<updates>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:17429</id>
    <title>Important: open-vm-tools security update</title>
    <issued date="2025-10-08 17:10:30" />
    <updated date="2025-10-22 08:11:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for open-vm-tools.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

* open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-41244" id="CVE-2025-41244" type="cve" title="CVE-2025-41244" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2397752" id="2397752" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:17429" id="RLSA-2025:17429" type="self" title="RLSA-2025:17429" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="open-vm-tools" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">5c5f72135c11113cab83ea67a2a34907abcdd69041994109446c400edc5554a7</sum>
        </package>
        <package name="open-vm-tools-desktop" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-desktop-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">f01f15633d0f3ddfa95e93d0354ddfecb81e1e774713a5071216789efbcb5b5d</sum>
        </package>
        <package name="open-vm-tools-salt-minion" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-salt-minion-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">016f1e9c9fc7f13accb0d34050e2c5334c4cea61a5ba70390ccfd161857671cf</sum>
        </package>
        <package name="open-vm-tools-sdmp" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-sdmp-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">2dcf190bf62602af9115e7416e6e53e9504cb5552b77df79a910026f9f219735</sum>
        </package>
        <package name="open-vm-tools-test" arch="x86_64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-test-12.5.0-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">3323ea1e381ad7d2fdf9bf9465a15a956275ecb68be155700757e230d816f403</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:17085</id>
    <title>Important: ipa security update</title>
    <issued date="2025-10-07 17:25:42" />
    <updated date="2025-10-21 08:10:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ipa.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7493" id="CVE-2025-7493" type="cve" title="CVE-2025-7493" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389448" id="2389448" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:17085" id="RLSA-2025:17085" type="self" title="RLSA-2025:17085" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipa-client" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">49ee0017fcf48ad4b4b979bd88dc102ff50abaa85745cdbb5b8e5f2a37314337</sum>
        </package>
        <package name="ipa-client-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-common-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">bf2ffd4b0910fc72cae5d3600870555b49c6996b5ffe3867900c2b05488185ab</sum>
        </package>
        <package name="ipa-client-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-encrypted-dns-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">7a882a3de30a47d94647cae3da069d3374604f3420605b5635042416997d791b</sum>
        </package>
        <package name="ipa-client-epn" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-epn-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">b159c4d993240f45185788c72de0db8e9f191e0d14574c0f16cc475fef1afd53</sum>
        </package>
        <package name="ipa-client-samba" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-samba-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">e3422ada3e8c03c971a39a068d691789067e37937753e9472a519661bbeac610</sum>
        </package>
        <package name="ipa-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-common-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">b669a87218c94c65720ded545b0be47d09d53823ffde3e44b2c800a7e960c40f</sum>
        </package>
        <package name="ipa-selinux" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-selinux-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">9fcc498fdbeb59c1f3666a1fb65744fd3309ea356e2daa95b5f488134c90fc85</sum>
        </package>
        <package name="ipa-selinux-luna" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-selinux-luna-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">027300560ce6195962457cfbd64af0060014a378f1c90bcfe1dac67ec716839e</sum>
        </package>
        <package name="ipa-selinux-nfast" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-selinux-nfast-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">b0ce410d8e96f7ac938714aedf2a6088ffc94cb80fd7d3f6e5dc92863e80eaa1</sum>
        </package>
        <package name="ipa-server" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">f358a5398743c5d1bfe17b88689ec50d9520654a9b2bf15de7b9b566334ee712</sum>
        </package>
        <package name="ipa-server-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-common-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">2d4629a5a13c49f35fa9ca50e3257dfec870ea8d687bf18bd9f9ec7b53fcf2d5</sum>
        </package>
        <package name="ipa-server-dns" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-dns-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">13cb1b4a2b64c0636a2902942e932bba7691219c1c0b1b6105ad6d4db00c6ba5</sum>
        </package>
        <package name="ipa-server-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-encrypted-dns-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">b1cf56d62f6c06b79c0ce5acf5ef946621280ca685b1dc2ff913ffb25e644e17</sum>
        </package>
        <package name="ipa-server-trust-ad" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-trust-ad-4.12.2-15.el10_0.4.x86_64.rpm</filename>
          <sum type="sha256">27fe5c87266f967780897c6b89d5589694297e266f97434ed25fcefcf572a23b</sum>
        </package>
        <package name="python3-ipaclient" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>python3-ipaclient-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">71d58a186df583d49049166b6469053fdca1b8f222122ce67b52f7da9a81e0ab</sum>
        </package>
        <package name="python3-ipalib" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>python3-ipalib-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">ed44dd38a1d5d1918c30602fbb7e80d254231254f0d053b82b347d34c0246e98</sum>
        </package>
        <package name="python3-ipaserver" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>python3-ipaserver-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">24f51609ea8226d2f14c8873ec839e2e8bcaa6c00297792a1f09bc4e1d53b650</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21485</id>
    <title>Moderate: java-25-openjdk security update</title>
    <issued date="2025-11-25 09:18:33" />
    <updated date="2025-12-09 09:07:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for java-25-openjdk.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

* JDK: Enhance Path Factories (CVE-2025-53066)

* JDK: Enhance Certificate Handling (CVE-2025-53057)

* JDK: Enhance String Handling (CVE-2025-61748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that the OpenJDK 25 package does not yet include FIPS support. This is expected to be reinstated in a future update.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53057" id="CVE-2025-53057" type="cve" title="CVE-2025-53057" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53066" id="CVE-2025-53066" type="cve" title="CVE-2025-53066" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61748" id="CVE-2025-61748" type="cve" title="CVE-2025-61748" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403063" id="2403063" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403064" id="2403064" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403082" id="2403082" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21485" id="RLSA-2025:21485" type="self" title="RLSA-2025:21485" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="java-25-openjdk" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">fef7787b64d8a6ba1e4c1350ae3b3dc8696d98643973c21a9eac3f3bbbfcebd1</sum>
        </package>
        <package name="java-25-openjdk-demo" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-demo-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">271726b9605410756a9d1ae00e239e242c3d26750e753c3484498795ee96aadc</sum>
        </package>
        <package name="java-25-openjdk-devel" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-devel-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">01399503bb50925104ca69a35f8c6f29ea51a77c8b26f29433a6edb7671012d5</sum>
        </package>
        <package name="java-25-openjdk-headless" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-headless-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">f60d95ada35c8a61460ded1e6d518f3218642d210b91641c45e08b46fa671503</sum>
        </package>
        <package name="java-25-openjdk-javadoc" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-javadoc-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">702419de9f24f2f3dc47a52b5e09b787d6d5643740a88828ce930f49c12aebf4</sum>
        </package>
        <package name="java-25-openjdk-javadoc-zip" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-javadoc-zip-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">c3bf0890884961f24c78bae0b96bcca7513cf227f04709ca65db4340dac0cca4</sum>
        </package>
        <package name="java-25-openjdk-jmods" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-jmods-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">aad3009b25a93ee555c5406a4da1c1c6e9eeb9c4a4346b7bcedbdd889c4e4f1f</sum>
        </package>
        <package name="java-25-openjdk-src" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-src-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">95193e537e949096651efdc5961e5af769d280e54aebc56fcb337a7e4da12fa3</sum>
        </package>
        <package name="java-25-openjdk-static-libs" arch="x86_64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-static-libs-25.0.1.0.8-2.el10.x86_64.rpm</filename>
          <sum type="sha256">0039eba06a5877218fd6de3509d1ea7d86b82181bf79be5898f7857dd713b782</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21691</id>
    <title>Important: haproxy security update</title>
    <issued date="2025-11-25 09:18:33" />
    <updated date="2025-12-09 09:07:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for haproxy.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11230" id="CVE-2025-11230" type="cve" title="CVE-2025-11230" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2413003" id="2413003" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21691" id="RLSA-2025:21691" type="self" title="RLSA-2025:21691" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="haproxy" arch="x86_64" epoch="0" version="3.0.5" release="4.el10_1.1" src="haproxy-3.0.5-4.el10_1.1.src.rpm">
          <filename>haproxy-3.0.5-4.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">e77f47567771730ba24a53c27de871b50c4b423cf63af96275f7f75db2431d84</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18320</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-26 08:08:08" />
    <updated date="2025-11-07 09:09:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: firefox: Memory safety bugs (CVE-2025-11714)

* thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709)

* thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710)

* thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708)

* thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715)

* thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11708" id="CVE-2025-11708" type="cve" title="CVE-2025-11708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11709" id="CVE-2025-11709" type="cve" title="CVE-2025-11709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11710" id="CVE-2025-11710" type="cve" title="CVE-2025-11710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11711" id="CVE-2025-11711" type="cve" title="CVE-2025-11711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11712" id="CVE-2025-11712" type="cve" title="CVE-2025-11712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11714" id="CVE-2025-11714" type="cve" title="CVE-2025-11714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11715" id="CVE-2025-11715" type="cve" title="CVE-2025-11715" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403763" id="2403763" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403765" id="2403765" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403768" id="2403768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403769" id="2403769" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403770" id="2403770" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403774" id="2403774" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403776" id="2403776" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18320" id="RLSA-2025:18320" type="self" title="RLSA-2025:18320" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.4.0" release="2.el10_0" src="thunderbird-140.4.0-2.el10_0.src.rpm">
          <filename>thunderbird-140.4.0-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7dfc5a0028b725d666103bdb33e5a5f6fcb3d26b07f1fc0c3ed8fa9662659ee1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21936</id>
    <title>Important: valkey security update</title>
    <issued date="2025-11-25 09:18:33" />
    <updated date="2025-12-09 09:07:19" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

* Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

* Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

* Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46817" id="CVE-2025-46817" type="cve" title="CVE-2025-46817" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46818" id="CVE-2025-46818" type="cve" title="CVE-2025-46818" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46819" id="CVE-2025-46819" type="cve" title="CVE-2025-46819" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49844" id="CVE-2025-49844" type="cve" title="CVE-2025-49844" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401258" id="2401258" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401292" id="2401292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401322" id="2401322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401324" id="2401324" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21936" id="RLSA-2025:21936" type="self" title="RLSA-2025:21936" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.6" release="2.el10_1" src="valkey-8.0.6-2.el10_1.src.rpm">
          <filename>valkey-8.0.6-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0b4c2ee2c4a3996c703dee42eea75839b25f0954978dc50361b55790abd4b44f</sum>
        </package>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.6" release="2.el10_1" src="valkey-8.0.6-2.el10_1.src.rpm">
          <filename>valkey-devel-8.0.6-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b996ef8149abb585a9fbe571ffeb839d2ba578484fc1dd1d330ad4ae8ccb133f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21816</id>
    <title>Moderate: delve and golang security update</title>
    <issued date="2025-11-27 09:11:22" />
    <updated date="2025-12-11 09:10:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang, delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Go Programming Language.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21816" id="RLSA-2025:21816" type="self" title="RLSA-2025:21816" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.25.2" release="1.el10_1" src="delve-1.25.2-1.el10_1.src.rpm">
          <filename>delve-1.25.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">28162c2aa0f6da1137aafe28c551256f6753577d5e0ba1fceb3f4661b1a76ac4</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-1.25.3-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2f3f7cdbc35a6b0bb8c5074813284459bb7021f2d25780c0ba020494d2bf9e08</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.3-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a779a6f243a8ce0e072e0212ae2dd7d85782e4d84136556eb203b80636dd3d68</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">9e7dbd3039937982d0083ea4030a03960311db7aeb1ae99d25a440a2991a2fa8</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e6fb8d50f403ed9b6bc1c92db1313138fe48b005ee3b4e36a7572176e99ced2a</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-race-1.25.3-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ac0aa2ca77237424a1c2832ce6891b0d440c4a7e4ec0006c77fe9e4569ffa7c4</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-src-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">fcab9736bf045d0b8c60b64b37f6a5b541dc262e34b835d0d69e0d519e1c7f3f</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">ba530d6269e26f0abab9df12cb744896239302378e95e398f111e917ace9c370</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.3-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b1a4d56304d8fb4a138ebbdcd64dcdf974d460ad9473b43a273888b35d13bcf8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18154</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* thunderbird: firefox: Memory safety bugs (CVE-2025-11714)

* thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709)

* thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710)

* thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708)

* thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715)

* thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11708" id="CVE-2025-11708" type="cve" title="CVE-2025-11708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11709" id="CVE-2025-11709" type="cve" title="CVE-2025-11709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11710" id="CVE-2025-11710" type="cve" title="CVE-2025-11710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11711" id="CVE-2025-11711" type="cve" title="CVE-2025-11711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11712" id="CVE-2025-11712" type="cve" title="CVE-2025-11712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11714" id="CVE-2025-11714" type="cve" title="CVE-2025-11714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11715" id="CVE-2025-11715" type="cve" title="CVE-2025-11715" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403763" id="2403763" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403765" id="2403765" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403768" id="2403768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403769" id="2403769" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403770" id="2403770" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403774" id="2403774" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403776" id="2403776" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18154" id="RLSA-2025:18154" type="self" title="RLSA-2025:18154" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.4.0" release="3.el10_0" src="firefox-140.4.0-3.el10_0.src.rpm">
          <filename>firefox-140.4.0-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d7f67161e82d8e9edc4bab53ba002435e4465cb2a7d65f9548e1efe6486a61c3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18152</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

* dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

* dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55247" id="CVE-2025-55247" type="cve" title="CVE-2025-55247" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55248" id="CVE-2025-55248" type="cve" title="CVE-2025-55248" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55315" id="CVE-2025-55315" type="cve" title="CVE-2025-55315" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403083" id="2403083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403085" id="2403085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403086" id="2403086" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18152" id="RLSA-2025:18152" type="self" title="RLSA-2025:18152" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2e82f54bfbdd0e374ca39625d9f0387ed3dd3f09a441918ffb05ae675e18cadc</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">69adaa9b4624ac5fa8bb9693b5321dceb8ad75048f207e05fe108443e0bbf07c</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">69c74d48b2183beddf9c9878e607f2b225237a0ac59467cde5d24fea2de000e2</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9f695335927966b53f765b11f613a0e938fc7533188793ce43a07f6fab9bf464</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">be3916302893eefe3721106b25b04e964bb984d7608d5385debba5231b55ff90</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5746efb1491a159a41fd8d17c1aacf06cf0440be1b10c5e0cea95f2f1fcc2543</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a3ac2b62b598c37c5a1f51fbd49b260dffad2b66389e03f8c81606fc29013810</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.121" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.121-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">72788d59dfac373b17648f9109934bea2ff1aee7cb7fd505eb32dd36d23ac88a</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.121" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.121-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f5be18d47c1c632079cc4de99d2823d47f0407cd95824e169747106fbf015884</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.21-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bd993cf686e92507546afa07fd10357dc86ba3ce62750926c867c3528346fdf1</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.121" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-templates-8.0-8.0.121-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">18024c7dd162f8b0dfff7bc8d2cedcba7472a290d93b2ea04cc2b977df3a7eb6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18153</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

* dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

* dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55247" id="CVE-2025-55247" type="cve" title="CVE-2025-55247" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55248" id="CVE-2025-55248" type="cve" title="CVE-2025-55248" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55315" id="CVE-2025-55315" type="cve" title="CVE-2025-55315" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403083" id="2403083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403085" id="2403085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403086" id="2403086" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18153" id="RLSA-2025:18153" type="self" title="RLSA-2025:18153" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ab807b363b42205f8c51a088b89e8f74b994c2bdc4aa4aec946fca95467c0e0c</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9493bfd217e561475b9811f6534f0cfb71f3a25039f9d3f98036b9af8715a666</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">eaeac8371d79bc8882c9e8fc4aa1eca32eb6a18cd015e626b1a34372d3b56534</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9560a19b5883491926bd48f082ad520357c14079e057bfafbcf49a92488c9054</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-host-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4bb72308bf7619934a1e1ea66edb7470b5c7f5843c0f2c35b1d9d4acc509f514</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">64cb647c7dbf5893cba5a963e8e2d9e666a8359a268a51d4bbcfa6e275d76712</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a20cad53d859ec9cda4208b8ad633dd0e9045652eb0c0bb577b2c08406652573</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f2ea5b6f8e54bde3d3c2bf77618d16677b12e1cd566f2f4c652997d03a5899ec</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a79b1e6681a45ad76310c2f96b73567bb81db035ef757ee44f873f93993822c6</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ce21cd3310ba29b77adafe6abd963e2ca961f6c157ab3b613d93914187f02145</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">10ca1eadcc761b9ad0b3c1a98e9b9f3d1a0046caa304c1b4e2960ecee6535dfe</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0132d02382947e042057929af2a4382f7fcf3d96b87ff49021143a978a079dc3</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-templates-9.0-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6b61d05e63dd665c7fc60b4f210f9ffdee5f48a5cf9c515929bbb2eb50955825</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.111-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">297b0880fd2dc98f17e49b4c76ac77571209b1b1615733dd58855dbb8da5c12f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18183</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11021" id="CVE-2025-11021" type="cve" title="CVE-2025-11021" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2399627" id="2399627" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18183" id="RLSA-2025:18183" type="self" title="RLSA-2025:18183" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.7" src="libsoup3-3.6.5-3.el10_0.7.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_0.7.x86_64.rpm</filename>
          <sum type="sha256">29426c9c87ea4e2708c33516a4c288239185bae22b2876c971a2a7bfac46e281</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.7" src="libsoup3-3.6.5-3.el10_0.7.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_0.7.x86_64.rpm</filename>
          <sum type="sha256">c2597dea8846c2114b810f78565fad3b4692262fc79788f7b8cfa998f9dcd787</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19156</id>
    <title>Important: libtiff security update</title>
    <issued date="2025-11-02 09:08:07" />
    <updated date="2025-11-16 09:10:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: Libtiff Write-What-Where (CVE-2025-9900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9900" id="CVE-2025-9900" type="cve" title="CVE-2025-9900" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2392784" id="2392784" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19156" id="RLSA-2025:19156" type="self" title="RLSA-2025:19156" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libtiff" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_0.1" src="libtiff-4.6.0-6.el10_0.1.src.rpm">
          <filename>libtiff-4.6.0-6.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">b6502126ea37fbfdcd217370b2138adc1904d30961844e7d2420883a94cf52f1</sum>
        </package>
        <package name="libtiff-devel" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_0.1" src="libtiff-4.6.0-6.el10_0.1.src.rpm">
          <filename>libtiff-devel-4.6.0-6.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">defd29f8fb6923c842a94c9792338b4e1b7b6ec2e9807c5123f659eeeed69a73</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19435</id>
    <title>Moderate: xorg-x11-server-Xwayland security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

* xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

* xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62229" id="CVE-2025-62229" type="cve" title="CVE-2025-62229" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62230" id="CVE-2025-62230" type="cve" title="CVE-2025-62230" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62231" id="CVE-2025-62231" type="cve" title="CVE-2025-62231" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2402649" id="2402649" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2402653" id="2402653" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2402660" id="2402660" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19435" id="RLSA-2025:19435" type="self" title="RLSA-2025:19435" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="x86_64" epoch="0" version="24.1.5" release="5.el10_0" src="xorg-x11-server-Xwayland-24.1.5-5.el10_0.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-5.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f3d857dd337c37bb26ebe4de4632cd7cae2f4a22717d1237c684dadda1c64305</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19675</id>
    <title>Important: valkey security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

* Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

* Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

* Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46817" id="CVE-2025-46817" type="cve" title="CVE-2025-46817" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46818" id="CVE-2025-46818" type="cve" title="CVE-2025-46818" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46819" id="CVE-2025-46819" type="cve" title="CVE-2025-46819" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49844" id="CVE-2025-49844" type="cve" title="CVE-2025-49844" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401258" id="2401258" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401292" id="2401292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401322" id="2401322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401324" id="2401324" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19675" id="RLSA-2025:19675" type="self" title="RLSA-2025:19675" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.6" release="1.el10_0" src="valkey-8.0.6-1.el10_0.src.rpm">
          <filename>valkey-8.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">87317dbdd09dc9157f670ad5d99301daf796deecb4246d13c4b83b1781b78a0d</sum>
        </package>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.6" release="1.el10_0" src="valkey-8.0.6-1.el10_0.src.rpm">
          <filename>valkey-devel-8.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6757d283ae173a1293bfc7bc95cb5054c5cba4c975b7e1f1b0e77bc63e969e5e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19720</id>
    <title>Low: libsoup3 security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4945" id="CVE-2025-4945" type="cve" title="CVE-2025-4945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367175" id="2367175" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19720" id="RLSA-2025:19720" type="self" title="RLSA-2025:19720" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.9" src="libsoup3-3.6.5-3.el10_0.9.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_0.9.x86_64.rpm</filename>
          <sum type="sha256">0b48c29e6396e5c1920d4e760c541258ea0fd75bdb751a0afa2cdc49e2081258</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.9" src="libsoup3-3.6.5-3.el10_0.9.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_0.9.x86_64.rpm</filename>
          <sum type="sha256">ed1539e481b13dea848976c73fc22774eb43c40c493c2131414bae2e0987e7ef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19772</id>
    <title>Important: qt6-qtsvg security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for qt6-qtsvg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

Security Fix(es):

* qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10729" id="CVE-2025-10729" type="cve" title="CVE-2025-10729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401241" id="2401241" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19772" id="RLSA-2025:19772" type="self" title="RLSA-2025:19772" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtsvg" arch="x86_64" epoch="0" version="6.8.1" release="1.el10_0.1" src="qt6-qtsvg-6.8.1-1.el10_0.1.src.rpm">
          <filename>qt6-qtsvg-6.8.1-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">8d3d25ffd7e7d0f318ba0a15a2308185ff33e0c1ee997214474f9d7a9e0c921f</sum>
        </package>
        <package name="qt6-qtsvg-devel" arch="x86_64" epoch="0" version="6.8.1" release="1.el10_0.1" src="qt6-qtsvg-6.8.1-1.el10_0.1.src.rpm">
          <filename>qt6-qtsvg-devel-6.8.1-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">9f824c3fd4a44263d403ebbaf6a0b8e0088dd89259d1912950c5df0090482ecf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:22012</id>
    <title>Important: buildah security update</title>
    <issued date="2025-11-28 09:17:04" />
    <updated date="2025-12-12 09:09:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881" id="CVE-2025-52881" type="cve" title="CVE-2025-52881" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404715" id="2404715" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:22012" id="RLSA-2025:22012" type="self" title="RLSA-2025:22012" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah" arch="x86_64" epoch="2" version="1.41.6" release="1.el10_1" src="buildah-1.41.6-1.el10_1.src.rpm">
          <filename>buildah-1.41.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cd22c546fd03c6654f10a42e1da58c66f0c620f31617877994b07cad9f74721a</sum>
        </package>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.41.6" release="1.el10_1" src="buildah-1.41.6-1.el10_1.src.rpm">
          <filename>buildah-tests-1.41.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3f4093fb7fb252c85bad980a316851934215f267cb07ff592de5ce12c44c6a29</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:22361</id>
    <title>Moderate: qt6-qtquick3d security update</title>
    <issued date="2025-12-02 09:07:01" />
    <updated date="2025-12-15 09:09:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qt6-qtquick3d.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Qt 6 Quick3D library.

Security Fix(es):

* assimp: Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow (CVE-2025-11277)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11277" id="CVE-2025-11277" type="cve" title="CVE-2025-11277" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401622" id="2401622" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:22361" id="RLSA-2025:22361" type="self" title="RLSA-2025:22361" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtquick3d" arch="x86_64" epoch="0" version="6.9.1" release="1.el10_1.1" src="qt6-qtquick3d-6.9.1-1.el10_1.1.src.rpm">
          <filename>qt6-qtquick3d-6.9.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">12810e225837e2d0addc77e67ca8af12ef3b250a1e7396267e0283a01442a54f</sum>
        </package>
        <package name="qt6-qtquick3d-devel" arch="x86_64" epoch="0" version="6.9.1" release="1.el10_1.1" src="qt6-qtquick3d-6.9.1-1.el10_1.1.src.rpm">
          <filename>qt6-qtquick3d-devel-6.9.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">8ecffe46def4f410d905ae8f67e3df64539391bfcf265ac0ecfed896cc10c822</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:22394</id>
    <title>Moderate: qt6-qtsvg security update</title>
    <issued date="2025-12-02 09:07:01" />
    <updated date="2025-12-15 09:09:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qt6-qtsvg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

Security Fix(es):

* qtsvg: Uncontrolled recursion in Qt SVG module (CVE-2025-10728)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10728" id="CVE-2025-10728" type="cve" title="CVE-2025-10728" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401244" id="2401244" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:22394" id="RLSA-2025:22394" type="self" title="RLSA-2025:22394" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtsvg" arch="x86_64" epoch="0" version="6.9.1" release="2.el10_1.2" src="qt6-qtsvg-6.9.1-2.el10_1.2.src.rpm">
          <filename>qt6-qtsvg-6.9.1-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">0b200eee637e182761b11b2bb426bc572ed83f4a46b74636dfe6542c94129aca</sum>
        </package>
        <package name="qt6-qtsvg-devel" arch="x86_64" epoch="0" version="6.9.1" release="2.el10_1.2" src="qt6-qtsvg-6.9.1-2.el10_1.2.src.rpm">
          <filename>qt6-qtsvg-devel-6.9.1-2.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">fd21ffd63b1a6183397a2a5f9af7da63b91a48704104256a8884e2fd9c37a876</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23035</id>
    <title>Important: firefox security update</title>
    <issued date="2025-12-11 09:09:11" />
    <updated date="2025-12-25 09:09:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333)

* firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

* firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

* firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14321" id="CVE-2025-14321" type="cve" title="CVE-2025-14321" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14322" id="CVE-2025-14322" type="cve" title="CVE-2025-14322" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14323" id="CVE-2025-14323" type="cve" title="CVE-2025-14323" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14324" id="CVE-2025-14324" type="cve" title="CVE-2025-14324" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14325" id="CVE-2025-14325" type="cve" title="CVE-2025-14325" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14328" id="CVE-2025-14328" type="cve" title="CVE-2025-14328" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14329" id="CVE-2025-14329" type="cve" title="CVE-2025-14329" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14330" id="CVE-2025-14330" type="cve" title="CVE-2025-14330" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14331" id="CVE-2025-14331" type="cve" title="CVE-2025-14331" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14333" id="CVE-2025-14333" type="cve" title="CVE-2025-14333" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420502" id="2420502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420503" id="2420503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420504" id="2420504" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420506" id="2420506" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420508" id="2420508" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420509" id="2420509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420512" id="2420512" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420513" id="2420513" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420516" id="2420516" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420517" id="2420517" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23035" id="RLSA-2025:23035" type="self" title="RLSA-2025:23035" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.6.0" release="1.el10_1" src="firefox-140.6.0-1.el10_1.src.rpm">
          <filename>firefox-140.6.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5b2a51725f98ba4bdd4dff03091e78ac648cba13f69442e0d23b63a9f9ea5ea0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23008</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045)

* mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040)

* mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069)

* mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53040" id="CVE-2025-53040" type="cve" title="CVE-2025-53040" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53042" id="CVE-2025-53042" type="cve" title="CVE-2025-53042" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53044" id="CVE-2025-53044" type="cve" title="CVE-2025-53044" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53045" id="CVE-2025-53045" type="cve" title="CVE-2025-53045" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53053" id="CVE-2025-53053" type="cve" title="CVE-2025-53053" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53054" id="CVE-2025-53054" type="cve" title="CVE-2025-53054" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53062" id="CVE-2025-53062" type="cve" title="CVE-2025-53062" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53069" id="CVE-2025-53069" type="cve" title="CVE-2025-53069" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405486" id="2405486" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405491" id="2405491" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405511" id="2405511" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405514" id="2405514" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405523" id="2405523" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405534" id="2405534" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405541" id="2405541" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405544" id="2405544" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23008" id="RLSA-2025:23008" type="self" title="RLSA-2025:23008" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mysql8.4" arch="x86_64" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-8.4.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">fd3f8f0c8050d0408416d2b14abfe20163e9d399e6db7426c88d73138e956504</sum>
        </package>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-common-8.4.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e8ec68c244bd06db9f32dc93d71f733d7643bcdba0969553fd2968abcde61056</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">c956ef5c3dc121f79a41086b473d6c274856a3d4b5532134099b9fd082f6997b</sum>
        </package>
        <package name="mysql8.4-libs" arch="x86_64" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-libs-8.4.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b66af012b341f91dd02db0d0cd91ad63b20cbf91442b754b4338a480a42b2665</sum>
        </package>
        <package name="mysql8.4-server" arch="x86_64" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-server-8.4.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e18eb3608ff374bb7cd1a2f284cb83577ec5b0ba6c0f372d2194224883c28600</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23052</id>
    <title>Important: tomcat9 security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651" id="CVE-2025-31651" type="cve" title="CVE-2025-31651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752" id="CVE-2025-55752" type="cve" title="CVE-2025-55752" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362782" id="2362782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406591" id="2406591" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23052" id="RLSA-2025:23052" type="self" title="RLSA-2025:23052" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">7cb5590482ebdaddcbbcc94193841985acbc24a97dd733ad433d4aae10f049e3</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">8f02b67c2c971db9acd8c1abcf7755fbcc5d5bbfe13a3c751ac4cca4f1fb8749</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">1450c24d9c1bbc753470d72e048496c4a53440d72dfeb83263d072167543b2d3</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">aeb97317e8764d3e5a34e98b3497e42423342cdd3528389f6d16d3d2882ffce2</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">fb073920aa88369e9357f674e08aad249f602afd88abf632b4e247288b7f3b17</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-lib-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">36627b3f5df782484dd4f166526c3a53f9bc85759b4c47e5fa65ec326dc097eb</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">f69f116d2eb2b097c73b3a29fa5ab70b64be7918b5c595083f4fe1a6bcd6baef</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-webapps-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">e69a9ba31bebb341d955e267012dce698882592c2bf0ea0e8b1681bc64e1e3ea</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23050</id>
    <title>Important: tomcat security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service (CVE-2025-61795)

* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651" id="CVE-2025-31651" type="cve" title="CVE-2025-31651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752" id="CVE-2025-55752" type="cve" title="CVE-2025-55752" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61795" id="CVE-2025-61795" type="cve" title="CVE-2025-61795" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362782" id="2362782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406588" id="2406588" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406591" id="2406591" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23050" id="RLSA-2025:23050" type="self" title="RLSA-2025:23050" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">f9de65559b1d36fada76879998ed02b85338697dc97a36ee317fc5aaef8c0493</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">ba2127f13424b7ef9c46ee3c1932be1eadc142a4e9f5df6bb0161659490f84e6</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">90e83c4283a81b358bb0d7f9c4330bc05d54607bfe5a892233eb3ce26ed60437</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">8bd07c2f0f6d3cae1d10aa2209a16e867c26eb73aa2c824dad456eb18b164478</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">778970678c930f76cb71d2673800d653f77eeec1c7bcede1d5b6cf20d8e1266e</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-lib-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">adb09daaaca930ba42e0d3bfef2ca2b98550a98cf188b51abd82c8cea6446fee</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">e5a3d01edd1133ac65bd6a72d417223e420eb0139cb886e74336827bb2b2e38b</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-webapps-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">91eec5407c25a1837a75508aee6b24c3ed68bc49ed361e4b4d093dcf20104e8f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23083</id>
    <title>Important: wireshark security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Access of Uninitialized Pointer in Wireshark (CVE-2025-13499)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13499" id="CVE-2025-13499" type="cve" title="CVE-2025-13499" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2416293" id="2416293" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23083" id="RLSA-2025:23083" type="self" title="RLSA-2025:23083" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="wireshark" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.1" src="wireshark-4.4.2-4.el10_1.1.src.rpm">
          <filename>wireshark-4.4.2-4.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">52bb7f180be77b78bf1f21b9b2257b3cfb29ed2e9b464d4efc9460a6464c6bba</sum>
        </package>
        <package name="wireshark-cli" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.1" src="wireshark-4.4.2-4.el10_1.1.src.rpm">
          <filename>wireshark-cli-4.4.2-4.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">dfac4cd05aef44787b4cc616a96e106367fe5576949ec4386b052590e0a370a1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23088</id>
    <title>Moderate: grafana security update</title>
    <issued date="2025-12-13 09:11:15" />
    <updated date="2025-12-27 09:10:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23088" id="RLSA-2025:23088" type="self" title="RLSA-2025:23088" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="21.el10_1" src="grafana-10.2.6-21.el10_1.src.rpm">
          <filename>grafana-10.2.6-21.el10_1.x86_64.rpm</filename>
          <sum type="sha256">675f4370bebd8fc46f9cb968f319f0f1192b70f89981e7e43f858e578c5b0dd8</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="21.el10_1" src="grafana-10.2.6-21.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-21.el10_1.x86_64.rpm</filename>
          <sum type="sha256">24c9e904c7840a737b5083024c2f6655ac2898fdd371770f2d16f3b130758386</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23139</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2025-12-13 09:11:15" />
    <updated date="2025-12-27 09:10:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Heap Use-After-Free in libsoup message queue handling during HTTP/2 read completion (CVE-2025-12105)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12105" id="CVE-2025-12105" type="cve" title="CVE-2025-12105" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405992" id="2405992" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23139" id="RLSA-2025:23139" type="self" title="RLSA-2025:23139" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.7" src="libsoup3-3.6.5-3.el10_1.7.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.7.x86_64.rpm</filename>
          <sum type="sha256">54e8c5789def874a750db4ed66408c80686950f83fb27ff701f50488e602f1b6</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.7" src="libsoup3-3.6.5-3.el10_1.7.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.7.x86_64.rpm</filename>
          <sum type="sha256">f2fcd058af40123c8908e5eeffc8292ef376f2c3f7b453dbf416c1bb57acd47a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23201</id>
    <title>Important: keylime security update</title>
    <issued date="2025-12-18 09:09:42" />
    <updated date="2026-01-01 09:09:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for keylime.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

* keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13609" id="CVE-2025-13609" type="cve" title="CVE-2025-13609" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2416761" id="2416761" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23201" id="RLSA-2025:23201" type="self" title="RLSA-2025:23201" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="keylime-tools" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-tools-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">6e11be837d9191ddc42538510419f5595e0fc99a45b99db2d02a14884d24c03e</sum>
        </package>
        <package name="keylime-verifier" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-verifier-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">d964296d42c80966a0e0f559d6025eaca23f8b3384fce128087ad4126f6bdb7d</sum>
        </package>
        <package name="python3-keylime" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>python3-keylime-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">b6501f588ccf5f97808aa144743e097af55963fb7bc08bf1c2953b7954baf7db</sum>
        </package>
        <package name="keylime" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">87f7cc1f45bf3e8903fb8c185935a84393f621b0fe133fa66f4c26518d6a1fd8</sum>
        </package>
        <package name="keylime-base" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-base-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">3e5aa077f4a06bf38a2a392931d3e9a8bd2d0b6907e82a5f3407c595e453ff05</sum>
        </package>
        <package name="keylime-registrar" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-registrar-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">033ecaa9912e3e28f94d9a9ecead8fafa63b1c6e5c4acf3285774f6597126eb2</sum>
        </package>
        <package name="keylime-selinux" arch="noarch" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-selinux-7.12.1-11.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">b47e065a613fca8753074843dc80b00630a87bea49c40544a70f1d245bf2d914</sum>
        </package>
        <package name="keylime-tenant" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-tenant-7.12.1-11.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">169fe9d87d9510bbc01633eb94b481b263b7a94d8a3421a9db9d43306f9ee164</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:20478</id>
    <title>Moderate: zziplib security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for zziplib.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The zziplib is a lightweight library to easily extract data from zip files.

