <package name="bind" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">64c163c667c38dbb4861d9fe8e13ab95d5ec27bcb22a42fb5bb22b39c58a67b0</sum>
        </package>
        <package name="bind-dnssec-utils" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">797a7a4f7cb0f63683c6e1f16fb3f3205b39d4c4783830325e33c440931de3dd</sum>
        </package>
        <package name="bind-libs" version="9.18.33" release="15.el10_2.2" epoch="32" arch="x86_64" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-libs-9.18.33-15.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">e9ae8f5ab2911b09066f02bee4c1a1ed3efe41f826e71a9808621c3e23446308</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24470</id>
    <title>Important: podman security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-06-11 08:50:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24470" id="RHSA-2026:24470" type="rhsa" title="RHSA-2026:24470"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24470.html" id="ALSA-2026:24470" type="self" title="ALSA-2026:24470"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="podman-remote" version="5.8.2" release="3.el10_2.alma.1" epoch="7" arch="x86_64" src="podman-5.8.2-3.el10_2.alma.1.src.rpm">
          <filename>podman-remote-5.8.2-3.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">c622af3ce60d56cf1ebff3e4da500e647d58a1a2584842e0efd9c9e67a3b41e0</sum>
        </package>
        <package name="podman" version="5.8.2" release="3.el10_2.alma.1" epoch="7" arch="x86_64" src="podman-5.8.2-3.el10_2.alma.1.src.rpm">
          <filename>podman-5.8.2-3.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">cfd2d33fb540aba5bbfb9cafbcec0cd2811ea009e9f0ee256fb1405e8ee0577d</sum>
        </package>
        <package name="podman-docker" version="5.8.2" release="3.el10_2.alma.1" epoch="7" arch="noarch" src="podman-5.8.2-3.el10_2.alma.1.src.rpm">
          <filename>podman-docker-5.8.2-3.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">e205f2f26c5534f264de80514cb994d72b05f6a8fdd0b52239e7998ed355f6cd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24985</id>
    <title>Important: poppler security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:51:32"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>poppler security update</summary>
    <description>Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.  

Security Fix(es):  

  * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24985" id="RHSA-2026:24985" type="rhsa" title="RHSA-2026:24985"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10118" id="CVE-2026-10118" type="cve" title="CVE-2026-10118"/>
      <reference href="https://bugzilla.redhat.com/2460428" id="2460428" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24985.html" id="ALSA-2026:24985" type="self" title="ALSA-2026:24985"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="poppler" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">15556a51e99e9d6f47c1253f2e6bf706d7a3248cb4c13d01d78dba8290e4c7f2</sum>
        </package>
        <package name="poppler-qt6" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-qt6-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">5a2660a45002ca3193ba8012cec5d650361f2ab15f7a06452dd34dd640857a45</sum>
        </package>
        <package name="poppler-utils" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-utils-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">98c4031be31b07878a8f81db54b9d5635b4764cab16b25ddf7f97b1b0eddad4f</sum>
        </package>
        <package name="poppler-glib" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-glib-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">be822a419c258076ceea80e73996f7b8e3595cddf79c44dfde35a0044fccb3d9</sum>
        </package>
        <package name="poppler-cpp" version="24.02.0" release="7.el10_2.2" epoch="0" arch="x86_64" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-cpp-24.02.0-7.el10_2.2.x86_64.rpm</filename>
          <sum type="sha256">f7193c7670ec36294622d06a6080698812bb7cb8e97e10c0bda360a4f3a71dbc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25111</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:46:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 8.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):  

  * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25111" id="RHSA-2026:25111" type="rhsa" title="RHSA-2026:25111"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591"/>
      <reference href="https://bugzilla.redhat.com/2487164" id="2487164" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487224" id="2487224" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25111.html" id="ALSA-2026:25111" type="self" title="ALSA-2026:25111"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="aspnetcore-runtime-dbg-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4309b02e2f8a785f984ac8b731fb0d6d4eb2ac9f6b34f720bb99d611d2d47d0b</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">77154edce60b582ff7f4d56da3ef7edf93082ac3daa30a61b761a442c8c4b4f8</sum>
        </package>
        <package name="dotnet-runtime-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8d08b82ac109f3b2b7b8bedd3016cbbee32ebb32e4dc0cbc232c4c5fdce209e5</sum>
        </package>
        <package name="dotnet-sdk-8.0" version="8.0.128" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.128-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9c9ef598f5d0bcfcfc706925601efd9d56adbb51c5c2d5f3eb9ce24f9a83c877</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b67650bddd80e04021ada32ca901d6b187980859a9dd6a93bbe9cc79ccaee0d0</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c6745f766e3c0eb04aa351b98974881c9ac09a01fc9a437276035f6dd4e06173</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" version="8.0.128" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.128-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d731c77301c83a16f0560455198b81c59ca33bc9e1b6be7acb122a270e1f4ba6</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e89df542f442277e099710a193c276b99d1e94d9db3826ccc7b6edd60386f2cb</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f621da1d12661b6293d7629f382bbaa309a43094722188add2f45f7f42cd89cf</sum>
        </package>
        <package name="dotnet-templates-8.0" version="8.0.128" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.128-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">faeb5d4f916debee1486f8af9c5a772d8fc6ca7d940d313a16fec6655562ed01</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" version="8.0.28" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.28-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ffa06fadaccc85080f3281d4d3fa16101712586f47515b6260f3893045df763b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25112</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:44:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 9.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):  

  * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25112" id="RHSA-2026:25112" type="rhsa" title="RHSA-2026:25112"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591"/>
      <reference href="https://bugzilla.redhat.com/2487164" id="2487164" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487224" id="2487224" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25112.html" id="ALSA-2026:25112" type="self" title="ALSA-2026:25112"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="aspnetcore-runtime-dbg-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0334c81eb124d0db0eb427ce4873305c4143e94b5fa6f44afd52f054a42e642e</sum>
        </package>
        <package name="dotnet-runtime-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0f2d4b3a55ab1c5cb59aad8321404e599ad43cbb361e92455118d9b3551ffb45</sum>
        </package>
        <package name="dotnet-templates-9.0" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">2a366b30f70cf7d8905f04c0725620f7c51d9ce8612ecd3aa5f2f71d72eebbe0</sum>
        </package>
        <package name="dotnet-sdk-9.0" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">655c5944fd1d067311875edb81a6f9cf5e522b8a5dd37ee9ce0a305b295afe25</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6e2470826e4289930336b63c15d05df3f4a4e2d28793a0c221a5a8118f100c33</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">70eda91274f8f46af5b38ca0b18235d1d1083e24dd0ebd588fd33e41aeb2d94e</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">868c53022bcc8c383ed74b6dfa94b137289a1db5eb567af81e1f7bed9879a1a2</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">995edca15dd800a4e7c876c2597f0cd3fcd33b38723d064d782c9ec1342ffb3e</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a8ed2fa14de30d27b6c584ef1998d839690bf7a7e0d070abdf54c43a261a73ad</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">aa118772e1312c02c6b8fbb50bd997b7845d1472d396969edbe6f677ce30ea1f</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c8c62cc22e7b6af41c0bff5c4579c169d75085ef3693a41d19481f5bf4035e6b</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" version="9.0.118" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.118-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cb315fd4315b62b70903f7ef9d0c8028c8078edc058b836ef08e0cbb42278688</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" version="9.0.17" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.17-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d5fff9e13840caef977f4292062f13fc9f1e4fee921140769554af9ee61f7328</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25115</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:43:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 10.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):  

  * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25115" id="RHSA-2026:25115" type="rhsa" title="RHSA-2026:25115"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591"/>
      <reference href="https://bugzilla.redhat.com/2487164" id="2487164" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487224" id="2487224" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25115.html" id="ALSA-2026:25115" type="self" title="ALSA-2026:25115"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="dotnet-host" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">033de8a7c3c691f1d05a978a806888160790ef6235a2ab087eb14850cf1a3c88</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0e889592948d51882116ecb689d98764a8226b71b35e55f95beaefd68f5f45da</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0eb607077e250fe29d3cf85e6e3d22150182f3d951350910dc231430fe018c3d</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">41f52876b05e07b7970d9d6ab72e2fa4fc00b73a43126d969e8c036f0c454031</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" version="10.0.109" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.109-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4717318670060c2f8131b9500e8345ef3b51b6e85fbdb2784a604d17b8e86a4a</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">47f499d27e81167892427547fb2e31b807eb13b2720287cc3a00e99a1efdd363</sum>
        </package>
        <package name="dotnet-sdk-10.0" version="10.0.109" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.109-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">4a47c6d3d25eb0e1cd63e11aef0eaf53198ff28c78085a26c7fedf095f430363</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">926f0797b57e7b4f88dd7bdd64f5e96990c91e195e01ff33afcd04eb2571f424</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" version="10.0.109" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.109-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">bc6274a8bca16e28bf2e457220a8a61bbb62f51f442951366bb6c6436a24359c</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d7122798a88dd58bc17f7071c97c3685f442834b0ee653d24ab30fee687a7431</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d99617e92030bd40bde22bd7f423366e66b15221d9421f7d024962ef08737b14</sum>
        </package>
        <package name="dotnet-templates-10.0" version="10.0.109" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.109-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f69c5a93dbff29b96b4ee2461352533e681c6d1ed75725c9de108887830d5831</sum>
        </package>
        <package name="dotnet-runtime-10.0" version="10.0.9" release="1.el10_2" epoch="0" arch="x86_64" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.9-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fcc1bed016fbe0568602b7c156085b1d8430c73fb89c0ba64430b460fb7f15c0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25191</id>
    <title>Critical: kernel security update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-06-11 17:37:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
  * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467)
  * kernel: can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CVE-2026-31532)
  * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
  * kernel: ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (CVE-2026-43037)
  * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
  * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25191" id="RHSA-2026:25191" type="rhsa" title="RHSA-2026:25191"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31419" id="CVE-2026-31419" type="cve" title="CVE-2026-31419"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31467" id="CVE-2026-31467" type="cve" title="CVE-2026-31467"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31532" id="CVE-2026-31532" type="cve" title="CVE-2026-31532"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31581" id="CVE-2026-31581" type="cve" title="CVE-2026-31581"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43037" id="CVE-2026-43037" type="cve" title="CVE-2026-43037"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43501" id="CVE-2026-43501" type="cve" title="CVE-2026-43501"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46054" id="CVE-2026-46054" type="cve" title="CVE-2026-46054"/>
      <reference href="https://bugzilla.redhat.com/2457829" id="2457829" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460616" id="2460616" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461107" id="2461107" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461471" id="2461471" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464351" id="2464351" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480457" id="2480457" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482025" id="2482025" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25191.html" id="ALSA-2026:25191" type="self" title="ALSA-2026:25191"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="rv" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.22.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">12e1a0d70146fe2636b1f16c5544d8242965816482f0ccac9113e4dd6fdb5d88</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.22.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">18d6caa56849033bab094f1d8b9f21d654e430dceb145d0e47705bff37b7eea6</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.22.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1b72010cb0720cf99301c5ceba984712ed4ae4d92f7153e496a4eb18504272ec</sum>
        </package>
        <package name="kernel-doc" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.22.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1cb3d93030aca010c6182c61bd262ffa6d526fb1b80f5cac5d3a4e0ddfd0923a</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.22.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3faf2ea5a3f5ebb90ed8fcf157b2885f1c51f23168e986370d8a3885e78badef</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.22.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6604776013d2e83ef4ab10404285c6374974f148f7d7a5225bc0597056bef986</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.22.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">726e8c3d784ab729551f4f2c0d7f85ae5f92cef5183b29a16f3f98a6eeb69123</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.22.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8b0d6987c68dd130302d01003584b4772a680f2d1fd099d608ea5a4cb89cec2f</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.22.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ae97c73684d9f5ea18148c438cbf44c41f5be49f0fbb9dd34891e0ea53654436</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.22.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">c27765ad07f6bd366f0e9c1ce6a7b6bdc4775e7b2ade1dbc1bedf8179b5c0717</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25225</id>
    <title>Important: mod_http2 security update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-06-11 20:30:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>mod_http2 security update</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.  