Security Fix(es):

* zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17828" id="CVE-2018-17828" type="cve" title="CVE-2018-17828" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1635888" id="1635888" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:20478" id="RLSA-2025:20478" type="self" title="RLSA-2025:20478" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="zziplib" arch="x86_64" epoch="0" version="0.13.78" release="2.el10" src="zziplib-0.13.78-2.el10.src.rpm">
          <filename>zziplib-0.13.78-2.el10.x86_64.rpm</filename>
          <sum type="sha256">79fa105b4ddcd385d8ce3af8fd2a762ec250e580b618783bb50e562dd5dc22a1</sum>
        </package>
        <package name="zziplib-utils" arch="x86_64" epoch="0" version="0.13.78" release="2.el10" src="zziplib-0.13.78-2.el10.src.rpm">
          <filename>zziplib-utils-0.13.78-2.el10.x86_64.rpm</filename>
          <sum type="sha256">e328dfc41afc9624191cf1b8c97535face15fd83ea8b9e191bb07fe9a0a85c29</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21002</id>
    <title>Important: squid security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for squid.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

* squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling (CVE-2025-62168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62168" id="CVE-2025-62168" type="cve" title="CVE-2025-62168" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404736" id="2404736" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21002" id="RLSA-2025:21002" type="self" title="RLSA-2025:21002" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="squid" arch="x86_64" epoch="7" version="6.10" release="6.el10_1.1" src="squid-6.10-6.el10_1.1.src.rpm">
          <filename>squid-6.10-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">5d58fde7365c0f27102c2da8951388dfad404bbe57565937b463354005d79ad3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:20994</id>
    <title>Important: ipa security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ipa.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7493" id="CVE-2025-7493" type="cve" title="CVE-2025-7493" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389448" id="2389448" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:20994" id="RLSA-2025:20994" type="self" title="RLSA-2025:20994" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipa-client" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">4df4c9d900d84bc20229cdeb7e6cacbda2bc48501f5aaaffbb9c2841a69feb63</sum>
        </package>
        <package name="ipa-client-common" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-common-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">1ed48f9ea27e3d51c6938f8e04aa918e384c4163a7cfb53d1b4afa22cf261bd1</sum>
        </package>
        <package name="ipa-client-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-encrypted-dns-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">b63a3e8fc7adaa5c5ccad6fb972bb1d4d7c980ad202c736dd5c56b2252c3442c</sum>
        </package>
        <package name="ipa-client-epn" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-epn-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">50922b9b91c3609452a312144f5c26e0f55d6ba2967b8a90b75d55cbe363fe4f</sum>
        </package>
        <package name="ipa-client-samba" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-samba-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">8923d269f8998e1503d4ac3a9982c3941c8d5a6477bf82fe218d2d08e7ee759e</sum>
        </package>
        <package name="ipa-common" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-common-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">c1b9d1f2220bf3eb358abd8e95f7790745255ec3f3b399abaf7aad2953c0e5eb</sum>
        </package>
        <package name="ipa-selinux" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-selinux-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">75744bb5b01ef62b6915e55785bd42a945b325ddb7f123f0a11777702a42f904</sum>
        </package>
        <package name="ipa-selinux-luna" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-selinux-luna-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">5093abf0e161cee519dc8d2a71d8ede28a212cab1c0cba7f4681439fe58bbc1a</sum>
        </package>
        <package name="ipa-selinux-nfast" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-selinux-nfast-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">47ba228ca00a37cc15ccf6a9c4652a6fca96634201e65eb95a4cb354e38eb33c</sum>
        </package>
        <package name="ipa-server" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">884ee33548a6a4f2b4782897be7e94d299efcc945b4bfa4e9dfa20eda3e2d59d</sum>
        </package>
        <package name="ipa-server-common" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-common-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">d51abb9a704469c8fcfc1b2a1b4ddb7c26c16a2435b35a61d62cefb5aeebd594</sum>
        </package>
        <package name="ipa-server-dns" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-dns-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">1c1d5b78f31b2f73883906d472f58a8ea5e8a54a3a1bbc3cfc84b44f3f514b8c</sum>
        </package>
        <package name="ipa-server-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-encrypted-dns-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">ab5b7a3fe55136d99f377f672c90cbcf867043e80546a0dd207550bf11383843</sum>
        </package>
        <package name="ipa-server-trust-ad" arch="x86_64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-trust-ad-4.12.2-24.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">2f3eb3f475d63c146f00fcfb685c3683bfb44d7a89882512cf92cef09c432214</sum>
        </package>
        <package name="python3-ipaclient" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>python3-ipaclient-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">fb3029b088891bad80443ccc23f16928d47e9ed109d7081e2bcb4ef7f6bee08d</sum>
        </package>
        <package name="python3-ipalib" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>python3-ipalib-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">d0443950c78b0bd4142c09462e1f2bcacabd02835e3afb176e71bd02b62ad86b</sum>
        </package>
        <package name="python3-ipaserver" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>python3-ipaserver-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">0bd398d681243e4de7c442df874a15304a0cf695e5736b5040399a851b644bf4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21032</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)

* libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11021" id="CVE-2025-11021" type="cve" title="CVE-2025-11021" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4945" id="CVE-2025-4945" type="cve" title="CVE-2025-4945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367175" id="2367175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2399627" id="2399627" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21032" id="RLSA-2025:21032" type="self" title="RLSA-2025:21032" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.6" src="libsoup3-3.6.5-3.el10_1.6.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">9c45387d49258f8098c567ac2587405764f8246fd3ffbb382c9b67d722965795</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.6" src="libsoup3-3.6.5-3.el10_1.6.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">8eee3b5a4e945cef76f63de2cd7f41eebe8e16216b492e0a616abf7bf332a8f3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21037</id>
    <title>Important: qt6-qtsvg security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for qt6-qtsvg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

Security Fix(es):

* qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10729" id="CVE-2025-10729" type="cve" title="CVE-2025-10729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401241" id="2401241" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21037" id="RLSA-2025:21037" type="self" title="RLSA-2025:21037" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtsvg" arch="x86_64" epoch="0" version="6.9.1" release="2.el10_1.1" src="qt6-qtsvg-6.9.1-2.el10_1.1.src.rpm">
          <filename>qt6-qtsvg-6.9.1-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">e10889240f77e91991a6eaba599dacb050ccd9a3de4f0cb2215baeaf8d344a00</sum>
        </package>
        <package name="qt6-qtsvg-devel" arch="x86_64" epoch="0" version="6.9.1" release="2.el10_1.1" src="qt6-qtsvg-6.9.1-2.el10_1.1.src.rpm">
          <filename>qt6-qtsvg-devel-6.9.1-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">08645db2f57ba12b2cdeff0780db0fb6946cf6078246357366fa29760f883bfb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21034</id>
    <title>Important: bind security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for bind.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778)

* bind: Cache poisoning due to weak PRNG (CVE-2025-40780)

* bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40778" id="CVE-2025-40778" type="cve" title="CVE-2025-40778" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40780" id="CVE-2025-40780" type="cve" title="CVE-2025-40780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8677" id="CVE-2025-8677" type="cve" title="CVE-2025-8677" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405827" id="2405827" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405829" id="2405829" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405830" id="2405830" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21034" id="RLSA-2025:21034" type="self" title="RLSA-2025:21034" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="bind" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">80cd62e71c915db9f358a0a0a1738dba34f502e66cf5dc4e751c32d25d02f383</sum>
        </package>
        <package name="bind-chroot" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-chroot-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">e45d5e7c370405a143aaf6b527247132eec86501976603327a52cfbabce0277c</sum>
        </package>
        <package name="bind-dnssec-utils" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">b204e08f20804c5db18e13e2847575ea171eaaa3e4377a42c611108a8edb3149</sum>
        </package>
        <package name="bind-libs" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-libs-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">05907e050ac0fb48a01b75ad8245f185cdf339de1385e1178efbfac4719327e3</sum>
        </package>
        <package name="bind-license" arch="noarch" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-license-9.18.33-10.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">2c9c63219d146ae32dc4bc03c04bf15a22ceef7fa40fdd33bd8865eac1c33a16</sum>
        </package>
        <package name="bind-utils" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-utils-9.18.33-10.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">08234432b4469be6a4144afff4fdeae136bb9cf7cb15fdc1e42a0eab54283926</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21142</id>
    <title>Important: python-kdcproxy security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-kdcproxy.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

* python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59088" id="CVE-2025-59088" type="cve" title="CVE-2025-59088" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59089" id="CVE-2025-59089" type="cve" title="CVE-2025-59089" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393955" id="2393955" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393958" id="2393958" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21142" id="RLSA-2025:21142" type="self" title="RLSA-2025:21142" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-kdcproxy" arch="noarch" epoch="0" version="1.0.0" release="19.el10_1" src="python-kdcproxy-1.0.0-19.el10_1.src.rpm">
          <filename>python3-kdcproxy-1.0.0-19.el10_1.noarch.rpm</filename>
          <sum type="sha256">92ae0a11b605fc8a2757c1ea35a49218ca517b019c9804e8a23375aa7aec3b5f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21220</id>
    <title>Important: podman security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881" id="CVE-2025-52881" type="cve" title="CVE-2025-52881" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404715" id="2404715" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21220" id="RLSA-2025:21220" type="self" title="RLSA-2025:21220" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="7" version="5.6.0" release="6.el10_1" src="podman-5.6.0-6.el10_1.src.rpm">
          <filename>podman-5.6.0-6.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d8c7e66b25c9dd4b11a21c53de29b67528ce39d489e1cd97d146d6aafd49c15c</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="6.el10_1" src="podman-5.6.0-6.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-6.el10_1.noarch.rpm</filename>
          <sum type="sha256">6db94e38c5be0caccf548d216622fd7c72e5d8298bdcadd0ce06fcb54934dcdf</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.6.0" release="6.el10_1" src="podman-5.6.0-6.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-6.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ab4b7b0766040b375bea3cbd63c5f3e204d0aefe1a9f8ec330837769d8beff83</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21281</id>
    <title>Important: firefox security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

* firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

* firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

* firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

* firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

* firefox: Race condition in the Graphics component (CVE-2025-13012)

* firefox: Spoofing issue in Firefox (CVE-2025-13015)

* firefox: Mitigation bypass in the DOM: Core &amp; HTML component (CVE-2025-13013)

* firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13012" id="CVE-2025-13012" type="cve" title="CVE-2025-13012" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13013" id="CVE-2025-13013" type="cve" title="CVE-2025-13013" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13014" id="CVE-2025-13014" type="cve" title="CVE-2025-13014" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13015" id="CVE-2025-13015" type="cve" title="CVE-2025-13015" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13016" id="CVE-2025-13016" type="cve" title="CVE-2025-13016" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13017" id="CVE-2025-13017" type="cve" title="CVE-2025-13017" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13018" id="CVE-2025-13018" type="cve" title="CVE-2025-13018" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13019" id="CVE-2025-13019" type="cve" title="CVE-2025-13019" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13020" id="CVE-2025-13020" type="cve" title="CVE-2025-13020" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414079" id="2414079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414080" id="2414080" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414083" id="2414083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414084" id="2414084" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414085" id="2414085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414086" id="2414086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414090" id="2414090" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414091" id="2414091" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414092" id="2414092" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21281" id="RLSA-2025:21281" type="self" title="RLSA-2025:21281" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.5.0" release="2.el10_1" src="firefox-140.5.0-2.el10_1.src.rpm">
          <filename>firefox-140.5.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">dc7f29a72c34b77600be5be5ec8e6c7a5c2a920e4b31f31bcc4f4786da98b92d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21843</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

* firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

* firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

* firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

* firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

* firefox: Race condition in the Graphics component (CVE-2025-13012)

* firefox: Spoofing issue in Firefox (CVE-2025-13015)

* firefox: Mitigation bypass in the DOM: Core &amp; HTML component (CVE-2025-13013)

* firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13012" id="CVE-2025-13012" type="cve" title="CVE-2025-13012" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13013" id="CVE-2025-13013" type="cve" title="CVE-2025-13013" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13014" id="CVE-2025-13014" type="cve" title="CVE-2025-13014" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13015" id="CVE-2025-13015" type="cve" title="CVE-2025-13015" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13016" id="CVE-2025-13016" type="cve" title="CVE-2025-13016" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13017" id="CVE-2025-13017" type="cve" title="CVE-2025-13017" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13018" id="CVE-2025-13018" type="cve" title="CVE-2025-13018" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13019" id="CVE-2025-13019" type="cve" title="CVE-2025-13019" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13020" id="CVE-2025-13020" type="cve" title="CVE-2025-13020" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414079" id="2414079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414080" id="2414080" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414083" id="2414083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414084" id="2414084" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414085" id="2414085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414086" id="2414086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414090" id="2414090" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414091" id="2414091" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414092" id="2414092" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21843" id="RLSA-2025:21843" type="self" title="RLSA-2025:21843" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.5.0" release="2.el10_1" src="thunderbird-140.5.0-2.el10_1.src.rpm">
          <filename>thunderbird-140.5.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5f19ee39d0ed99c592928848823868d617a10a4de259a495033a51df65290ca1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23294</id>
    <title>Moderate: skopeo security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23294" id="RLSA-2025:23294" type="self" title="RLSA-2025:23294" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.20.0" release="2.el10_1" src="skopeo-1.20.0-2.el10_1.src.rpm">
          <filename>skopeo-1.20.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f2c7fe4db461452c90384d8794db82cdc0230a1f7a73d3fe40c355e51cbcfa61</sum>
        </package>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.20.0" release="2.el10_1" src="skopeo-1.20.0-2.el10_1.src.rpm">
          <filename>skopeo-tests-1.20.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">93964e6994c42aaa5c25fe20a324a8fcdbd50f6f23e5368b5056391ce2feb9b1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23295</id>
    <title>Moderate: podman security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23295" id="RLSA-2025:23295" type="self" title="RLSA-2025:23295" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="7" version="5.6.0" release="8.el10_1" src="podman-5.6.0-8.el10_1.src.rpm">
          <filename>podman-5.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d523f657419a73bc85927e8761dc6794572fb2254b400135c98f42020a5770bd</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="8.el10_1" src="podman-5.6.0-8.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-8.el10_1.noarch.rpm</filename>
          <sum type="sha256">b8dfeb260bbe9bea9e3be8bc0e4fc7c6f61cd18d5ce124845e41bedfb126c84f</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.6.0" release="8.el10_1" src="podman-5.6.0-8.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">408020efe23c4816f0fa9b7ce0e02129a18482784e4f2c892052ef0394ea7098</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23664</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation (CVE-2025-68156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68156" id="CVE-2025-68156" type="cve" title="CVE-2025-68156" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2422891" id="2422891" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23664" id="RLSA-2025:23664" type="self" title="RLSA-2025:23664" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.135.0" release="2.el10_1" src="opentelemetry-collector-0.135.0-2.el10_1.src.rpm">
          <filename>opentelemetry-collector-0.135.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4b5d1711a801f404be054bc49e06b2040e2406ac78b299688ad72ea8913caf6a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23667</id>
    <title>Important: git-lfs security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26625" id="CVE-2025-26625" type="cve" title="CVE-2025-26625" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404720" id="2404720" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23667" id="RLSA-2025:23667" type="self" title="RLSA-2025:23667" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git-lfs" arch="x86_64" epoch="0" version="3.6.1" release="4.el10_1" src="git-lfs-3.6.1-4.el10_1.src.rpm">
          <filename>git-lfs-3.6.1-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b66ecde9da47fa2b74247da32b535cc95989592acfb0d8c0594a84ca40e991ac</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23738</id>
    <title>Important: mod_md security update</title>
    <issued date="2025-12-24 09:09:08" />
    <updated date="2026-01-07 09:06:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mod_md.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning.  Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.

Security Fix(es):

* mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55753" id="CVE-2025-55753" type="cve" title="CVE-2025-55753" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419140" id="2419140" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23738" id="RLSA-2025:23738" type="self" title="RLSA-2025:23738" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_md" arch="x86_64" epoch="1" version="2.4.26" release="4.el10_1" src="mod_md-2.4.26-4.el10_1.src.rpm">
          <filename>mod_md-2.4.26-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">954de3100ce89386f8888cd26ec19b1573b814548ac4dbc754b1cea8408d60b2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23932</id>
    <title>Important: httpd security update</title>
    <issued date="2025-12-24 09:09:08" />
    <updated date="2026-01-07 09:06:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)

* httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)

* httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58098" id="CVE-2025-58098" type="cve" title="CVE-2025-58098" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65082" id="CVE-2025-65082" type="cve" title="CVE-2025-65082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66200" id="CVE-2025-66200" type="cve" title="CVE-2025-66200" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419139" id="2419139" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419262" id="2419262" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419365" id="2419365" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23932" id="RLSA-2025:23932" type="self" title="RLSA-2025:23932" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="httpd" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">f9341130578019b08f0ec727eadae219f624456b1f06416fe87f17bbea041bbe</sum>
        </package>
        <package name="httpd-core" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-core-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">33ba09317272e35e194103012e797a0cbd15df9917c9ededff447af101816327</sum>
        </package>
        <package name="httpd-devel" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-devel-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">9de053d76295d7247f2bcfd1335ee0b2f7ee2ed16d2b52841ef4fea44dff415a</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-filesystem-2.4.63-4.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">ecf3854d6a4894a4600c34687ac57b55daae3e1a185750514a825ac7b1500d75</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-manual-2.4.63-4.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">6949a406e6a3155db79dc44fc713116f5b40b1d345b6749ab09b2d783faa80af</sum>
        </package>
        <package name="httpd-tools" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-tools-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">afd659378cb08cf351f1a02a61262a1525b7b5b46ed0e39cbd3e3387dcc3a525</sum>
        </package>
        <package name="mod_ldap" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_ldap-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">beb786f382d2e6d67d31babbc2e9dee615a993567f4eb84f1cc3536d999ecc8f</sum>
        </package>
        <package name="mod_lua" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_lua-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">30625b48faad114c3bb8452ffc653dc9cbbb6e071297473b3c19a7ba16aed3f8</sum>
        </package>
        <package name="mod_proxy_html" arch="x86_64" epoch="1" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_proxy_html-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">3ade30491c179285667f82c8f1c169d5bfd52e7ad8e27791a1aac70efa0c9177</sum>
        </package>
        <package name="mod_session" arch="x86_64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_session-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">39cfa97fd481230c5b068982cbc6bb0bab6d7af8bd02dff9c9bdd160777389f7</sum>
        </package>
        <package name="mod_ssl" arch="x86_64" epoch="1" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_ssl-2.4.63-4.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">227671bde2d670506a86b5924f9370c7461e208c7c979f507a3b028bbc6bf144</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23141</id>
    <title>Moderate: ruby security update</title>
    <issued date="2026-01-03 09:07:36" />
    <updated date="2026-01-17 09:08:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* resolv: Denial of Service in resolv gem (CVE-2025-24294)

* rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24294" id="CVE-2025-24294" type="cve" title="CVE-2025-24294" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58767" id="CVE-2025-58767" type="cve" title="CVE-2025-58767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61594" id="CVE-2025-61594" type="cve" title="CVE-2025-61594" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379684" id="2379684" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2396186" id="2396186" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426336" id="2426336" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23141" id="RLSA-2025:23141" type="self" title="RLSA-2025:23141" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ruby" arch="x86_64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-3.3.10-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3897719f05801e93b2129284eb0472c16cb3a8342b32e80b016da37703f6f418</sum>
        </package>
        <package name="ruby-bundled-gems" arch="x86_64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-bundled-gems-3.3.10-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">772b6cf0a39bc7a612f6d57e8bb66aa26839af0f130d3f97c915571d6cf0e01b</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-default-gems-3.3.10-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">40f44efb34d21198b1c29a0929c4c51675d04e983cd81465f8cf1532b07441b1</sum>
        </package>
        <package name="ruby-devel" arch="x86_64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-devel-3.3.10-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">36f8ebbceb5941beadd51588446f3407a7d72eda143b141ad9532f17b385fa5d</sum>
        </package>
        <package name="rubygem-bigdecimal" arch="x86_64" epoch="0" version="3.1.5" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ae28f73fba0b12e84d417cc6b27bf2b17be85ba273398ec94ed86a41af1daa40</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-bundler-2.5.22-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">058f37cc1517c22c9bbb5bd1fca687bfa62588b74e84fe713ee7461bdd23e8bb</sum>
        </package>
        <package name="rubygem-io-console" arch="x86_64" epoch="0" version="0.7.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-io-console-0.7.1-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4283b3862f6f19297894ae291fc47cf83b511acf775962d80b7842d36168a2c9</sum>
        </package>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-irb-1.13.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">e4edd538b5968a839b91e449d8349daec2f196776c60d9077d93d5967f77596a</sum>
        </package>
        <package name="rubygem-json" arch="x86_64" epoch="0" version="2.7.2" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-json-2.7.2-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cd9dab4c7c19dbe4af5dd6a5395ed688d0e23745980fbf32e437fc313e0c275f</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-minitest-5.20.0-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">0434b5728cd4944228035d9b77680d2858734453f31d74c391c56f8c2d67d98a</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-power_assert-2.0.3-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">d0bde6352c0ae723efdc4a97696de00def0d82f6a8e8ef7e2400afccce648d59</sum>
        </package>
        <package name="rubygem-psych" arch="x86_64" epoch="0" version="5.1.2" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-psych-5.1.2-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">47452d678912371276902756f72fa4dcd70796476db848942ad591612bee0743</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rake-13.1.0-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">42114b64369326aa4a84ad5f32f116690e712ea7ed501003737ce2bde8ab583f</sum>
        </package>
        <package name="rubygem-rbs" arch="x86_64" epoch="0" version="3.4.0" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rbs-3.4.0-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f720c85c0947d20471f0867e870503fdab7955c918061db38af2788d8726b2c1</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">e71510b81e9beb13670a44249383320eb7c5fa1d774a38adf64bbc7df697536f</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.4.4" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rexml-3.4.4-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">f5ce0a935c6cd55f8b83cae6456ffb26c1a8b64e2ad50ee51e84267fc4207995</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rss-0.3.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">07912be4be20e8c39e41041841ad3d5e259a8f3cafedc1e6b69b92a9f58c5a20</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygems-3.5.22-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">4619bd0477a6a2b7bdfed9977c03765198f1c4f300874e94133bb6a3ff80934c</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygems-devel-3.5.22-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">8d675850b3900bef9a8445e114d3bdcec9a1043b871e659daa0a1b64b9b5f72e</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-test-unit-3.6.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">4567bdec139bad08bd4c25cc304bcd6729fa5765f351f045dd9c6cf89e9e609c</sum>
        </package>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-typeprof-0.21.9-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">d513b152dafea61d7a1f55ad03e2e1ebd0a489a4593a77434377e57c089e87ee</sum>
        </package>
        <package name="ruby-libs" arch="x86_64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-libs-3.3.10-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2431a56069ba051d289be1821e04cd17c77ba43b383f1c2687d59f012657c6e2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0025</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-01-05 09:08:05" />
    <updated date="2026-01-19 09:09:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333)

* firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

* firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

* firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14321" id="CVE-2025-14321" type="cve" title="CVE-2025-14321" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14322" id="CVE-2025-14322" type="cve" title="CVE-2025-14322" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14323" id="CVE-2025-14323" type="cve" title="CVE-2025-14323" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14324" id="CVE-2025-14324" type="cve" title="CVE-2025-14324" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14325" id="CVE-2025-14325" type="cve" title="CVE-2025-14325" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14328" id="CVE-2025-14328" type="cve" title="CVE-2025-14328" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14329" id="CVE-2025-14329" type="cve" title="CVE-2025-14329" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14330" id="CVE-2025-14330" type="cve" title="CVE-2025-14330" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14331" id="CVE-2025-14331" type="cve" title="CVE-2025-14331" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14333" id="CVE-2025-14333" type="cve" title="CVE-2025-14333" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420502" id="2420502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420503" id="2420503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420504" id="2420504" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420506" id="2420506" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420508" id="2420508" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420509" id="2420509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420512" id="2420512" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420513" id="2420513" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420516" id="2420516" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420517" id="2420517" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0025" id="RLSA-2026:0025" type="self" title="RLSA-2026:0025" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.6.0" release="1.el10_1" src="thunderbird-140.6.0-1.el10_1.src.rpm">
          <filename>thunderbird-140.6.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">206328c42c7d7fbd10e4365a988a5235333bfaa5e3a004f305341b522edf3e52</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0525</id>
    <title>Moderate: postgresql16 security update</title>
    <issued date="2026-01-14 09:14:26" />
    <updated date="2026-01-28 09:10:53" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12818" id="CVE-2025-12818" type="cve" title="CVE-2025-12818" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414826" id="2414826" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0525" id="RLSA-2026:0525" type="self" title="RLSA-2026:0525" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postgresql-plpython3" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-plpython3-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">87222f7cf1aeaadee5d008db8fe8c481d4db0068cc72bfff59f7f86ac6eda42e</sum>
        </package>
        <package name="postgresql-static" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-static-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d3d0fec6d0bbcbb0d38fb9421e8226430484a8babefa61f3c9661d4f0f80a06c</sum>
        </package>
        <package name="postgresql-docs" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-docs-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cb500e6a5f7c98ae158cf9ea43ecccb663dc18109b78cd7500a4895b0c452e22</sum>
        </package>
        <package name="postgresql" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5c5190813aed64ee329b3eb9b3fa0d94035bb1680350501054bb4e39bdd3e20c</sum>
        </package>
        <package name="postgresql-private-devel" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-private-devel-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ffa3f840b8f345b2390fbdd93b433b8ff20a292396711cc6a96a649bfc95c5e1</sum>
        </package>
        <package name="postgresql-contrib" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-contrib-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ebc305bd37b61943a6184476e9f21b8d43c7cf2d0c6baa47b58f2890fe6bf7d8</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-devel-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">690e1bd68a9ca334b5150b7033f1f140b70330039bf2c133521d716628dc4249</sum>
        </package>
        <package name="postgresql-plperl" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-plperl-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8657290354edcc8a63941cb5b595cd422ab40c3ea87970fb199c9a867b72906b</sum>
        </package>
        <package name="postgresql-server-devel" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-server-devel-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">51071b0013f300bfd36f2c665de58ece0401dd5803cb9220da98f40596451181</sum>
        </package>
        <package name="postgresql-server" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-server-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">aba6bf7159228cb19135add43fc7291a69d837d572c5fdfed2fe7f960c0dd7d3</sum>
        </package>
        <package name="postgresql-test" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-test-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d49fb5eaaa9c118ca70d4fa9d5d3c8b9ad3d1e0d05d4e260c64b9a40a74a40b3</sum>
        </package>
        <package name="postgresql-pltcl" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-pltcl-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7f590d00de023938ce1362a2bc7d5f32de508632d135f9aeba49dee384bd6af8</sum>
        </package>
        <package name="postgresql-private-libs" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-private-libs-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0a3dd7d8132b3e03313aeca2e6ed2edefb6eda10a76f557500d70f811d5ad71e</sum>
        </package>
        <package name="postgresql-upgrade" arch="x86_64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-16.11-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">64d6c42e01f14deed4c209d611439e3530ad709e57e01245232b8eadf2df2e6b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0423</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2026-01-15 09:16:30" />
    <updated date="2026-01-29 09:12:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins) (CVE-2025-14523)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14523" id="CVE-2025-14523" type="cve" title="CVE-2025-14523" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2421349" id="2421349" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0423" id="RLSA-2026:0423" type="self" title="RLSA-2026:0423" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.8" src="libsoup3-3.6.5-3.el10_1.8.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">de26c8b6c6fc6dd1cda0f50504d3a0ce942b3a71a813e44348f21e2498dc89db</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.8" src="libsoup3-3.6.5-3.el10_1.8.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">2129621b3a6cb9c63067172f135838260b46872d69749abb4f8abb79bb63daac</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0436</id>
    <title>Important: buildah security update</title>
    <issued date="2026-01-15 09:16:30" />
    <updated date="2026-01-29 09:12:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47913" id="CVE-2025-47913" type="cve" title="CVE-2025-47913" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414943" id="2414943" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0436" id="RLSA-2026:0436" type="self" title="RLSA-2026:0436" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.41.8" release="1.el10_1" src="buildah-1.41.8-1.el10_1.src.rpm">
          <filename>buildah-tests-1.41.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1b4c4add0688fe4800a57a0f75f2ff8ad6f6bd5a0b07f6a38cf1a607b1b21bda</sum>
        </package>
        <package name="buildah" arch="x86_64" epoch="2" version="1.41.8" release="1.el10_1" src="buildah-1.41.8-1.el10_1.src.rpm">
          <filename>buildah-1.41.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">dd5c9ca1ba7881c7125821a9cf47f730748c2420ddeef83896c27998f0a1e1fa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0770</id>
    <title>Important: gpsd security update</title>
    <issued date="2026-01-21 09:06:31" />
    <updated date="2026-02-03 17:25:19" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gpsd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.

Security Fix(es):

* gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269)

* gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67268" id="CVE-2025-67268" type="cve" title="CVE-2025-67268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67269" id="CVE-2025-67269" type="cve" title="CVE-2025-67269" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426835" id="2426835" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426810" id="2426810" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0770" id="RLSA-2026:0770" type="self" title="RLSA-2026:0770" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gpsd" arch="x86_64" epoch="1" version="3.26.1" release="1.el10_1.1" src="gpsd-3.26.1-1.el10_1.1.src.rpm">
          <filename>gpsd-3.26.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">2669ad374f675b1ba19f2ccbb41a57b077ca196313bbfe611c95efa327d8bbc5</sum>
        </package>
        <package name="gpsd-clients" arch="x86_64" epoch="1" version="3.26.1" release="1.el10_1.1" src="gpsd-3.26.1-1.el10_1.1.src.rpm">
          <filename>gpsd-clients-3.26.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">26c30b2d4d429c7fd75f55b8f131139f289b63982cf7b64d5579f00f455cf2d6</sum>
        </package>
        <package name="python3-gpsd" arch="x86_64" epoch="1" version="3.26.1" release="1.el10_1.1" src="gpsd-3.26.1-1.el10_1.1.src.rpm">
          <filename>python3-gpsd-3.26.1-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">c2cb68e2504ecd7ca8d4d2ef48c8e5773f62c2cc67b331a15b0a8a5a14df5f52</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0545</id>
    <title>Important: podman security update</title>
    <issued date="2026-01-17 09:07:37" />
    <updated date="2026-01-30 22:12:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47913" id="CVE-2025-47913" type="cve" title="CVE-2025-47913" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414943" id="2414943" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0545" id="RLSA-2026:0545" type="self" title="RLSA-2026:0545" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="11.el10_1" src="podman-5.6.0-11.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">16c5e9f16eb94c5e9b7fe3a1eda9b8ea23b083e81067e88b0f31f4d7582476a1</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.6.0" release="11.el10_1" src="podman-5.6.0-11.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">df581bf3b4f137a1bc60a48bc4cf856125aeee15a815367bd7844456ffead24b</sum>
        </package>
        <package name="podman" arch="x86_64" epoch="7" version="5.6.0" release="11.el10_1" src="podman-5.6.0-11.el10_1.src.rpm">
          <filename>podman-5.6.0-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cbf1135449f6083abec22d4f3f534aaf62f85bded59846f455724f8687c1250a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0606</id>
    <title>Moderate: vsftpd security update</title>
    <issued date="2026-01-17 09:07:37" />
    <updated date="2026-01-30 22:12:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for vsftpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

Security Fix(es):

* vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14242" id="CVE-2025-14242" type="cve" title="CVE-2025-14242" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419826" id="2419826" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0606" id="RLSA-2026:0606" type="self" title="RLSA-2026:0606" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="vsftpd" arch="x86_64" epoch="0" version="3.0.5" release="10.el10_1.1" src="vsftpd-3.0.5-10.el10_1.1.src.rpm">
          <filename>vsftpd-3.0.5-10.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">d2cc1377a00a81f215f5f61633d68ba43ff0042b3466a7142170b09cfa2858fa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0668</id>
    <title>Important: net-snmp security update</title>
    <issued date="2026-01-17 09:07:37" />
    <updated date="2026-01-30 22:12:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for net-snmp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

Security Fix(es):

* net-snmp: buffer overflow via a specially crafted packet can cause a crash in snmptrapd (CVE-2025-68615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68615" id="CVE-2025-68615" type="cve" title="CVE-2025-68615" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2424618" id="2424618" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0668" id="RLSA-2026:0668" type="self" title="RLSA-2026:0668" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="net-snmp-perl" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-perl-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">f43cf5e0013647abc79bbefd94bca037590f748daed5dd9076c0a35249588ce2</sum>
        </package>
        <package name="net-snmp-perl-module" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-perl-module-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">4d39c8b030400b52b66f27c4fc6ae3168c76cc3aa84d416a4c10b5f2b6354cdc</sum>
        </package>
        <package name="net-snmp-libs" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-libs-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">d8adf13d22f82adce511a5cea9b5adfe0c7f48827fb47dc0d51d095f9d32e782</sum>
        </package>
        <package name="net-snmp" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">c1ab83861de134346245e6af9c076225de8a2ee2caa4c8702c364a1cbbd65643</sum>
        </package>
        <package name="net-snmp-utils" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-utils-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">66f5955ef5ebba7ce0bafbfc155796a05fb6a071ae8ac9ebdfcda85df577dd59</sum>
        </package>
        <package name="net-snmp-agent-libs" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-agent-libs-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">79adcdbe558fad90d9029815a85522b52afff087e2f047d001b9111bfb5b7336</sum>
        </package>
        <package name="net-snmp-devel" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-devel-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">d9e33bc5fb7ea440aeb440792e0ccd225a1050907803d71b4e14440c84a2a9c0</sum>
        </package>
        <package name="python3-net-snmp" arch="x86_64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>python3-net-snmp-5.9.4-15.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">ae4aa33fb6f62d78d7ac6657d8486165307d3c1c74fbc02513c3e47d016a8355</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0922</id>
    <title>Important: golang security update</title>
    <issued date="2026-01-23 09:09:09" />
    <updated date="2026-02-06 09:10:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0922" id="RLSA-2026:0922" type="self" title="RLSA-2026:0922" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.5-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">50ed0b06e55a882d383ece3d72f72b4a13f3e31f10a1bcce56172e5c7c28a960</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">37193f1ea5fe167f83ebd687d22a6c0911a285d06a3865a229f59e019e02323f</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">509934389da150ab8af62eadc5261fc91afbeb1f02291b5dd3b94fb73fd64393</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-race-1.25.5-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">073b9098f4976fbfb68f7e1754fb2186d0a390ab121627f69fe90046c8f60dd9</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-1.25.5-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d63a749e61612d2eb4df265f22bdde1425ef1b096584e68a696510e7768a280e</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">0baede789c6eb9f29fb31fc4f2eeac953f7f11de4464a6e5f54155744799cac8</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.5-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">55af6893ad61edaff8816ee911a4f1095536abbed79faba219a812d8a3464a43</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-src-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">3471f8593ee325afc1423143bb49a46d3676a5dbfa904a095a1bb8820e61a05a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1597</id>
    <title>Moderate: iperf3 security update</title>
    <issued date="2026-02-03 17:23:52" />
    <updated date="2026-02-17 09:10:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for iperf3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

* iperf3: iperf Heap Buffer Overflow (CVE-2025-54349)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54349" id="CVE-2025-54349" type="cve" title="CVE-2025-54349" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2386151" id="2386151" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1597" id="RLSA-2026:1597" type="self" title="RLSA-2026:1597" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="iperf3" arch="x86_64" epoch="0" version="3.17.1" release="5.el10_1" src="iperf3-3.17.1-5.el10_1.src.rpm">
          <filename>iperf3-3.17.1-5.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b9bdca5dca06788f0315dd9d4612e5b9e63e2ec0cd7b862fd3463f5a57ca0a94</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1628</id>
    <title>Important: php security update</title>
    <issued date="2026-02-05 09:13:02" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