Security Fix(es):  

  * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25225" id="RHSA-2026:25225" type="rhsa" title="RHSA-2026:25225"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-49975" id="CVE-2026-49975" type="cve" title="CVE-2026-49975"/>
      <reference href="https://bugzilla.redhat.com/2485371" id="2485371" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25225.html" id="ALSA-2026:25225" type="self" title="ALSA-2026:25225"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="mod_http2" version="2.0.29" release="4.el10_2.1" epoch="0" arch="x86_64" src="mod_http2-2.0.29-4.el10_2.1.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">fc323779c4f868a79000bf89f45bd40e8a5cf6b653f11b1bc34eb5efb35fe702</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25237</id>
    <title>Important: openssl security update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-06-11 18:18:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>openssl security update</summary>
    <description>OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  

Security Fix(es):  

  * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)
  * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)
  * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)
  * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)
  * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)
  * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)
  * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)
  * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)
  * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)
  * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)
  * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)
  * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)
  * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)
  * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)
  * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25237" id="RHSA-2026:25237" type="rhsa" title="RHSA-2026:25237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34180" id="CVE-2026-34180" type="cve" title="CVE-2026-34180"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34181" id="CVE-2026-34181" type="cve" title="CVE-2026-34181"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34182" id="CVE-2026-34182" type="cve" title="CVE-2026-34182"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34183" id="CVE-2026-34183" type="cve" title="CVE-2026-34183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42764" id="CVE-2026-42764" type="cve" title="CVE-2026-42764"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42766" id="CVE-2026-42766" type="cve" title="CVE-2026-42766"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42767" id="CVE-2026-42767" type="cve" title="CVE-2026-42767"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42768" id="CVE-2026-42768" type="cve" title="CVE-2026-42768"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42769" id="CVE-2026-42769" type="cve" title="CVE-2026-42769"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42770" id="CVE-2026-42770" type="cve" title="CVE-2026-42770"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45445" id="CVE-2026-45445" type="cve" title="CVE-2026-45445"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45446" id="CVE-2026-45446" type="cve" title="CVE-2026-45446"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45447" id="CVE-2026-45447" type="cve" title="CVE-2026-45447"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-7383" id="CVE-2026-7383" type="cve" title="CVE-2026-7383"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9076" id="CVE-2026-9076" type="cve" title="CVE-2026-9076"/>
      <reference href="https://bugzilla.redhat.com/2481879" id="2481879" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481880" id="2481880" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481881" id="2481881" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481882" id="2481882" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481884" id="2481884" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481885" id="2481885" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481887" id="2481887" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481890" id="2481890" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481891" id="2481891" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481892" id="2481892" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481893" id="2481893" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481894" id="2481894" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481896" id="2481896" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481897" id="2481897" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481898" id="2481898" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25237.html" id="ALSA-2026:25237" type="self" title="ALSA-2026:25237"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="openssl-devel" version="3.5.5" release="4.el10_2.alma.1" epoch="1" arch="x86_64" src="openssl-3.5.5-4.el10_2.alma.1.src.rpm">
          <filename>openssl-devel-3.5.5-4.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">2fb8fb641d39efc22ce2216b79db1cfed658f1ffd8ce9a6cf287b0948b3b627a</sum>
        </package>
        <package name="openssl-perl" version="3.5.5" release="4.el10_2.alma.1" epoch="1" arch="x86_64" src="openssl-3.5.5-4.el10_2.alma.1.src.rpm">
          <filename>openssl-perl-3.5.5-4.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">8c92b3df8b14139ef0165abc4ade9876ba377d5696861efac1cb08f400c9e912</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25930</id>
    <title>Important: postfix security update</title>
    <issued date="2026-06-15 00:00:00"/>
    <updated date="2026-06-15 14:20:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postfix security update</summary>
    <description>The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS.  

Security Fix(es):  

  * postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25930" id="RHSA-2026:25930" type="rhsa" title="RHSA-2026:25930"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43964" id="CVE-2026-43964" type="cve" title="CVE-2026-43964"/>
      <reference href="https://bugzilla.redhat.com/2466488" id="2466488" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25930.html" id="ALSA-2026:25930" type="self" title="ALSA-2026:25930"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="postfix-sqlite" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-sqlite-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">041a20a728beef07639de4268658aab11e7bf85475d31d954f8cd27a8a5fd27d</sum>
        </package>
        <package name="postfix" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0d6f29a2fe9de63054b9e3bf36590b125e269e3968dbbc5c208677ea119eb6fe</sum>
        </package>
        <package name="postfix-ldap" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-ldap-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">3153f41bec2d6e5262f5ed152979e72630b997c0c253f8f64daca882c125f2cc</sum>
        </package>
        <package name="postfix-lmdb" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-lmdb-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">32782f3e5957702c0e2ee79cfaadeca211bc58287673a8784ecf549445a7102b</sum>
        </package>
        <package name="postfix-pgsql" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-pgsql-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">552690a548333972e4f6aafafdec979693edb59bc856e8a40f8a60ea57920465</sum>
        </package>
        <package name="postfix-cdb" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-cdb-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8bd9e9cbe3481c0d4475d1810d4219e968161105fe98b10467e50d6b8a8f32bb</sum>
        </package>
        <package name="postfix-perl-scripts" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-perl-scripts-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">b099d518e10f58f0a885fa239b31ba5089d35a2e0bacf194fbb4740541fd5f6e</sum>
        </package>
        <package name="postfix-pcre" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-pcre-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">ec821850da34f36a0a05ce9db500c82461e73edfaa7d18db2fdd2fe505379ea2</sum>
        </package>
        <package name="postfix-mysql" version="3.8.5" release="10.el10_2" epoch="2" arch="x86_64" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-mysql-3.8.5-10.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fc41c237b75d0c20b46afb59111baa91a766cee620495e213c287546594dcec8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:26332</id>
    <title>Important: rsync security, bug fix, and enhancement update</title>
    <issued date="2026-06-16 00:00:00"/>
    <updated date="2026-06-17 09:40:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>rsync security, bug fix, and enhancement update</summary>
    <description>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  

Security Fix(es):  

  * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)
  * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)


Bug Fix(es) and Enhancement(s):  

  * Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:26332" id="RHSA-2026:26332" type="rhsa" title="RHSA-2026:26332"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-29518" id="CVE-2026-29518" type="cve" title="CVE-2026-29518"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43618" id="CVE-2026-43618" type="cve" title="CVE-2026-43618"/>
      <reference href="https://bugzilla.redhat.com/2469054" id="2469054" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2469055" id="2469055" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-26332.html" id="ALSA-2026:26332" type="self" title="ALSA-2026:26332"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="rsync-rrsync" version="3.4.4" release="1.el10_2" epoch="0" arch="noarch" src="rsync-3.4.4-1.el10_2.src.rpm">
          <filename>rsync-rrsync-3.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">540a428308cad863c69c33ed960b0bc940301aa9b2b59258a14f1fc3273c97b0</sum>
        </package>
        <package name="rsync-daemon" version="3.4.4" release="1.el10_2" epoch="0" arch="noarch" src="rsync-3.4.4-1.el10_2.src.rpm">
          <filename>rsync-daemon-3.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">c41feb2a21f43ce9aa84fc833bcabb0d96f6b707a7ee6ccbb51ade3b02c7e18a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:26532</id>
    <title>Important: dracut security update</title>
    <issued date="2026-06-17 00:00:00"/>
    <updated date="2026-06-17 13:08:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dracut security update</summary>
    <description>The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.  

Security Fix(es):  

  * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:26532" id="RHSA-2026:26532" type="rhsa" title="RHSA-2026:26532"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6893" id="CVE-2026-6893" type="cve" title="CVE-2026-6893"/>
      <reference href="https://bugzilla.redhat.com/2459963" id="2459963" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-26532.html" id="ALSA-2026:26532" type="self" title="ALSA-2026:26532"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="dracut-caps" version="107" release="7.el10_2" epoch="0" arch="x86_64" src="dracut-107-7.el10_2.src.rpm">
          <filename>dracut-caps-107-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1d10b3e51acbf4df47f3d5029cee158a78510b294d4e11af0caa1d94cbad9794</sum>
        </package>
        <package name="dracut-live" version="107" release="7.el10_2" epoch="0" arch="x86_64" src="dracut-107-7.el10_2.src.rpm">
          <filename>dracut-live-107-7.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6559bb246e13e961da190dd236731d72c86b44c8c8f00998eaacab574cfe3760</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27288</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-19 00:00:00"/>
    <updated date="2026-06-26 17:55:55"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
  * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
  * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
  * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
  * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
  * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
  * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
  * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
  * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
  * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
  * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
  * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
  * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
  * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
  * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)


Bug Fix(es) and Enhancement(s):  

  * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047)
  * AlmaLinux9.5 crash due to lpfc NULL ndlp-&gt;vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774)
  * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495)
  * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723)
  * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127)
  * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319)
  * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27288" id="RHSA-2026:27288" type="rhsa" title="RHSA-2026:27288"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31474" id="CVE-2026-31474" type="cve" title="CVE-2026-31474"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31641" id="CVE-2026-31641" type="cve" title="CVE-2026-31641"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31669" id="CVE-2026-31669" type="cve" title="CVE-2026-31669"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31772" id="CVE-2026-31772" type="cve" title="CVE-2026-31772"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31786" id="CVE-2026-31786" type="cve" title="CVE-2026-31786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31787" id="CVE-2026-31787" type="cve" title="CVE-2026-31787"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43056" id="CVE-2026-43056" type="cve" title="CVE-2026-43056"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43260" id="CVE-2026-43260" type="cve" title="CVE-2026-43260"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43330" id="CVE-2026-43330" type="cve" title="CVE-2026-43330"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46056" id="CVE-2026-46056" type="cve" title="CVE-2026-46056"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46125" id="CVE-2026-46125" type="cve" title="CVE-2026-46125"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46152" id="CVE-2026-46152" type="cve" title="CVE-2026-46152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46166" id="CVE-2026-46166" type="cve" title="CVE-2026-46166"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46173" id="CVE-2026-46173" type="cve" title="CVE-2026-46173"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46331" id="CVE-2026-46331" type="cve" title="CVE-2026-46331"/>
      <reference href="https://bugzilla.redhat.com/2460646" id="2460646" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461503" id="2461503" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461548" id="2461548" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464092" id="2464092" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464096" id="2464096" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464449" id="2464449" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464502" id="2464502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467083" id="2467083" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468061" id="2468061" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479492" id="2479492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482181" id="2482181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482563" id="2482563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482608" id="2482608" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482634" id="2482634" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482645" id="2482645" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27288.html" id="ALSA-2026:27288" type="self" title="ALSA-2026:27288"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="kernel-doc" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="noarch" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-doc-6.12.0-211.26.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">11db01dd6e6ddd890f4d22adb09a488c7d4dc0295f2128ecd209e94fadbced54</sum>
        </package>
        <package name="kernel-debug-devel-matched" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-matched-6.12.0-211.26.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">124af44469037e7dac33671b2f87ff2785f2dc1781a7762db21be29919d19595</sum>
        </package>
        <package name="kernel-devel-matched" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-devel-matched-6.12.0-211.26.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">409f3e82ae05498032746f334a4448bcecbaa476867d7acb435f9152236d7a16</sum>
        </package>
        <package name="kernel-headers" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-headers-6.12.0-211.26.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">49d454aa227a8f29b5b0fc8ce1a7f6ecb3ad18d1caa5018ac7871d1744bb1852</sum>
        </package>
        <package name="perf" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>perf-6.12.0-211.26.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5ce086fe5f7ec82548fd106fea22a7cca3fc9d2848cbb58ce2252750f48445f7</sum>
        </package>
        <package name="kernel-devel" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-devel-6.12.0-211.26.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">6d68e8c03fcb8f632883a2ca0414cb769abd6f6808f6552a635e21b90c0a0198</sum>
        </package>
        <package name="rv" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>rv-6.12.0-211.26.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9edc691917b55b3a17a8ccd674278c42696d21b21fdef4bc53cc6affe382d3c6</sum>
        </package>
        <package name="rtla" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>rtla-6.12.0-211.26.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9f01b1cd97641b3b8472a8e96c75a9a91cd941da54aaf35d1daac3fe6647d9d8</sum>
        </package>
        <package name="kernel-debug-devel" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-debug-devel-6.12.0-211.26.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f5cd29a3964b3e3f232613452fd5fde70c41aa820cff71b09ba9fae64c5398fe</sum>
        </package>
        <package name="python3-perf" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="x86_64" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>python3-perf-6.12.0-211.26.1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">fd93769386ef96b6fd70aac0d4100a9e80c424643308ae004291223f95f1eb09</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27733</id>
    <title>Important: firefox security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:17:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>firefox security update</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  

Security Fix(es):  

  * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294)
  * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313)
  * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327)
  * firefox: thunderbird: JIT miscompilation in the DOM: Core &amp; HTML component (CVE-2026-12299)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312)
  * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302)
  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328)
  * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310)
  * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325)
  * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295)
  * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289)
  * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315)
  * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307)
  * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305)
  * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292)
  * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308)
  * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324)
  * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304)
  * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291)
  * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27733" id="RHSA-2026:27733" type="rhsa" title="RHSA-2026:27733"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12289" id="CVE-2026-12289" type="cve" title="CVE-2026-12289"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12290" id="CVE-2026-12290" type="cve" title="CVE-2026-12290"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12291" id="CVE-2026-12291" type="cve" title="CVE-2026-12291"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12292" id="CVE-2026-12292" type="cve" title="CVE-2026-12292"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12294" id="CVE-2026-12294" type="cve" title="CVE-2026-12294"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12295" id="CVE-2026-12295" type="cve" title="CVE-2026-12295"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12296" id="CVE-2026-12296" type="cve" title="CVE-2026-12296"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12297" id="CVE-2026-12297" type="cve" title="CVE-2026-12297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12298" id="CVE-2026-12298" type="cve" title="CVE-2026-12298"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12299" id="CVE-2026-12299" type="cve" title="CVE-2026-12299"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12302" id="CVE-2026-12302" type="cve" title="CVE-2026-12302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12304" id="CVE-2026-12304" type="cve" title="CVE-2026-12304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12305" id="CVE-2026-12305" type="cve" title="CVE-2026-12305"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12306" id="CVE-2026-12306" type="cve" title="CVE-2026-12306"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12307" id="CVE-2026-12307" type="cve" title="CVE-2026-12307"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12308" id="CVE-2026-12308" type="cve" title="CVE-2026-12308"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12309" id="CVE-2026-12309" type="cve" title="CVE-2026-12309"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12310" id="CVE-2026-12310" type="cve" title="CVE-2026-12310"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12311" id="CVE-2026-12311" type="cve" title="CVE-2026-12311"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12312" id="CVE-2026-12312" type="cve" title="CVE-2026-12312"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12313" id="CVE-2026-12313" type="cve" title="CVE-2026-12313"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12314" id="CVE-2026-12314" type="cve" title="CVE-2026-12314"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12315" id="CVE-2026-12315" type="cve" title="CVE-2026-12315"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12324" id="CVE-2026-12324" type="cve" title="CVE-2026-12324"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12325" id="CVE-2026-12325" type="cve" title="CVE-2026-12325"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12327" id="CVE-2026-12327" type="cve" title="CVE-2026-12327"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12328" id="CVE-2026-12328" type="cve" title="CVE-2026-12328"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12329" id="CVE-2026-12329" type="cve" title="CVE-2026-12329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12330" id="CVE-2026-12330" type="cve" title="CVE-2026-12330"/>
      <reference href="https://bugzilla.redhat.com/2489207" id="2489207" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489208" id="2489208" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489209" id="2489209" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489210" id="2489210" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489211" id="2489211" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489212" id="2489212" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489214" id="2489214" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489215" id="2489215" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489217" id="2489217" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489218" id="2489218" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489220" id="2489220" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489221" id="2489221" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489223" id="2489223" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489224" id="2489224" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489225" id="2489225" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489226" id="2489226" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489229" id="2489229" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489231" id="2489231" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489232" id="2489232" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489233" id="2489233" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489234" id="2489234" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489235" id="2489235" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489236" id="2489236" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489237" id="2489237" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489239" id="2489239" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489240" id="2489240" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489243" id="2489243" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489244" id="2489244" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2489248" id="2489248" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27733.html" id="ALSA-2026:27733" type="self" title="ALSA-2026:27733"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="firefox" version="140.12.0" release="1.el10_2" epoch="0" arch="x86_64" src="firefox-140.12.0-1.el10_2.src.rpm">
          <filename>firefox-140.12.0-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">616ea39c644ad66dddfb24ab361620b596eb8897925921fc818a1d7e19169638</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27743</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:14:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql16 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475)
  * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)
  * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)
  * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27743" id="RHSA-2026:27743" type="rhsa" title="RHSA-2026:27743"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6473" id="CVE-2026-6473" type="cve" title="CVE-2026-6473"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6475" id="CVE-2026-6475" type="cve" title="CVE-2026-6475"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6477" id="CVE-2026-6477" type="cve" title="CVE-2026-6477"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6478" id="CVE-2026-6478" type="cve" title="CVE-2026-6478"/>
      <reference href="https://bugzilla.redhat.com/2477439" id="2477439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477442" id="2477442" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477447" id="2477447" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477448" id="2477448" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27743.html" id="ALSA-2026:27743" type="self" title="ALSA-2026:27743"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="postgresql-plpython3" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-plpython3-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0b0ed22e56bb8e6f00d61fa86663e0162e641139562446fd287d7e7ef444ff69</sum>
        </package>
        <package name="postgresql-server" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-server-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1300176981cf384c0c49c781068b2ecd55cff83142f0d4f36e4fe6961866f0c4</sum>
        </package>
        <package name="postgresql-plperl" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-plperl-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">30651d02d128b86d6e760fbb4a49d68c13f5fdba09a1ee10cd01555eab9c97dc</sum>
        </package>
        <package name="postgresql-private-devel" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-private-devel-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">356f5eb813425b8d746d9bc24e2634234054a1490fe1d477f63b29473e1fc84d</sum>
        </package>
        <package name="postgresql-pltcl" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-pltcl-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">460c4ccaa320071a71594e5b70d864b166bda85c7c90b94bba5e19980a169b0d</sum>
        </package>
        <package name="postgresql-server-devel" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-server-devel-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">573d8c0d3dbd329756a62e138992286b4dfdf605f237826d1d3867ccf0fd6f98</sum>
        </package>
        <package name="postgresql-docs" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-docs-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">7b13ada87af15ff7e736cbc229665fa6a7e6edaa7e0d92321ef5e19a8054b18b</sum>
        </package>
        <package name="postgresql-static" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-static-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">843d7c52a751580507d0fbd4a236de0260e39d17662612c0dd2b6a71e21c96d7</sum>
        </package>
        <package name="postgresql-contrib" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-contrib-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">a79136a40d8981618aa1305c49b6290fa2bd31d5c7088a8395afea81ee806c49</sum>
        </package>
        <package name="postgresql-upgrade" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d004827ff0deeb7d73bc0919c782769e19b7750a74e4174cceeea80e3f335eaf</sum>
        </package>
        <package name="postgresql-test" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-test-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">d95802ede05a0bd8d4ed3224c0be98950ce635c47bb7dd627e9df5b1748b22ca</sum>
        </package>
        <package name="postgresql-private-libs" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-private-libs-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e290601310c0eaa1a63727ed5964a9239f3bc68aaf26d915c401a963efd6922a</sum>
        </package>
        <package name="postgresql-upgrade-devel" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-devel-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e74894c768ec55fe9740a35ab41f524a59603f38f3aa9ec49c5b703766d7f3bc</sum>
        </package>
        <package name="postgresql" version="16.14" release="1.el10_2" epoch="0" arch="x86_64" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-16.14-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">f5abd9bdefe4f522252e833c87bd4ad1fbee838ae2f49137abec2e127b407d89</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27842</id>
    <title>Important: memcached security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:11:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>memcached security update</summary>
    <description>memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.   

Security Fix(es):  

  * memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27842" id="RHSA-2026:27842" type="rhsa" title="RHSA-2026:27842"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47783" id="CVE-2026-47783" type="cve" title="CVE-2026-47783"/>
      <reference href="https://bugzilla.redhat.com/2480089" id="2480089" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27842.html" id="ALSA-2026:27842" type="self" title="ALSA-2026:27842"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="memcached-selinux" version="1.6.23" release="7.el10_2.1" epoch="0" arch="x86_64" src="memcached-1.6.23-7.el10_2.1.src.rpm">
          <filename>memcached-selinux-1.6.23-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">befa2e7bd552bd1824e4901a48f62800f2deecc18d5317289fabfe565c2b5524</sum>
        </package>
        <package name="memcached" version="1.6.23" release="7.el10_2.1" epoch="0" arch="x86_64" src="memcached-1.6.23-7.el10_2.1.src.rpm">
          <filename>memcached-1.6.23-7.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">cecad5d087e653862c61d67b423179d0bdf90eea283ac8f9d18f3411aa0a8ed6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27929</id>
    <title>Important: python3.14-urllib3 security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:10:05"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14-urllib3 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)
  * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27929" id="RHSA-2026:27929" type="rhsa" title="RHSA-2026:27929"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44431" id="CVE-2026-44431" type="cve" title="CVE-2026-44431"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44432" id="CVE-2026-44432" type="cve" title="CVE-2026-44432"/>
      <reference href="https://bugzilla.redhat.com/2477154" id="2477154" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477167" id="2477167" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27929.html" id="ALSA-2026:27929" type="self" title="ALSA-2026:27929"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="python3.14-urllib3" version="2.6.3" release="2.el10_2" epoch="0" arch="noarch" src="python3.14-urllib3-2.6.3-2.el10_2.src.rpm">
          <filename>python3.14-urllib3-2.6.3-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">57130c6cb8bb3cf561d8de37fc42674c447fb5b7868aa36aa521c9f85eb9cdd9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28233</id>
    <title>Moderate: libpng security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:25:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libpng security update</summary>
    <description>The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.  