* php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

* php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14177" id="CVE-2025-14177" type="cve" title="CVE-2025-14177" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14178" id="CVE-2025-14178" type="cve" title="CVE-2025-14178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14180" id="CVE-2025-14180" type="cve" title="CVE-2025-14180" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425627" id="2425627" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425625" id="2425625" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425626" id="2425626" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1628" id="RLSA-2026:1628" type="self" title="RLSA-2026:1628" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="php-embedded" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-embedded-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">33fddf1d74e32829ba767e77aeaa5d2977ae88f06b1d195274312611b730b188</sum>
        </package>
        <package name="php-gd" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-gd-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">6fbee4db51f4fa36df6d023121bb77c2a89f8cd7271905720b4039c77f39fda0</sum>
        </package>
        <package name="php-snmp" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-snmp-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c1925b7feb600a76afad66c475377fa116a424391722c3350d3b5627e38b5755</sum>
        </package>
        <package name="php-ldap" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-ldap-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ec577b99eb418ff62d2b3ed5ac1e3925d72bd6fc9abd676d185bf3c9ec75e864</sum>
        </package>
        <package name="php-devel" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-devel-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b89b81bee412bda6aa679e078fa3b80b669790cf79a41ae880404d42220aae4d</sum>
        </package>
        <package name="php" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5a19a0bf092722493ee7c7b22c2a3c2e03938d80b9ef0a9e999b91e5e33bc14d</sum>
        </package>
        <package name="php-dbg" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-dbg-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d09e7929d46a1998a4c23913a4f49dd24c980b07352f1e1413edc0ac6581c6f0</sum>
        </package>
        <package name="php-soap" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-soap-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">021c7e6ef194b3d7cf10f57efc18d3078e53071b880121ddeeb6fed58d1f81d0</sum>
        </package>
        <package name="php-fpm" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-fpm-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e5e73b562a42b3618de03b71fbd641415b77236aed3e65d4589a9313879e8fab</sum>
        </package>
        <package name="php-mysqlnd" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-mysqlnd-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">348dd4d78b22aaf4bad2987c51d9e6e96e4d1686144ec1df6d164b252e179b9b</sum>
        </package>
        <package name="php-common" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-common-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3ecbb4e14c39dc558fe2fc20c545b1bf49fdb0bc60064c9d5f50af82583bb60d</sum>
        </package>
        <package name="php-gmp" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-gmp-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2eca5b2ccd32a008d353917fbc6eb37a128212226c017f9cffd9d823e7c9e7b4</sum>
        </package>
        <package name="php-enchant" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-enchant-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9c6f89ecb11e9e57bb8416a0a4b817cbfa1b2f4eadc5972dcc9905a146ac65fa</sum>
        </package>
        <package name="php-mbstring" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-mbstring-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cfe90863232552cc51a5e4f9e7d4a7aa5b3f724b570b728acba3703f0ac841e5</sum>
        </package>
        <package name="php-odbc" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-odbc-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">6b4bc5e6eca4e57d707cc0fc49bc3bc5dea9d7f935dedc3134f0953d40ba40d5</sum>
        </package>
        <package name="php-dba" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-dba-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f33b17e28714849e59acf8ebb04ba65ebbde7067c933d40851911ece516f756a</sum>
        </package>
        <package name="php-pdo" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-pdo-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">21b2d5fa420cc9f073a31e29999b84dd477439ec301b6e362014710a99cb9770</sum>
        </package>
        <package name="php-intl" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-intl-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">24f4f16fabe63c86251c368d5b4fc4eae4d883870182023441f087d44d52de5b</sum>
        </package>
        <package name="php-opcache" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-opcache-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8f8c724d34748c848eaf8d1c985a99af159ab3612d7dd72380d589b662434715</sum>
        </package>
        <package name="php-process" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-process-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ae5c62894a6e94f0bee88e1de2c9c51e91c3e6834ec1825fa7fd0d84542215e7</sum>
        </package>
        <package name="php-ffi" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-ffi-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">09391134e24a700301f2c4ee7c3b912c06d0444b16a355ff8351280f58c3551e</sum>
        </package>
        <package name="php-pgsql" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-pgsql-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c6084526e71527a5e651e3685c0c29b2b7eddff8893ce258afcf14ee3a85ea75</sum>
        </package>
        <package name="php-bcmath" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-bcmath-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b9fb9de8d80a9fcf90b0040ab366be56810046c28aedc7bf162a9770a3376fdc</sum>
        </package>
        <package name="php-xml" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-xml-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">29dcef05a90519262ab004478e414ba96099d9cf4c5b1855c99985b6692f0c5a</sum>
        </package>
        <package name="php-cli" arch="x86_64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-cli-8.3.29-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">87d72a4dc117ec13b32160191809bbdb28e9d6284b4600b408c14032719b3911</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1714</id>
    <title>Moderate: wireshark security update</title>
    <issued date="2026-02-05 09:13:02" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* Wireshark: NULL Pointer Dereference in Wireshark (CVE-2025-9817)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9817" id="CVE-2025-9817" type="cve" title="CVE-2025-9817" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2392839" id="2392839" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1714" id="RLSA-2026:1714" type="self" title="RLSA-2026:1714" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="wireshark-cli" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.2" src="wireshark-4.4.2-4.el10_1.2.src.rpm">
          <filename>wireshark-cli-4.4.2-4.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">791acb14d6b823c72331cd01ef175a379585d68344364f9c82e397a5b089637a</sum>
        </package>
        <package name="wireshark" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.2" src="wireshark-4.4.2-4.el10_1.2.src.rpm">
          <filename>wireshark-4.4.2-4.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">01a52dfd7e453af47265a5946e526d889c3e70df82589c8534ed8c1495309622</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1715</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-02-05 09:13:02" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1715" id="RLSA-2026:1715" type="self" title="RLSA-2026:1715" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="4.el10_1" src="golang-github-openprinting-ipp-usb-0.9.27-4.el10_1.src.rpm">
          <filename>ipp-usb-0.9.27-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">55e39f90a58b12ed5c1554a20b1834423029c2811e8370219b2119913691a7f4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2182</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2026-02-07 09:09:45" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication (CVE-2026-0719)

* libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0719" id="CVE-2026-0719" type="cve" title="CVE-2026-0719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1761" id="CVE-2026-1761" type="cve" title="CVE-2026-1761" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2427906" id="2427906" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2435961" id="2435961" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2182" id="RLSA-2026:2182" type="self" title="RLSA-2026:2182" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.9" src="libsoup3-3.6.5-3.el10_1.9.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.9.x86_64.rpm</filename>
          <sum type="sha256">e9a92678a2b5dcec77fcc390be5165549df20219354c0e014ba6c31d127bec71</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.9" src="libsoup3-3.6.5-3.el10_1.9.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.9.x86_64.rpm</filename>
          <sum type="sha256">882b0b57482f0065dc023362d5c4ec442f9abbdced56aa5065097e79aa9b4ab5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1905</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23490" id="CVE-2026-23490" type="cve" title="CVE-2026-23490" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430472" id="2430472" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1905" id="RLSA-2026:1905" type="self" title="RLSA-2026:1905" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="fence-virtd-multicast" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-multicast-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">0d811f5f3eb8283ca6184024e4ff9bb2aa5477641173a29dc3e4a4ea6bb9af3d</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6d6b49af741df947e13524e43e0955aa2c0f52403d8bf836334e6c951c07664b</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">f7b20f7e215b4808d5083ef2fdb88b7fe6852b022696e398c5923317cb84e699</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">744983f9b876d2e6204e4fa9f7ccf98b53900005a2c60501e820359f56301108</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">fa3c44b37e4e9b99ecde0486d8ffdb9b7686e34e6f96a5a7a1ca25e3e96f342e</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">da9c4f59307029c579f0231587b0f226112896e8d9524a0072cba6995bcd8f62</sum>
        </package>
        <package name="fence-agents-redfish" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-redfish-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">24b7b7939b61ac5ea7b25a4d376abeafa366d5996b610072eb45a35cf82f5402</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">db27ed6e5c4c2bedc1c57e6d188c2fb8eb1b4190db5e3ccf2bc85cd699e31c56</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">a13f18f3a7352dbb80c55920b5804ac145c308861beb7f98d23cb04ce6fb55c1</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-virsh-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6946997cd0e441920755d88aae9fc5e3dff75ac1a8d70a71a78728c2d4ecf17f</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">ad6341e317306438f9eb28bf844390b525aa784bdcd3d86ca3201141bc319895</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">c352c5b8f487314eb9267a04de69cff78ab1cf752e767ed24dcc9ee172d06f95</sum>
        </package>
        <package name="fence-agents-common" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-common-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">1acd85e31b0a1f03106a71dbc6ae3af1647d9e5803da449a2739384f55791a00</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-emerson-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">4d41c05e178981fa8db8579bf696f853f15a1ea37354bbe12366f1b70c49142f</sum>
        </package>
        <package name="fence-agents-aws" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-aws-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">fc9b2794e9c8cf868be148d594fe8c924ef80d3725a93dbe13176c43882cab0d</sum>
        </package>
        <package name="fence-agents-azure-arm" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-azure-arm-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">3160f52859d79f1936be20746708e6c742b9c49e5863865eb9198004ae489370</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-apc-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6069ff740536ce03e921217bbcc695237f025395e8675551bede3ba6b2a2a9e0</sum>
        </package>
        <package name="fence-virtd-tcp" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-tcp-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">861fa1f3acbb8d3f8be3a302350d2adee63beec9e5cbc4cad23482b221ae27c5</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">1d3e3e21a23596020da9c70f61beac80e88ef5bb0a6ab0a1d1cc7f79e8999fbf</sum>
        </package>
        <package name="fence-virtd-serial" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-serial-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">7cf6d97dde813877a9ac8450a77186a4c21642e9f8973a809ce60490f8322411</sum>
        </package>
        <package name="fence-agents-openstack" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-openstack-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">46360b681238bf3b3290f1558ba08b158ebb5d56b6681ee7fadaa2b9cc1c4e6c</sum>
        </package>
        <package name="fence-agents-gce" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-gce-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">c00c44be9d6fd2beda59634a9c60ef3a43d133896795f38852528516147a27dc</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">3d8158d5f7fad1e6437ab26b4ebb670d22bc2bffacd74debda5eca8fbc5d99e8</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-sbd-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">f00dd62eab14ee407ca82c221c62884e7a7015f8faa54b8f1ea0f448f9502ca6</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">94f12803ea6b260f160dad9c1da96ca3eab05aaacfd02ed23457c52e051b1a48</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-rsb-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">db6c37fa9ffa72f12c41d25c5a6182a9a712196e9438e62f70332f930d5526cf</sum>
        </package>
        <package name="ha-cloud-support" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>ha-cloud-support-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">56572ee8c4ab916d9ac0160ecec39bf9d87d230a5eae3986404c14d2ad052053</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">ac8ec113d3e4561b7ad8cc68dc070a75892c982c2accd5e90838a19f7684667d</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">20573bb73c629bbaa9630fc494c081d0b5050bf42fc24f2c2bc048df656ff272</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">59aba5896367a98b1c2fc5d2ddb177d18a415f74504d32a1ba40be7e1d2a2e35</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">04d3d314ab0871cb6b3a2e5b675e043493c3d322e4a78e51075d51e3b0589a61</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-mpath-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">69f5e537c670b4b47389c422b242cd9a62d5f5f28a09bc47c3a58397601902ec</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">9d70edbb0cd1a6268436c33a1e99c54d9f56c3fa8c7f0140d04ba88547648405</sum>
        </package>
        <package name="fence-agents-kdump" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-kdump-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">6ed4a4bdbb02a8646e938ce8de80046e72c6d6e9376bd446c7d9a01728bd7767</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-brocade-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">088994c92aa2eed0381485f4fcbb0c4a6d6d5d38011614fc0cfc133ecc7ea5ce</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-scsi-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">a3c22cbaf14cd9c68558c19337b5e4d82d6ed053c3e3798aa9fdb60db8538b83</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">c938db8c5d2443f7a19598454d72eb7d4cc00f4c460e2db8aa0cae6c323dc40e</sum>
        </package>
        <package name="fence-virtd" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">bd59e3ddb4ecfe3f907387fb7359679c4f45e5a425118fd1799cf7f71f981de1</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-drac5-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">2cbd0cba564e2dc0c8f1df64abb3633714c5cfce3cca1f62bab8212b0e02c1b7</sum>
        </package>
        <package name="fence-virtd-libvirt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-libvirt-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">f39f51d4c3e27a1c9eb7da234c9a06de03fe05d599f3c50ab40abd8acc495e2a</sum>
        </package>
        <package name="fence-agents-aliyun" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-aliyun-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">14cee3ec03c6b35c4f575ca73a9b8f4003b047125de493d17c5dbaf812e2ce21</sum>
        </package>
        <package name="fence-agents-all" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-all-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">6cfa8730436ad830b1af2a38e8c65411438d618cacb095e17bef9953b4cd2abc</sum>
        </package>
        <package name="fence-virt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virt-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">4abde22e83dd28ef7d7c9ad21099da6a26a5124806fd7c142a1e848a1cf9be32</sum>
        </package>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">7ec071eefb60bebdcb40ac3b4d3dde0211749971d7a01296dfe45deb5110e6f4</sum>
        </package>
        <package name="fence-virtd-cpg" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-virtd-cpg-4.16.0-13.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">7bd402a2d37a3aafc6668d478f28933e23e41e8376dc1ce1d65ea87f5f20892e</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">b6ca56e874c07d826cbc2c6db3ed94cae4164f3a892b7a428297eeea98219d09</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">20384778df91636f46cee3afb7d0ffbcb5153d988d4fe84f48df27276066bc11</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-eps-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">c394a51084efead2948dd570410324d03a3f7ad7536d02a7ca00aedf7c7e2a6c</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-wti-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6a0c5faaebea74abe72a2fe4b1aa6f14c69b0f31376863858d5d7c45abfca561</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">957b8b2ba4630b26ed33a390e830e4cfe18212722e40bb0734b6943471b29578</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">5790c225105735536180d29888748191f67188e202ca93084b61cb61e9fc0832</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-rsa-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">176fd22fc375634e906848efe06cb418e9b0209dd59442ffa99d05d1c3372885</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-lpar-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">0a130538f252739c95f1b60984a0c614bab4f99fbb4e170c49c988d8e80e6065</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1842</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

* nodejs: Nodejs denial of service (CVE-2026-21637)

* nodejs: Nodejs denial of service (CVE-2025-59466)

* nodejs: Nodejs denial of service (CVE-2025-59465)

* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

* nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55130" id="CVE-2025-55130" type="cve" title="CVE-2025-55130" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55131" id="CVE-2025-55131" type="cve" title="CVE-2025-55131" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55132" id="CVE-2025-55132" type="cve" title="CVE-2025-55132" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59465" id="CVE-2025-59465" type="cve" title="CVE-2025-59465" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59466" id="CVE-2025-59466" type="cve" title="CVE-2025-59466" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21637" id="CVE-2026-21637" type="cve" title="CVE-2026-21637" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431349" id="2431349" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431343" id="2431343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431340" id="2431340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431352" id="2431352" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431350" id="2431350" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431338" id="2431338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1842" id="RLSA-2026:1842" type="self" title="RLSA-2026:1842" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs24-full-i18n" arch="x86_64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-full-i18n-24.13.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1729d822171b373061ce17ae6f3429461b98b54dd746c15197b89911573832db</sum>
        </package>
        <package name="nodejs24-devel" arch="x86_64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-devel-24.13.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">efab123f91e4356131d027fac7136998eb939b1b76acd2abf743706270f70d34</sum>
        </package>
        <package name="nodejs24-libs" arch="x86_64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-libs-24.13.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0bec2c9dcc51b53311d9c7615f995370bee7ab4c4df0e859219758f9323f4cb5</sum>
        </package>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-docs-24.13.0-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">1d2e9d7d3bbf686a1862ba194782f22e5eb522f1643084d926e5ba576ab067d0</sum>
        </package>
        <package name="nodejs24" arch="x86_64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-24.13.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">717b3369eac9c05ecab4adc215f58c0699f291d426eaa282bf26c6efa8b503bc</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.6.2" release="1.24.13.0.1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-npm-11.6.2-1.24.13.0.1.el10_1.noarch.rpm</filename>
          <sum type="sha256">47139c6e8c75276e94a4d2cc6f41ac80bd7d7eb07b95f00f1db117d1754e7b48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1843</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

* nodejs: Nodejs denial of service (CVE-2026-21637)

* nodejs: Nodejs denial of service (CVE-2025-59466)

* nodejs: Nodejs denial of service (CVE-2025-59465)

* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

* nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55130" id="CVE-2025-55130" type="cve" title="CVE-2025-55130" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55131" id="CVE-2025-55131" type="cve" title="CVE-2025-55131" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55132" id="CVE-2025-55132" type="cve" title="CVE-2025-55132" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59465" id="CVE-2025-59465" type="cve" title="CVE-2025-59465" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59466" id="CVE-2025-59466" type="cve" title="CVE-2025-59466" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21637" id="CVE-2026-21637" type="cve" title="CVE-2026-21637" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431349" id="2431349" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431343" id="2431343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431340" id="2431340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431352" id="2431352" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431350" id="2431350" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431338" id="2431338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1843" id="RLSA-2026:1843" type="self" title="RLSA-2026:1843" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs-full-i18n" arch="x86_64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-full-i18n-22.22.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5c416cfb38010f4af98c1ad8130681efebf3a94894af75101e80e19fd9da896c</sum>
        </package>
        <package name="nodejs-devel" arch="x86_64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-devel-22.22.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cac51ee1f8e5760c346abbd780c175b9ce9145b590be2d3f4d9c93705244769f</sum>
        </package>
        <package name="nodejs-libs" arch="x86_64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-libs-22.22.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">bec93652c8e54a0d358217945d2b1a6676f9259b7e0ffd099968a92e6842705f</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-docs-22.22.0-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">12418e04b77a2c1137c2647a82575b946895b7fc9ae0b47193086ae6efb251f4</sum>
        </package>
        <package name="nodejs-npm" arch="x86_64" epoch="1" version="10.9.4" release="1.22.22.0.3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-npm-10.9.4-1.22.22.0.3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4058f97a56f0eb154eb483aa12b47ba74d5e840eb87d4d1339d0b20bddd8bad1</sum>
        </package>
        <package name="nodejs" arch="x86_64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-22.22.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">aa4b88728ebff319b824f7836234580a7184cb3a316d9811d8c4a5ee22878c1e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1831</id>
    <title>Moderate: qemu-kvm security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qemu-kvm.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

* qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11234" id="CVE-2025-11234" type="cve" title="CVE-2025-11234" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401209" id="2401209" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1831" id="RLSA-2026:1831" type="self" title="RLSA-2026:1831" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qemu-kvm-device-usb-host" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-usb-host-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">f87fdd2b244c471a5e8cbfe4587179c47d778bb55fa6731e9e52e9e730600c65</sum>
        </package>
        <package name="qemu-kvm-ui-egl-headless" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-ui-egl-headless-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">2c5829736f841afa5be470e144c28ee34346ecbb5a404be9a23d803ce7181809</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">aa0d134da8432d7c61bb86d1ebcf712a05ffd0f6f5ac2c4e90d0a67de71b8f48</sum>
        </package>
        <package name="qemu-kvm-audio-pa" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-audio-pa-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">e35e3e17762ec1d27d58f51fe07d92f55aa4a2e1669d9f8f120b34c8f2789850</sum>
        </package>
        <package name="qemu-pr-helper" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-pr-helper-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">80408401721b35773810732e6ab3d8766cba88762b8a65c38484fa00253d758b</sum>
        </package>
        <package name="qemu-kvm-block-blkio" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-block-blkio-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">c7bd05a9d8f8a525e1f9c31ea147bb6072674a84171769a234c4b1892f63984c</sum>
        </package>
        <package name="qemu-kvm-device-usb-redirect" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-usb-redirect-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">fecf054d61dfd7cc827a218ac53f8a2cfa2453dab7fb44d948aaf3f632966a14</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu-pci" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-pci-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">662334824dcda7324d8ae307e5878b9b2eff45670f970a487a1685e4a7a0abeb</sum>
        </package>
        <package name="qemu-kvm-ui-opengl" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-ui-opengl-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">98ca0652d9df86f8e2c9376754e4b0d2cb9e7501cec384adb35ca666c25ce167</sum>
        </package>
        <package name="qemu-kvm-tools" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-tools-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">b680d61e18933cd22076dac16176fec4403b060f252e0449959f00bce2438aaf</sum>
        </package>
        <package name="qemu-kvm-core" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-core-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">a0ff863204cab19d7981b3984416892191c3b004221eb57d27e24f8d1145b6dd</sum>
        </package>
        <package name="qemu-guest-agent" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-guest-agent-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">1182cdb32760eaa4b082d6ba7cb8b1d8710360de9b4adbf142f8266b4da8e8b6</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-vga" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-vga-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">5a6b2a6730bd3aac95b760b132630613aea82ecf7acce92193acb4b5c4cc9521</sum>
        </package>
        <package name="qemu-kvm-docs" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-docs-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">9a2966ed7ea381c009b84efa4097d5d3277c0440c4c78382b2b00735749cbb8b</sum>
        </package>
        <package name="qemu-kvm-block-curl" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-block-curl-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">d219e8198b876097fbdfdf6212425ad7c9e7a4a4060770ee030adb1246e1f638</sum>
        </package>
        <package name="qemu-img" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-img-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">6cc93d0f9e281f2d1440f9af81e8a9d64cacad112891dfdc6f4ceba69550a5d6</sum>
        </package>
        <package name="qemu-kvm-block-rbd" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-block-rbd-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">110413b3589ff44a2b9298872a27af91fd39331005dfc365bf35bc07e4cb2a7c</sum>
        </package>
        <package name="qemu-kvm-common" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-common-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">15a67022c4d89f74686c18c52d680dd9f7f66a6fdfacac52934c80ac274a020e</sum>
        </package>
        <package name="qemu-kvm" arch="x86_64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-10.0.0-14.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">0cac2f915783c817aafffb7e40ff9fd5ac813f70755d22311f5d712ca2ad40ca</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2225</id>
    <title>Critical: keylime security update</title>
    <issued date="2026-02-11 09:16:03" />
    <updated date="2026-02-24 18:58:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>An update is available for keylime.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

* keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1709" id="CVE-2026-1709" type="cve" title="CVE-2026-1709" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2435514" id="2435514" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2225" id="RLSA-2026:2225" type="self" title="RLSA-2026:2225" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="keylime" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">62eb3a1759578ea026256fa1b9e268d8c62b3e791edff9e96aad123087656442</sum>
        </package>
        <package name="keylime-registrar" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-registrar-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">e9a1fe96f4accf6b1947cbd3f186238b933323e163246fbf3f28e917cf087abb</sum>
        </package>
        <package name="python3-keylime" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>python3-keylime-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">5af53f6130e6dc111be74fc036b61a8a7ba7364527609a52be3b9f928f648a01</sum>
        </package>
        <package name="keylime-selinux" arch="noarch" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-selinux-7.12.1-11.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">cf74ec0786a2fb42cf5d46aeb335f4a59596ac3b4c0f380088d7dc98a4912fed</sum>
        </package>
        <package name="keylime-tenant" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-tenant-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">71b93ce7f4c37db85f9f6a4cd8844ec0cfc68ce4ea7ad447059e21705cb80298</sum>
        </package>
        <package name="keylime-tools" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-tools-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">4fdb6b701d9831884dac60aa14de5406aeb5f0b1201298a056c1cc4c27fd0268</sum>
        </package>
        <package name="keylime-verifier" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-verifier-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">2a94093739648408d6db54ac71bc44384d20dd16cf5107a70bbc2fd6628fec92</sum>
        </package>
        <package name="keylime-base" arch="x86_64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-base-7.12.1-11.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">436e06521ce5d159e39d227c84fb4f3ca948e85ede15725f29aa9af91e9f37ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2222</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-02-11 09:16:03" />
    <updated date="2026-02-24 18:58:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530)

* freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884)

* freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)

* freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533)

* freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531)

* freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534)

* freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23530" id="CVE-2026-23530" type="cve" title="CVE-2026-23530" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23531" id="CVE-2026-23531" type="cve" title="CVE-2026-23531" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23532" id="CVE-2026-23532" type="cve" title="CVE-2026-23532" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23533" id="CVE-2026-23533" type="cve" title="CVE-2026-23533" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23534" id="CVE-2026-23534" type="cve" title="CVE-2026-23534" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23883" id="CVE-2026-23883" type="cve" title="CVE-2026-23883" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23884" id="CVE-2026-23884" type="cve" title="CVE-2026-23884" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430880" id="2430880" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430886" id="2430886" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430885" id="2430885" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430891" id="2430891" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430877" id="2430877" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430887" id="2430887" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430888" id="2430888" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2222" id="RLSA-2026:2222" type="self" title="RLSA-2026:2222" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.1" src="freerdp-3.10.3-5.el10_1.1.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">58d1389647dac0fe3666bcda68dcdd68249d21c865298330920acedfc237b8a5</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.1" src="freerdp-3.10.3-5.el10_1.1.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">5a0bcaea3bf0df4a46089661f3d524e83e1fe6abb0fa74845ea9795360430f8b</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.1" src="freerdp-3.10.3-5.el10_1.1.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">5cfa78a7231209e47cd2cd0b10cd809474cdbd8bb7ace135d6fb34569716348a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2410</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2026-02-13 09:09:56" />
    <updated date="2026-02-26 20:49:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1761" id="CVE-2026-1761" type="cve" title="CVE-2026-1761" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2435961" id="2435961" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2410" id="RLSA-2026:2410" type="self" title="RLSA-2026:2410" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.10" src="libsoup3-3.6.5-3.el10_1.10.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.10.x86_64.rpm</filename>
          <sum type="sha256">dfb245438542b1b6a348ba498504beebc622a95d81e27121afc8d0a046fa0e31</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.10" src="libsoup3-3.6.5-3.el10_1.10.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.10.x86_64.rpm</filename>
          <sum type="sha256">6bfefa84caaec3d210215786e2e8810bd47d1d02492fbeaa3458d685ff127048</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2706</id>
    <title>Important: golang security update</title>
    <issued date="2026-02-17 09:08:42" />
    <updated date="2026-03-02 09:10:55" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61732" id="CVE-2025-61732" type="cve" title="CVE-2025-61732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437016" id="2437016" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2706" id="RLSA-2026:2706" type="self" title="RLSA-2026:2706" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang" arch="x86_64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-1.25.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">81db2b9314a04f3095031db47a9d8f3c94ecd8a36e6859dc8650429328a20b60</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e919b39c47979171d95fba6b72cbe2c625a403eb2d65dc8417c5a5b4cf5ef7de</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">30c746dab593cd0c646919439cd688eb19a9f442ea5c0905de14836f1b89c5d2</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">cd491c0a88130a78c3d9540bf63a5b1f358c4e1a0de3f1c7c122d61b6b09e00e</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">27e6ef9ca5cf6b646ea3832990b77afbdef885afd9c6768c360cc95d1d5c87e1</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-race-1.25.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1ad6706399127eac0eaab787541fb2c4556c8430e935a8489f0e549345e1572c</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">a5c9084a174853dde1a972c47efc09986f37062a178d9846e02f2964cabc0bb6</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-src-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">f155d31640cca7f4abb754b982b9f359504bc9047e1852dc24d168bb3f631e68</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2914</id>
    <title>Important: grafana security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross?Dashboard Privilege Escalation (CVE-2026-21721)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21721" id="CVE-2026-21721" type="cve" title="CVE-2026-21721" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433242" id="2433242" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2914" id="RLSA-2026:2914" type="self" title="RLSA-2026:2914" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="22.el10_1" src="grafana-10.2.6-22.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-22.el10_1.x86_64.rpm</filename>
          <sum type="sha256">69d116bb11e3a0455568c0312c0dec6fe33e2a3f338dfa5d9721e490c7ccebd6</sum>
        </package>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="22.el10_1" src="grafana-10.2.6-22.el10_1.src.rpm">
          <filename>grafana-10.2.6-22.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7698bcdd197f7530a499fdb404176def1b17cfbd71ffb30081dcdf8902838ddf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3035</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3035" id="RLSA-2026:3035" type="self" title="RLSA-2026:3035" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-pcp" arch="x86_64" epoch="0" version="5.3.0" release="2.el10_1" src="grafana-pcp-5.3.0-2.el10_1.src.rpm">
          <filename>grafana-pcp-5.3.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1bec30fa1d1285a2b8a21b8668c0adab9db0f93f7c156e7c4daa04a588c3953d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3033</id>
    <title>Important: munge security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for munge.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.

Security Fix(es):

* MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25506" id="CVE-2026-25506" type="cve" title="CVE-2026-25506" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438715" id="2438715" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3033" id="RLSA-2026:3033" type="self" title="RLSA-2026:3033" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="munge-libs" arch="x86_64" epoch="0" version="0.5.15" release="11.el10_1" src="munge-0.5.15-11.el10_1.src.rpm">
          <filename>munge-libs-0.5.15-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">36fb45ac40af73ff5b8e96305582bc465a3dcdee8b509e402738bcfe4489ed3e</sum>
        </package>
        <package name="munge" arch="x86_64" epoch="0" version="0.5.15" release="11.el10_1" src="munge-0.5.15-11.el10_1.src.rpm">
          <filename>munge-0.5.15-11.el10_1.x86_64.rpm</filename>
          <sum type="sha256">60cc3e3fc68761fa7b108b1a207af91930bcf937b58a12c82f74eacfff360d95</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3068</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22853)

* freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859)

* freerdp: FreeRDP: Denial of Service via use after free in ecam_channel_write (CVE-2026-24678)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22853" id="CVE-2026-22853" type="cve" title="CVE-2026-22853" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22855" id="CVE-2026-22855" type="cve" title="CVE-2026-22855" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22858" id="CVE-2026-22858" type="cve" title="CVE-2026-22858" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22859" id="CVE-2026-22859" type="cve" title="CVE-2026-22859" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24678" id="CVE-2026-24678" type="cve" title="CVE-2026-24678" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429653" id="2429653" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429649" id="2429649" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429647" id="2429647" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438197" id="2438197" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429645" id="2429645" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3068" id="RLSA-2026:3068" type="self" title="RLSA-2026:3068" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.2" src="freerdp-3.10.3-5.el10_1.2.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">067b278c5ebbb71c0baf33f032ea9596e8751b8947b579a74c0c86e7bf5fe994</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.2" src="freerdp-3.10.3-5.el10_1.2.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">8300eb4b2fb4db3ce2bfe3992b7d2667440f6cf2acf18da3a0fad532a9e237f9</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.2" src="freerdp-3.10.3-5.el10_1.2.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">f11eb1d57995ed9934127962b7e68ed46e37c6595a6862ecefafdd71ed14917c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3092</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3092" id="RLSA-2026:3092" type="self" title="RLSA-2026:3092" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="5.el10_1" src="golang-github-openprinting-ipp-usb-0.9.27-5.el10_1.src.rpm">
          <filename>ipp-usb-0.9.27-5.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8888d69bb8115ae7dc3b1b7594367d17ffa3d3575d4b1e0e470a975e69f633a8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3094</id>
    <title>Important: protobuf security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for protobuf.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.

Security Fix(es):

* python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0994" id="CVE-2026-0994" type="cve" title="CVE-2026-0994" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2432398" id="2432398" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3094" id="RLSA-2026:3094" type="self" title="RLSA-2026:3094" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-protobuf" arch="x86_64" epoch="0" version="3.19.6" release="15.el10_1" src="protobuf-3.19.6-15.el10_1.src.rpm">
          <filename>python3-protobuf-3.19.6-15.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1ab7d1cd924f808e8cc4e40f912949d91b213a137d996ccccb0a9257d2d4eb19</sum>
        </package>
        <package name="protobuf" arch="x86_64" epoch="0" version="3.19.6" release="15.el10_1" src="protobuf-3.19.6-15.el10_1.src.rpm">
          <filename>protobuf-3.19.6-15.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8163275f67eb66ab63faa6fb334dbb6887cb5a467e3a8cdac7da6ed61e8ba86f</sum>
        </package>
        <package name="protobuf-lite" arch="x86_64" epoch="0" version="3.19.6" release="15.el10_1" src="protobuf-3.19.6-15.el10_1.src.rpm">
          <filename>protobuf-lite-3.19.6-15.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1f62a6df4a8eb547595f9523a2515665c7557e3488c451cb9d223d4f868369f2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3208</id>
    <title>Moderate: 389-ds-base security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for 389-ds-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14905" id="CVE-2025-14905" type="cve" title="CVE-2025-14905" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2423624" id="2423624" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3208" id="RLSA-2026:3208" type="self" title="RLSA-2026:3208" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="389-ds-base" arch="x86_64" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>389-ds-base-3.1.3-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d8417f093ec7f287ce02ca02b2bee0e9157b4b1492247dc27e9ecc1f8761d331</sum>
        </package>
        <package name="389-ds-base-libs" arch="x86_64" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>389-ds-base-libs-3.1.3-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">6d8d1dd9f46e4bcd0a6bcdb3fc8563cafb6f933912c11d4f30b0aeda8b8541e0</sum>
        </package>
        <package name="389-ds-base-snmp" arch="x86_64" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>389-ds-base-snmp-3.1.3-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">813419ef0afd252f43c8bad687d102de3acd2362c6727688ec59e6b704317565</sum>
        </package>
        <package name="python3-lib389" arch="noarch" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>python3-lib389-3.1.3-7.el10_1.noarch.rpm</filename>
          <sum type="sha256">3de41c1f87bf374e89d73ff11abb7793efb0c38be054059155cde52dc2d29e48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3297</id>
    <title>Important: buildah security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3297" id="RLSA-2026:3297" type="self" title="RLSA-2026:3297" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah" arch="x86_64" epoch="2" version="1.41.8" release="2.el10_1" src="buildah-1.41.8-2.el10_1.src.rpm">
          <filename>buildah-1.41.8-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">487d17bf6f1dde78c174fb25d2db606feb88ca3a86d3489f4cc0004d85732678</sum>
        </package>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.41.8" release="2.el10_1" src="buildah-1.41.8-2.el10_1.src.rpm">
          <filename>buildah-tests-1.41.8-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">85e895acf869d4065e76486418ca25ea60e15a3187fed762f4b446e3a9911f58</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3336</id>
    <title>Important: podman security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3336" id="RLSA-2026:3336" type="self" title="RLSA-2026:3336" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman-remote" arch="x86_64" epoch="7" version="5.6.0" release="12.el10_1" src="podman-5.6.0-12.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ce7a01d1c6fd9274194fb2e30f823c74bdc3c50c320292a763ecb95e0b1d1a99</sum>
        </package>
        <package name="podman" arch="x86_64" epoch="7" version="5.6.0" release="12.el10_1" src="podman-5.6.0-12.el10_1.src.rpm">
          <filename>podman-5.6.0-12.el10_1.x86_64.rpm</filename>
          <sum type="sha256">959c3a3141f194118d11d1aad559afc230989fe61af6ffc378a4748fca3626a3</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="12.el10_1" src="podman-5.6.0-12.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">2dd7bd90122e6ba9f8bd5e0acc65c7395f2d0160075dfdf770e2df9ff4cb4f41</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3343</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3343" id="RLSA-2026:3343" type="self" title="RLSA-2026:3343" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.20.0" release="3.el10_1" src="skopeo-1.20.0-3.el10_1.src.rpm">
          <filename>skopeo-tests-1.20.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">bab0f80a1af729a0cf71e4b9db0891477a65862b35e54993b06783f8c4df2406</sum>
        </package>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.20.0" release="3.el10_1" src="skopeo-1.20.0-3.el10_1.src.rpm">
          <filename>skopeo-1.20.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">04ae842d360de62f8b2124b89818c8044418148e456cbe6b693cc74bee53fe72</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3354</id>
    <title>Important: python-pyasn1 security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-pyasn1.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23490" id="CVE-2026-23490" type="cve" title="CVE-2026-23490" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430472" id="2430472" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3354" id="RLSA-2026:3354" type="self" title="RLSA-2026:3354" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-pyasn1-modules" arch="noarch" epoch="0" version="0.6.2" release="1.el10_1" src="python-pyasn1-0.6.2-1.el10_1.src.rpm">
          <filename>python3-pyasn1-modules-0.6.2-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">1c60e78956141e52bf419861d056c95bcbddda4c480f855146d603ddf86e41e1</sum>
        </package>
        <package name="python3-pyasn1" arch="noarch" epoch="0" version="0.6.2" release="1.el10_1" src="python-pyasn1-0.6.2-1.el10_1.src.rpm">
          <filename>python3-pyasn1-0.6.2-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">ce218548da8b604e37639340da121a27df8b87cc1901835fb99135a70de2dfd1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3361</id>
    <title>Important: firefox security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

* firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785)

* firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793)