Security Fix(es):  

  * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
  * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28233" id="RHSA-2026:28233" type="rhsa" title="RHSA-2026:28233"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636"/>
      <reference href="https://bugzilla.redhat.com/2451805" id="2451805" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451819" id="2451819" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28233.html" id="ALSA-2026:28233" type="self" title="ALSA-2026:28233"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libpng-devel" version="1.6.40" release="11.el10_2.1" epoch="2" arch="x86_64" src="libpng-1.6.40-11.el10_2.1.src.rpm">
          <filename>libpng-devel-1.6.40-11.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">434294213ecf205e76349ce6242489a7ec3d386d0fcdf51640d8406f528b800c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28234</id>
    <title>Low: libxml2 security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:26:48"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>libxml2 security update</summary>
    <description>The libxml2 library is a development toolbox providing the implementation of various XML standards.  

Security Fix(es):  

  * libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c (CVE-2024-34459)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28234" id="RHSA-2026:28234" type="rhsa" title="RHSA-2026:28234"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-34459" id="CVE-2024-34459" type="cve" title="CVE-2024-34459"/>
      <reference href="https://bugzilla.redhat.com/2280532" id="2280532" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28234.html" id="ALSA-2026:28234" type="self" title="ALSA-2026:28234"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libxml2-devel" version="2.12.5" release="10.el10_2.1" epoch="0" arch="x86_64" src="libxml2-2.12.5-10.el10_2.1.src.rpm">
          <filename>libxml2-devel-2.12.5-10.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">8c2607c317c7c1783937af65de815b7f8c7cf847dbad0047871acef173116f24</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28235</id>
    <title>Low: libtasn1 security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:25:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>libtasn1 security update</summary>
    <description>A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions.  

Security Fix(es):  

  * libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string (CVE-2025-13151)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28235" id="RHSA-2026:28235" type="rhsa" title="RHSA-2026:28235"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13151" id="CVE-2025-13151" type="cve" title="CVE-2025-13151"/>
      <reference href="https://bugzilla.redhat.com/2427698" id="2427698" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28235.html" id="ALSA-2026:28235" type="self" title="ALSA-2026:28235"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libtasn1-tools" version="4.20.0" release="5.el10_2" epoch="0" arch="x86_64" src="libtasn1-4.20.0-5.el10_2.src.rpm">
          <filename>libtasn1-tools-4.20.0-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">8353172c5e93971d349e9aa382de5755651b599ef6aa025b93ac687affc85902</sum>
        </package>
        <package name="libtasn1-devel" version="4.20.0" release="5.el10_2" epoch="0" arch="x86_64" src="libtasn1-4.20.0-5.el10_2.src.rpm">
          <filename>libtasn1-devel-4.20.0-5.el10_2.x86_64.rpm</filename>
          <sum type="sha256">9d1b14d1f4d7b7029fca0e8b6905e613a284a7454d308e6375528269e5c77a1f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28236</id>
    <title>Moderate: libsolv security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:24:32"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libsolv security update</summary>
    <description>The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm.  

Security Fix(es):  

  * libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150)
  * libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (CVE-2026-9149)
  * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28236" id="RHSA-2026:28236" type="rhsa" title="RHSA-2026:28236"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48864" id="CVE-2026-48864" type="cve" title="CVE-2026-48864"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9149" id="CVE-2026-9149" type="cve" title="CVE-2026-9149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9150" id="CVE-2026-9150" type="cve" title="CVE-2026-9150"/>
      <reference href="https://bugzilla.redhat.com/2460379" id="2460379" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460380" id="2460380" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460425" id="2460425" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28236.html" id="ALSA-2026:28236" type="self" title="ALSA-2026:28236"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="python3-solv" version="0.7.33" release="5.el10_2.alma.1" epoch="0" arch="x86_64" src="libsolv-0.7.33-5.el10_2.alma.1.src.rpm">
          <filename>python3-solv-0.7.33-5.el10_2.alma.1.x86_64.rpm</filename>
          <sum type="sha256">77d0fd1dcd059b3d655a2e8d67e38819f45992dface9fb4fcc7ed388e8937945</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28581</id>
    <title>Important: python3.14 security, bug fix, and enhancement update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:23:57"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security, bug fix, and enhancement update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
  * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)


Bug Fix(es) and Enhancement(s):  

  * [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28581" id="RHSA-2026:28581" type="rhsa" title="RHSA-2026:28581"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6019" id="CVE-2026-6019" type="cve" title="CVE-2026-6019"/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460869" id="2460869" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28581.html" id="ALSA-2026:28581" type="self" title="ALSA-2026:28581"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="python3.14-libs" version="3.14.5" release="1.el10_2" epoch="0" arch="x86_64" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.5-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">0f7b85c19ad697dd35868beb3da1ee70c64f91f911437b462e802709007bf1e2</sum>
        </package>
        <package name="python3.14-devel" version="3.14.5" release="1.el10_2" epoch="0" arch="x86_64" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.5-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">31703f83cfb0a3777b8da3dcd99b130045f9f3d8cfcdae64ec7bc06f82821daf</sum>
        </package>
        <package name="python3.14" version="3.14.5" release="1.el10_2" epoch="0" arch="x86_64" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-3.14.5-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">da4074617554c220f9f9e0fb6bab3eb7503ad64c7cb375d9f1c4413bc1cf4e29</sum>
        </package>
        <package name="python3.14-tkinter" version="3.14.5" release="1.el10_2" epoch="0" arch="x86_64" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.5-1.el10_2.x86_64.rpm</filename>
          <sum type="sha256">e7d8c7b79d43d79ba9d89c3abdcb4173235ea534d0804a8761a890f526c2717a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28584</id>
    <title>Moderate: libxslt security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:22:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libxslt security update</summary>
    <description>libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism.   

Security Fix(es):  

  * libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28584" id="RHSA-2026:28584" type="rhsa" title="RHSA-2026:28584"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-10911" id="CVE-2025-10911" type="cve" title="CVE-2025-10911"/>
      <reference href="https://bugzilla.redhat.com/2397838" id="2397838" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28584.html" id="ALSA-2026:28584" type="self" title="ALSA-2026:28584"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="libxslt" version="1.1.39" release="8.el10_2.1" epoch="0" arch="x86_64" src="libxslt-1.1.39-8.el10_2.1.src.rpm">
          <filename>libxslt-1.1.39-8.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">36d25afc6cd084437df16e1a0835c1fa8dfc52408b01cd02a9065cfba4d91d23</sum>
        </package>
        <package name="libxslt-devel" version="1.1.39" release="8.el10_2.1" epoch="0" arch="x86_64" src="libxslt-1.1.39-8.el10_2.1.src.rpm">
          <filename>libxslt-devel-1.1.39-8.el10_2.1.x86_64.rpm</filename>
          <sum type="sha256">91a0371e044a70c3f68840461001cd7d426b3f4b0e49716c1759067b5b97a7e9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29035</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-06-24 00:00:00"/>
    <updated date="2026-06-25 10:06:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>skopeo security update</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.   

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29035" id="RHSA-2026:29035" type="rhsa" title="RHSA-2026:29035"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29035.html" id="ALSA-2026:29035" type="self" title="ALSA-2026:29035"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="skopeo-tests" version="1.22.2" release="2.el10_2" epoch="2" arch="x86_64" src="skopeo-1.22.2-2.el10_2.src.rpm">
          <filename>skopeo-tests-1.22.2-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">1a6166875dcd9bb43ba8f3547f8920196945381b40a33a42531e9049939cb7a8</sum>
        </package>
        <package name="skopeo" version="1.22.2" release="2.el10_2" epoch="2" arch="x86_64" src="skopeo-1.22.2-2.el10_2.src.rpm">
          <filename>skopeo-1.22.2-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">cae483741e677ab81c3554f77098fa59f9020c081fc114298cda1eae3fdc6a6f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29195</id>
    <title>Important: buildah security update</title>
    <issued date="2026-06-24 00:00:00"/>
    <updated date="2026-06-25 10:06:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>buildah security update</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29195" id="RHSA-2026:29195" type="rhsa" title="RHSA-2026:29195"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29195.html" id="ALSA-2026:29195" type="self" title="ALSA-2026:29195"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="buildah" version="1.43.1" release="2.el10_2" epoch="2" arch="x86_64" src="buildah-1.43.1-2.el10_2.src.rpm">
          <filename>buildah-1.43.1-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">5fceeaf34895f5e6984a214afa0645cb9a2ebfc6b1a642be093d14f4a9d2c010</sum>
        </package>
        <package name="buildah-tests" version="1.43.1" release="2.el10_2" epoch="2" arch="x86_64" src="buildah-1.43.1-2.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-2.el10_2.x86_64.rpm</filename>
          <sum type="sha256">dfae76f30e4646809565f49b4dcbedf6d616c7f584284202fcb7b6c5561ff8fa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29874</id>
    <title>Important: nginx security update</title>
    <issued date="2026-06-25 00:00:00"/>
    <updated date="2026-06-26 12:49:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29874" id="RHSA-2026:29874" type="rhsa" title="RHSA-2026:29874"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9256" id="CVE-2026-9256" type="cve" title="CVE-2026-9256"/>
      <reference href="https://bugzilla.redhat.com/2480746" id="2480746" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29874.html" id="ALSA-2026:29874" type="self" title="ALSA-2026:29874"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64-appstream-rpms__10_0_default">
        <name>almalinux-10-for-x86_64-appstream-rpms__10_0_default</name>
        <package name="nginx-mod-http-xslt-filter" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">03c0c2f844aebebf81f771559b845523b839693b8fda7974737511a0818c4225</sum>
        </package>
        <package name="nginx-mod-http-image-filter" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">0e8bb4a102b45c8b4f75062b96dda0b269880d8e484961b84fdcd335c524fb60</sum>
        </package>
        <package name="nginx" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">2f1bb134b553a2438429d4c07bdb2ebc65b29e78b2fe4241f01e5c3407c59968</sum>
        </package>
        <package name="nginx-mod-stream" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">391e8f81b8392cd45bca0c13c13ba177daa9fc85e2e227d283c1ba66d56a7862</sum>
        </package>
        <package name="nginx-core" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">409b08a5a51355524568adaf67e5fbe556b5405dbf6ad4b5d7765218d2cdba4c</sum>
        </package>
        <package name="nginx-mod-http-perl" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">4b06251af35b4d1fa328ad6b8f8d433c9e516b0e35bd47c67c9b5bdb98a26055</sum>
        </package>
        <package name="nginx-all-modules" version="1.26.3" release="6.el10_2.4" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">562b83c5c4657fa12e3561c30f43284f0fbc49e4d410c9f9b7f57f8dffef487c</sum>
        </package>
        <package name="nginx-mod-mail" version="1.26.3" release="6.el10_2.4" epoch="2" arch="x86_64" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.4.x86_64.rpm</filename>
          <sum type="sha256">7525fc21cc4cd321c353253a07de34f8daf90b46ee21c7f0306246efcd92f545</sum>
        </package>
        <package name="nginx-filesystem" version="1.26.3" release="6.el10_2.4" epoch="2" arch="noarch" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">9f23da9e2b3a022ca250a77c0fe4ad02e555ea9d6fc291bd81545b117d01a511</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>