* firefox: Undefined behavior in the DOM: Core &amp; HTML component (CVE-2026-2771)

* firefox: Integer overflow in the Audio/Video component (CVE-2026-2774)

* firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776)

* firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781)

* firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766)

* firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769)

* firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787)

* firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768)

* firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783)

* firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784)

* firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759)

* firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762)

* firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761)

* firefox: Privilege escalation in the Messaging System component (CVE-2026-2777)

* firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790)

* firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763)

* firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792)

* firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786)

* firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760)

* firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772)

* firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779)

* firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767)

* firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780)

* firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core &amp; HTML component (CVE-2026-2778)

* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758)

* firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791)

* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447" id="CVE-2026-2447" type="cve" title="CVE-2026-2447" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2757" id="CVE-2026-2757" type="cve" title="CVE-2026-2757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2758" id="CVE-2026-2758" type="cve" title="CVE-2026-2758" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2759" id="CVE-2026-2759" type="cve" title="CVE-2026-2759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2760" id="CVE-2026-2760" type="cve" title="CVE-2026-2760" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2761" id="CVE-2026-2761" type="cve" title="CVE-2026-2761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2762" id="CVE-2026-2762" type="cve" title="CVE-2026-2762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2763" id="CVE-2026-2763" type="cve" title="CVE-2026-2763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2764" id="CVE-2026-2764" type="cve" title="CVE-2026-2764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2765" id="CVE-2026-2765" type="cve" title="CVE-2026-2765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2766" id="CVE-2026-2766" type="cve" title="CVE-2026-2766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2767" id="CVE-2026-2767" type="cve" title="CVE-2026-2767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2768" id="CVE-2026-2768" type="cve" title="CVE-2026-2768" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2769" id="CVE-2026-2769" type="cve" title="CVE-2026-2769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2770" id="CVE-2026-2770" type="cve" title="CVE-2026-2770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2771" id="CVE-2026-2771" type="cve" title="CVE-2026-2771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2772" id="CVE-2026-2772" type="cve" title="CVE-2026-2772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2773" id="CVE-2026-2773" type="cve" title="CVE-2026-2773" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2774" id="CVE-2026-2774" type="cve" title="CVE-2026-2774" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2775" id="CVE-2026-2775" type="cve" title="CVE-2026-2775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2776" id="CVE-2026-2776" type="cve" title="CVE-2026-2776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2777" id="CVE-2026-2777" type="cve" title="CVE-2026-2777" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2778" id="CVE-2026-2778" type="cve" title="CVE-2026-2778" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2779" id="CVE-2026-2779" type="cve" title="CVE-2026-2779" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2780" id="CVE-2026-2780" type="cve" title="CVE-2026-2780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2781" id="CVE-2026-2781" type="cve" title="CVE-2026-2781" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2782" id="CVE-2026-2782" type="cve" title="CVE-2026-2782" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2783" id="CVE-2026-2783" type="cve" title="CVE-2026-2783" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2784" id="CVE-2026-2784" type="cve" title="CVE-2026-2784" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2785" id="CVE-2026-2785" type="cve" title="CVE-2026-2785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2786" id="CVE-2026-2786" type="cve" title="CVE-2026-2786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2787" id="CVE-2026-2787" type="cve" title="CVE-2026-2787" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2788" id="CVE-2026-2788" type="cve" title="CVE-2026-2788" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2789" id="CVE-2026-2789" type="cve" title="CVE-2026-2789" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2790" id="CVE-2026-2790" type="cve" title="CVE-2026-2790" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2791" id="CVE-2026-2791" type="cve" title="CVE-2026-2791" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2792" id="CVE-2026-2792" type="cve" title="CVE-2026-2792" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2793" id="CVE-2026-2793" type="cve" title="CVE-2026-2793" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442331" id="2442331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442337" id="2442337" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442322" id="2442322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442295" id="2442295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442292" id="2442292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442343" id="2442343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442290" id="2442290" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442307" id="2442307" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442316" id="2442316" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442304" id="2442304" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442328" id="2442328" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442335" id="2442335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442318" id="2442318" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442342" id="2442342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442288" id="2442288" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442325" id="2442325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442320" id="2442320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442291" id="2442291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442314" id="2442314" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442312" id="2442312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442297" id="2442297" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442324" id="2442324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442319" id="2442319" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442327" id="2442327" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442300" id="2442300" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442313" id="2442313" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442284" id="2442284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442287" id="2442287" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442308" id="2442308" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442298" id="2442298" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442294" id="2442294" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440219" id="2440219" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442333" id="2442333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442309" id="2442309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442334" id="2442334" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442329" id="2442329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442326" id="2442326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442302" id="2442302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3361" id="RLSA-2026:3361" type="self" title="RLSA-2026:3361" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.8.0" release="2.el10_1" src="firefox-140.8.0-2.el10_1.src.rpm">
          <filename>firefox-140.8.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a944bc24190bf48df069e9c11e078a5ae04773e24718bea263386cb7f608dfad</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3443</id>
    <title>Important: valkey security update</title>
    <issued date="2026-02-28 09:08:38" />
    <updated date="2026-03-14 06:06:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts (CVE-2025-67733)

* valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67733" id="CVE-2025-67733" type="cve" title="CVE-2025-67733" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21863" id="CVE-2026-21863" type="cve" title="CVE-2026-21863" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442025" id="2442025" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442026" id="2442026" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3443" id="RLSA-2026:3443" type="self" title="RLSA-2026:3443" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.7" release="1.el10_1" src="valkey-8.0.7-1.el10_1.src.rpm">
          <filename>valkey-devel-8.0.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">80335402f592eaf2a707b0e7c4aae259d8e1d8d7dafd7a013d8bd4939ef9b8c7</sum>
        </package>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.7" release="1.el10_1" src="valkey-8.0.7-1.el10_1.src.rpm">
          <filename>valkey-8.0.7-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4347ca6fa7aa18c96a78a39b6975fbdd9182d68e1184619c8b098e847879d8d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3476</id>
    <title>Important: udisks2 security update</title>
    <issued date="2026-03-05 09:12:24" />
    <updated date="2026-03-19 06:08:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for udisks2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.

Security Fix(es):

* udisks: Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API (CVE-2026-26104)

* udisks: Missing Authorization Check Allows Unprivileged Users to Restore LUKS Headers via udisks D-Bus API (CVE-2026-26103)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26103" id="CVE-2026-26103" type="cve" title="CVE-2026-26103" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26104" id="CVE-2026-26104" type="cve" title="CVE-2026-26104" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433719" id="2433719" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433717" id="2433717" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3476" id="RLSA-2026:3476" type="self" title="RLSA-2026:3476" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="udisks2" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">5dc13f37724ce55e3aa71f9f969f7ae4a53b7ea5217ef0d760efa67eac81037f</sum>
        </package>
        <package name="udisks2-iscsi" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-iscsi-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">c571842faf525f4f7c3ed1e7c262b677bb69629d5eecab7419599c72282837d2</sum>
        </package>
        <package name="udisks2-lsm" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-lsm-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">3ff722dccb439a7c683e878205491d6463a7678d7c1ea21cd4fa61f425d7a547</sum>
        </package>
        <package name="udisks2-lvm2" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-lvm2-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">93b067c439621c4fe506b46e36bba1e62693b9b231b81a1b1d1b7d69d647ccca</sum>
        </package>
        <package name="libudisks2" arch="x86_64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>libudisks2-2.10.90-6.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">7fdedfe10915f0a731e4fb51244c60438e03b9034d1eeba925beb9d0af87b6fa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3517</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-03-05 09:12:24" />
    <updated date="2026-03-19 06:08:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

* firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785)

* firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793)

* firefox: Undefined behavior in the DOM: Core &amp; HTML component (CVE-2026-2771)

* firefox: Integer overflow in the Audio/Video component (CVE-2026-2774)

* firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776)

* firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781)

* firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766)

* firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769)

* firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787)

* firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768)

* firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783)

* firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784)

* firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759)

* firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762)

* firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761)

* firefox: Privilege escalation in the Messaging System component (CVE-2026-2777)

* firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790)

* firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763)

* firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792)

* firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786)

* firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760)

* firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772)

* firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779)

* firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767)

* firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780)

* firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core &amp; HTML component (CVE-2026-2778)

* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758)

* firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791)

* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447" id="CVE-2026-2447" type="cve" title="CVE-2026-2447" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2757" id="CVE-2026-2757" type="cve" title="CVE-2026-2757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2758" id="CVE-2026-2758" type="cve" title="CVE-2026-2758" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2759" id="CVE-2026-2759" type="cve" title="CVE-2026-2759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2760" id="CVE-2026-2760" type="cve" title="CVE-2026-2760" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2761" id="CVE-2026-2761" type="cve" title="CVE-2026-2761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2762" id="CVE-2026-2762" type="cve" title="CVE-2026-2762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2763" id="CVE-2026-2763" type="cve" title="CVE-2026-2763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2764" id="CVE-2026-2764" type="cve" title="CVE-2026-2764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2765" id="CVE-2026-2765" type="cve" title="CVE-2026-2765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2766" id="CVE-2026-2766" type="cve" title="CVE-2026-2766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2767" id="CVE-2026-2767" type="cve" title="CVE-2026-2767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2768" id="CVE-2026-2768" type="cve" title="CVE-2026-2768" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2769" id="CVE-2026-2769" type="cve" title="CVE-2026-2769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2770" id="CVE-2026-2770" type="cve" title="CVE-2026-2770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2771" id="CVE-2026-2771" type="cve" title="CVE-2026-2771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2772" id="CVE-2026-2772" type="cve" title="CVE-2026-2772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2773" id="CVE-2026-2773" type="cve" title="CVE-2026-2773" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2774" id="CVE-2026-2774" type="cve" title="CVE-2026-2774" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2775" id="CVE-2026-2775" type="cve" title="CVE-2026-2775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2776" id="CVE-2026-2776" type="cve" title="CVE-2026-2776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2777" id="CVE-2026-2777" type="cve" title="CVE-2026-2777" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2778" id="CVE-2026-2778" type="cve" title="CVE-2026-2778" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2779" id="CVE-2026-2779" type="cve" title="CVE-2026-2779" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2780" id="CVE-2026-2780" type="cve" title="CVE-2026-2780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2781" id="CVE-2026-2781" type="cve" title="CVE-2026-2781" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2782" id="CVE-2026-2782" type="cve" title="CVE-2026-2782" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2783" id="CVE-2026-2783" type="cve" title="CVE-2026-2783" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2784" id="CVE-2026-2784" type="cve" title="CVE-2026-2784" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2785" id="CVE-2026-2785" type="cve" title="CVE-2026-2785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2786" id="CVE-2026-2786" type="cve" title="CVE-2026-2786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2787" id="CVE-2026-2787" type="cve" title="CVE-2026-2787" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2788" id="CVE-2026-2788" type="cve" title="CVE-2026-2788" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2789" id="CVE-2026-2789" type="cve" title="CVE-2026-2789" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2790" id="CVE-2026-2790" type="cve" title="CVE-2026-2790" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2791" id="CVE-2026-2791" type="cve" title="CVE-2026-2791" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2792" id="CVE-2026-2792" type="cve" title="CVE-2026-2792" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2793" id="CVE-2026-2793" type="cve" title="CVE-2026-2793" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442331" id="2442331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442337" id="2442337" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442322" id="2442322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442295" id="2442295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442292" id="2442292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442343" id="2442343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442290" id="2442290" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442307" id="2442307" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442316" id="2442316" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442304" id="2442304" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442328" id="2442328" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442335" id="2442335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442318" id="2442318" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442342" id="2442342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442288" id="2442288" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442325" id="2442325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442320" id="2442320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442291" id="2442291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442314" id="2442314" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442312" id="2442312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442297" id="2442297" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442324" id="2442324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442319" id="2442319" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442327" id="2442327" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442300" id="2442300" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442313" id="2442313" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442284" id="2442284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442287" id="2442287" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442308" id="2442308" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442298" id="2442298" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442294" id="2442294" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440219" id="2440219" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442333" id="2442333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442309" id="2442309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442334" id="2442334" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442329" id="2442329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442326" id="2442326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442302" id="2442302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3517" id="RLSA-2026:3517" type="self" title="RLSA-2026:3517" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.8.0" release="2.el10_1" src="thunderbird-140.8.0-2.el10_1.src.rpm">
          <filename>thunderbird-140.8.0-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b8470174fc8f00d83cf6917570f600ccf3f799d0132eb60b6c497a7bd448f707</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3669</id>
    <title>Important: go-rpm-macros security update</title>
    <issued date="2026-03-05 09:12:24" />
    <updated date="2026-03-19 06:08:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-rpm-macros.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages.  It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3669" id="RLSA-2026:3669" type="self" title="RLSA-2026:3669" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-srpm-macros" arch="noarch" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-srpm-macros-3.6.0-7.el10_1.noarch.rpm</filename>
          <sum type="sha256">fc47fdd7894de333af41c359159c250478c82358fff84549f21a5b18fb3f2448</sum>
        </package>
        <package name="go-rpm-templates" arch="x86_64" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-rpm-templates-3.6.0-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c6703a81330552b99348d8fa32f8bfab4313015b57b5b05f2945cc4e1ea407c0</sum>
        </package>
        <package name="go-filesystem" arch="x86_64" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-filesystem-3.6.0-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b7febe578e988ebec2579f4452cd4ae65fa413216a7fc676fe5d9ad8c123ac9a</sum>
        </package>
        <package name="go-rpm-macros" arch="x86_64" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-rpm-macros-3.6.0-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8fef469c81e67e0cb7f45ee19d94cb76804da84790a4c71de329a4fb27520b7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4164</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-03-11 12:08:24" />
    <updated date="2026-03-25 12:11:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4164" id="RLSA-2026:4164" type="self" title="RLSA-2026:4164" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git-lfs" arch="x86_64" epoch="0" version="3.6.1" release="7.el10_1" src="git-lfs-3.6.1-7.el10_1.src.rpm">
          <filename>git-lfs-3.6.1-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">befdf1a94e2bea7adf98bbe5da2326b60e9027cb5716b7ca2b2d18a1a96b8693</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4629</id>
    <title>Important: libvpx security update</title>
    <issued date="2026-03-17 12:07:50" />
    <updated date="2026-03-31 12:09:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libvpx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447" id="CVE-2026-2447" type="cve" title="CVE-2026-2447" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440219" id="2440219" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4629" id="RLSA-2026:4629" type="self" title="RLSA-2026:4629" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libvpx" arch="x86_64" epoch="0" version="1.14.1" release="6.el10_1" src="libvpx-1.14.1-6.el10_1.src.rpm">
          <filename>libvpx-1.14.1-6.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c1f3df9da63f18b383962c7c3af74e8098a0bd0426b1b79f61ab939c55e80276</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3864</id>
    <title>Important: delve security update</title>
    <issued date="2026-03-07 12:07:41" />
    <updated date="2026-03-21 12:09:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3864" id="RLSA-2026:3864" type="self" title="RLSA-2026:3864" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.25.2" release="2.el10_1" src="delve-1.25.2-2.el10_1.src.rpm">
          <filename>delve-1.25.2-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7b6c422f73a96b10a57ccfc7c6b1717484b4d44220609af825f8eea3536cdca7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3887</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-03-06 06:05:39" />
    <updated date="2026-03-20 06:07:20" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)

* postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)

* postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439326" id="2439326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439324" id="2439324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439325" id="2439325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439322" id="2439322" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3887" id="RLSA-2026:3887" type="self" title="RLSA-2026:3887" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postgresql-upgrade" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">bbaa940c2772c32ab0d8f9aba06946b5b3240dd92a4465fe116791fb9464643c</sum>
        </package>
        <package name="postgresql-pltcl" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-pltcl-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f1148225856b3a23c615ac3353637f376dc5f722b5ffe0b55f9836097dc7248c</sum>
        </package>
        <package name="postgresql-contrib" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-contrib-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e3db43a735eeb2dc9d338884656f564572c46054ca194bce2bebbab209feae5c</sum>
        </package>
        <package name="postgresql-server-devel" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-devel-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ecc05602fbd70b728d5650dbe55ebef287e198d7e14ded1c5dea917c305e3e24</sum>
        </package>
        <package name="postgresql-server" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d6016a2a5606030f1d91f9ca8b6f6702f01298e165f30ae80f0562b9562050f2</sum>
        </package>
        <package name="postgresql-private-devel" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-devel-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ac082bb70390f1a58feb81e556ebd34ded9b73bcffeba8e4fb7b6f346e4d1d23</sum>
        </package>
        <package name="postgresql-private-libs" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-libs-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b7f5141db1187e4c9c3b31f6a063b767c1351750ab19b942c005177bec91ee79</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-devel-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b8e915b2f81e3d4162a0af085764f10dbf7275b34786b6b1c4a0c5f887efc655</sum>
        </package>
        <package name="postgresql-docs" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-docs-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">dc6c0ea794ef7caad8e64b534461785279963853bce3dd17aa614685ddc8143e</sum>
        </package>
        <package name="postgresql-test" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-test-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c8ff7236899a608a19742e89f157b3c954b5325ec6e98693c30fb874292ce4f1</sum>
        </package>
        <package name="postgresql-plpython3" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plpython3-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4d206b98eacba4020c3afb216f927dc9cb6a3510c90f6de3309abfbf18b927dc</sum>
        </package>
        <package name="postgresql-plperl" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plperl-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b7e62f6de8b1072d727098bacc7c0821f54717e8d6edcc102750f438978ffa5e</sum>
        </package>
        <package name="postgresql" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">eb97f78910abd34961a6832e0caa67d88313db86a4061df178de114b696a905f</sum>
        </package>
        <package name="postgresql-static" arch="x86_64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-static-16.13-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">588f6e8ba3097e363bc170fe8fc744eaf01ddf2d1d2bd73408da34f5f48e29ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4705</id>
    <title>Moderate: nginx security update</title>
    <issued date="2026-03-27 12:07:50" />
    <updated date="2026-04-10 12:09:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1642" id="CVE-2026-1642" type="cve" title="CVE-2026-1642" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2436738" id="2436738" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4705" id="RLSA-2026:4705" type="self" title="RLSA-2026:4705" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nginx" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">498543a275456947be44f55d91f4a06047e0b315e9babf0f83817609d02e20d6</sum>
        </package>
        <package name="nginx-mod-mail" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-mail-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">07c352330fcff14c16ce2d2ce941ba37aa55f0f49833af2b7e782879d5821b22</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7e76cb403bcead9e42662d15999bcab1c66179ad64017b63fa73723f038944ef</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0383e8dc3d9471b59e4ef12b15bbe16d7b8232c6df14089f7a22561743d18119</sum>
        </package>
        <package name="nginx-mod-stream" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-stream-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7c3cf19faae15b1d48bdc52b22af825cd8f1f2ae2ac6b24a7dd4edc7191a87e3</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-filesystem-1.26.3-2.el10_1.noarch.rpm</filename>
          <sum type="sha256">2e48093d794898fb1642f0bb71e0ef1f0e0e446a3654319b193ad44620e105ff</sum>
        </package>
        <package name="nginx-core" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-core-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1b527fb832d44e1d1365949c5c0068f8f2c2cb676ea39cdd6de92188196d15c1</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b47594564200ef32425618098e855b8c03f8233bd88b8b204a9dc7b0d7478961</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-all-modules-1.26.3-2.el10_1.noarch.rpm</filename>
          <sum type="sha256">181b674c0cd77cd494499242f41b59c06a0b49baa0cbdc38f09807c1f0e6723d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5145</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-03-27 12:07:50" />
    <updated date="2026-04-10 12:09:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5145" id="RLSA-2026:5145" type="self" title="RLSA-2026:5145" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="x86_64" epoch="0" version="0.2.3" release="4.el10_1" src="yggdrasil-worker-package-manager-0.2.3-4.el10_1.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">db4f7c1cd0b9a3d113bdba1d47dc1d65ed1830f99098871388e57e5910f0bd86</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5146</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-03-27 12:07:50" />
    <updated date="2026-04-10 12:09:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5146" id="RLSA-2026:5146" type="self" title="RLSA-2026:5146" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.8" release="3.el10_1" src="yggdrasil-0.4.8-3.el10_1.src.rpm">
          <filename>yggdrasil-0.4.8-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">eae31e27a9f8352c1d22812af68894c4a727dbe93ad56514c040921b47cbef98</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7672</id>
    <title>Important: firefox security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5731" id="CVE-2026-5731" type="cve" title="CVE-2026-5731" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5732" id="CVE-2026-5732" type="cve" title="CVE-2026-5732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5734" id="CVE-2026-5734" type="cve" title="CVE-2026-5734" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451819" id="2451819" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455897" id="2455897" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451805" id="2451805" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455908" id="2455908" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455901" id="2455901" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7672" id="RLSA-2026:7672" type="self" title="RLSA-2026:7672" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.9.1" release="1.el10_1" src="firefox-140.9.1-1.el10_1.src.rpm">
          <filename>firefox-140.9.1-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">53a351ec7ba6fb02ea2a8f44630cfe2a3b0c17c5290d5fdd4bc5ed3c8650e4b4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7680</id>
    <title>Important: perl-XML-Parser security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-XML-Parser.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.

Security Fix(es):

* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)

* perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-10002" id="CVE-2006-10002" type="cve" title="CVE-2006-10002" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-10003" id="CVE-2006-10003" type="cve" title="CVE-2006-10003" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448999" id="2448999" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449001" id="2449001" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7680" id="RLSA-2026:7680" type="self" title="RLSA-2026:7680" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl-XML-Parser" arch="x86_64" epoch="0" version="2.47" release="6.1.el10_1" src="perl-XML-Parser-2.47-6.1.el10_1.src.rpm">
          <filename>perl-XML-Parser-2.47-6.1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8b9b2cc50b1414f0433b7bff1145914ea93609204d8e5585f66c215699559e43</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7675</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs denial of service (CVE-2026-21637)

* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)

* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1525" id="CVE-2026-1525" type="cve" title="CVE-2026-1525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1526" id="CVE-2026-1526" type="cve" title="CVE-2026-1526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1527" id="CVE-2026-1527" type="cve" title="CVE-2026-1527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1528" id="CVE-2026-1528" type="cve" title="CVE-2026-1528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21637" id="CVE-2026-21637" type="cve" title="CVE-2026-21637" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21710" id="CVE-2026-21710" type="cve" title="CVE-2026-21710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21711" id="CVE-2026-21711" type="cve" title="CVE-2026-21711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21712" id="CVE-2026-21712" type="cve" title="CVE-2026-21712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21713" id="CVE-2026-21713" type="cve" title="CVE-2026-21713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21714" id="CVE-2026-21714" type="cve" title="CVE-2026-21714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21715" id="CVE-2026-21715" type="cve" title="CVE-2026-21715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21716" id="CVE-2026-21716" type="cve" title="CVE-2026-21716" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21717" id="CVE-2026-21717" type="cve" title="CVE-2026-21717" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2229" id="CVE-2026-2229" type="cve" title="CVE-2026-2229" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25547" id="CVE-2026-25547" type="cve" title="CVE-2026-25547" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2581" id="CVE-2026-2581" type="cve" title="CVE-2026-2581" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26996" id="CVE-2026-26996" type="cve" title="CVE-2026-26996" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135" id="CVE-2026-27135" type="cve" title="CVE-2026-27135" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453162" id="2453162" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447142" id="2447142" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453160" id="2453160" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447144" id="2447144" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447140" id="2447140" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453161" id="2453161" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2436942" id="2436942" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453151" id="2453151" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453037" id="2453037" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447141" id="2447141" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453158" id="2453158" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453157" id="2453157" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453152" id="2453152" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2441268" id="2441268" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448754" id="2448754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447143" id="2447143" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431340" id="2431340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447145" id="2447145" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7675" id="RLSA-2026:7675" type="self" title="RLSA-2026:7675" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-docs-24.14.1-2.el10_1.noarch.rpm</filename>
          <sum type="sha256">ddbec5004cc902972469c329b9376ecdba0d2394339a57df343f4248be51ac78</sum>
        </package>
        <package name="nodejs24" arch="x86_64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-24.14.1-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3ea0442ac2a1c70225619edcdf2baa1f66a5182e6294b07fddf24502f521bd1a</sum>
        </package>
        <package name="nodejs24-full-i18n" arch="x86_64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-full-i18n-24.14.1-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">617f0071ab2f72b3126fea27cd5e552a4b9a22a62501226d5ed5ac1764ab8130</sum>
        </package>
        <package name="nodejs24-libs" arch="x86_64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-libs-24.14.1-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a7f881bbbcc89d0faa07d5400fbfb03b2ae7c496001371ab489d45ec55706651</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.11.0" release="1.24.14.1.2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-npm-11.11.0-1.24.14.1.2.el10_1.noarch.rpm</filename>
          <sum type="sha256">efc7fe76818e6134795e26544413a2fd735ad8ffeca272117f0111c64d2c261e</sum>
        </package>
        <package name="nodejs24-devel" arch="x86_64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-devel-24.14.1-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">95753691d020186b7c170bc5c9f09e9bb37cdd6910d65bd07cbaf271da34fd7b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7992</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7992" id="RLSA-2026:7992" type="self" title="RLSA-2026:7992" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="5.el10_1.1" src="golang-github-openprinting-ipp-usb-0.9.27-5.el10_1.1.src.rpm">
          <filename>ipp-usb-0.9.27-5.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">a3ebe131ce135985565081b4fee48048494ba3328d151288947a2dd0c28e8327</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8119</id>
    <title>Important: squid security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for squid.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

* squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

* Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32748" id="CVE-2026-32748" type="cve" title="CVE-2026-32748" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33526" id="CVE-2026-33526" type="cve" title="CVE-2026-33526" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451574" id="2451574" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451577" id="2451577" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8119" id="RLSA-2026:8119" type="self" title="RLSA-2026:8119" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="squid" arch="x86_64" epoch="7" version="6.10" release="6.el10_1.3" src="squid-6.10-6.el10_1.3.src.rpm">
          <filename>squid-6.10-6.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">763138e0e2444c03ab5a4ad5577fdfb84e68072b2f4d17b66d1200f01209cc8f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7005</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-04-10 12:07:15" />
    <updated date="2026-04-24 12:08:46" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7005" id="RLSA-2026:7005" type="self" title="RLSA-2026:7005" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git-lfs" arch="x86_64" epoch="0" version="3.6.1" release="8.el10_1" src="git-lfs-3.6.1-8.el10_1.src.rpm">
          <filename>git-lfs-3.6.1-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2b02d8dd609037e80537836e7d5ef59c1b2ce4fe00aa542b4fa00a761dd0fccb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7081</id>
    <title>Moderate: libtiff security update</title>
    <issued date="2026-04-10 12:07:15" />
    <updated date="2026-04-24 12:08:46" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52356" id="CVE-2023-52356" type="cve" title="CVE-2023-52356" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2251344" id="2251344" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7081" id="RLSA-2026:7081" type="self" title="RLSA-2026:7081" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libtiff-devel" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_1.2" src="libtiff-4.6.0-6.el10_1.2.src.rpm">
          <filename>libtiff-devel-4.6.0-6.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">04b7a8384c51c5d75101faf4c45c431851df9368c5a427baaf31f50d365264c4</sum>
        </package>
        <package name="libtiff" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_1.2" src="libtiff-4.6.0-6.el10_1.2.src.rpm">
          <filename>libtiff-4.6.0-6.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">302809a69a6284cd0180931d77630946f02b4367bc0e699326cf27db21250bef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8458</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)

* FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33983" id="CVE-2026-33983" type="cve" title="CVE-2026-33983" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33984" id="CVE-2026-33984" type="cve" title="CVE-2026-33984" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453220" id="2453220" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453219" id="2453219" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8458" id="RLSA-2026:8458" type="self" title="RLSA-2026:8458" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.6" src="freerdp-3.10.3-5.el10_1.6.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">363b55da5e419d351630d496025056474887cf6528b0416db1eebdbdc6fabe50</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.6" src="freerdp-3.10.3-5.el10_1.6.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">3c07fca37360dd31324266b21c3f16f629b43a7397c006f85d8c68f93300d92b</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.6" src="freerdp-3.10.3-5.el10_1.6.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.6.x86_64.rpm</filename>
          <sum type="sha256">ad5789e2e76dc6a35cf14a2651e81d9262a6f88a58fb08f038f2e548a30f1686</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8470</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

* dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

* dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

* dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26171" id="CVE-2026-26171" type="cve" title="CVE-2026-26171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32178" id="CVE-2026-32178" type="cve" title="CVE-2026-32178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32203" id="CVE-2026-32203" type="cve" title="CVE-2026-32203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33116" id="CVE-2026-33116" type="cve" title="CVE-2026-33116" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457741" id="2457741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457740" id="2457740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457781" id="2457781" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457739" id="2457739" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8470" id="RLSA-2026:8470" type="self" title="RLSA-2026:8470" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f5e3982c5d4ec31d3cc1eacb947a01dfd602e9358507bce70cb0f3d7501e7059</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.126" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-templates-8.0-8.0.126-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">52216ae8036e30f9b33cfe752b54243f115bb15b44a1e7be50d884c686956b36</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.126" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.126-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5291d2cc1ced34c876258b3a9c1f5c3e82eb54f85da39259b7bad6f17cc41840</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.126" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.126-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7b7c5ee7e93d601b469ed7ab5201d7868e5e6a7af551bf61c4b30ffaac818ad2</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">fead6c44a9095936b89bd0fdbc207c531e0b7737716bf5a71b498a3c4c5d7ad8</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">63612640084f3fff4281cee5fead84f44e91999bfbf9973a0a494815ea5d3260</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a3ffa06a0f80981dd03ebd103dee942a10472be2341e5f62406e58c3f6b52e6c</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5e27786ae6ff01c6673eb46845bf43523b556e17b42464c8eb5c029c2135a06b</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a42c047b2f5743d8a78a5fa6e47b3070a03664f7604017e9ada1ee11cb04bb22</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e152c979546075d6df91bb97830a3aaff0bf759034ab30e3a11d66ec22eb5036</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.26-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3544b3fb7738a981ddc4d121d86152947e45cbdfb6e5c66517f98b244e1c33fd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5931</id>
    <title>Important: firefox security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

* firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

* firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)

* firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

* firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

* firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)

* firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)

* firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

* firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4684" id="CVE-2026-4684" type="cve" title="CVE-2026-4684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4685" id="CVE-2026-4685" type="cve" title="CVE-2026-4685" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4686" id="CVE-2026-4686" type="cve" title="CVE-2026-4686" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4687" id="CVE-2026-4687" type="cve" title="CVE-2026-4687" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4688" id="CVE-2026-4688" type="cve" title="CVE-2026-4688" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4689" id="CVE-2026-4689" type="cve" title="CVE-2026-4689" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4690" id="CVE-2026-4690" type="cve" title="CVE-2026-4690" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4691" id="CVE-2026-4691" type="cve" title="CVE-2026-4691" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4692" id="CVE-2026-4692" type="cve" title="CVE-2026-4692" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4693" id="CVE-2026-4693" type="cve" title="CVE-2026-4693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4694" id="CVE-2026-4694" type="cve" title="CVE-2026-4694" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4695" id="CVE-2026-4695" type="cve" title="CVE-2026-4695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4696" id="CVE-2026-4696" type="cve" title="CVE-2026-4696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4697" id="CVE-2026-4697" type="cve" title="CVE-2026-4697" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4698" id="CVE-2026-4698" type="cve" title="CVE-2026-4698" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4699" id="CVE-2026-4699" type="cve" title="CVE-2026-4699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4700" id="CVE-2026-4700" type="cve" title="CVE-2026-4700" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4701" id="CVE-2026-4701" type="cve" title="CVE-2026-4701" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4702" id="CVE-2026-4702" type="cve" title="CVE-2026-4702" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4704" id="CVE-2026-4704" type="cve" title="CVE-2026-4704" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4705" id="CVE-2026-4705" type="cve" title="CVE-2026-4705" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4706" id="CVE-2026-4706" type="cve" title="CVE-2026-4706" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4707" id="CVE-2026-4707" type="cve" title="CVE-2026-4707" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4708" id="CVE-2026-4708" type="cve" title="CVE-2026-4708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4709" id="CVE-2026-4709" type="cve" title="CVE-2026-4709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4710" id="CVE-2026-4710" type="cve" title="CVE-2026-4710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4711" id="CVE-2026-4711" type="cve" title="CVE-2026-4711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4712" id="CVE-2026-4712" type="cve" title="CVE-2026-4712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4713" id="CVE-2026-4713" type="cve" title="CVE-2026-4713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4714" id="CVE-2026-4714" type="cve" title="CVE-2026-4714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4715" id="CVE-2026-4715" type="cve" title="CVE-2026-4715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4716" id="CVE-2026-4716" type="cve" title="CVE-2026-4716" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4717" id="CVE-2026-4717" type="cve" title="CVE-2026-4717" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4718" id="CVE-2026-4718" type="cve" title="CVE-2026-4718" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4719" id="CVE-2026-4719" type="cve" title="CVE-2026-4719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4720" id="CVE-2026-4720" type="cve" title="CVE-2026-4720" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4721" id="CVE-2026-4721" type="cve" title="CVE-2026-4721" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450733" id="2450733" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450741" id="2450741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450744" id="2450744" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450752" id="2450752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450747" id="2450747" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450738" id="2450738" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450710" id="2450710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450755" id="2450755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450725" id="2450725" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450739" id="2450739" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450726" id="2450726" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450714" id="2450714" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450727" id="2450727" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450723" id="2450723" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450724" id="2450724" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450734" id="2450734" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450748" id="2450748" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450757" id="2450757" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450730" id="2450730" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450713" id="2450713" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450711" id="2450711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450719" id="2450719" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450729" id="2450729" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450722" id="2450722" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450720" id="2450720" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450712" id="2450712" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450718" id="2450718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450751" id="2450751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450735" id="2450735" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450721" id="2450721" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450715" id="2450715" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450732" id="2450732" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450742" id="2450742" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450746" id="2450746" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450756" id="2450756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450740" id="2450740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450728" id="2450728" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5931" id="RLSA-2026:5931" type="self" title="RLSA-2026:5931" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.9.0" release="1.el10_1" src="firefox-140.9.0-1.el10_1.src.rpm">
          <filename>firefox-140.9.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9d315f7df09caa192229ca640859f9ed48b8ac59db82ec0f2c70c15a4c2074a9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5941</id>
    <title>Important: golang security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61731" id="CVE-2025-61731" type="cve" title="CVE-2025-61731" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434433" id="2434433" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5941" id="RLSA-2026:5941" type="self" title="RLSA-2026:5941" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">fc8f1a185cef97ab179b3b1477bf13405134c6388c1ed1be6bda5f9d4d816926</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-1.25.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">69af4d4d301da0021c57721594129ba0b6197de366743e26d5d4cc75a3eafe11</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-race-1.25.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">50271359e86ee3f4af7190e19491ebe0ead2c0fb1df2966a8ae9f8bb956fd6ef</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">827d2ee8ef54c00bb4f8440cdcfb6108a00df6f0131c46153600b63e90f61903</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.8-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5241e0d9bf410d518e2b0d6117ef492dad4d53497567cee2904641372f98df04</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">db3ff67272fcaf8c30871aa3c5e138379325eaf9acb04905b84eb2e7ed68db4b</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">fc08056daced4942367d12f1740d6eb3537d643175a8a7a443a4ea76dc5195e4</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-src-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e5958f50c1ecb5d498b5fd89b07951b2dc97e9b4f8975f25537fb7f9a97136be</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6259</id>
    <title>Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-plugins-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

* GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)

* GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)

* GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)

* GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2920" id="CVE-2026-2920" type="cve" title="CVE-2026-2920" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2921" id="CVE-2026-2921" type="cve" title="CVE-2026-2921" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2922" id="CVE-2026-2922" type="cve" title="CVE-2026-2922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2923" id="CVE-2026-2923" type="cve" title="CVE-2026-2923" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3082" id="CVE-2026-3082" type="cve" title="CVE-2026-3082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3083" id="CVE-2026-3083" type="cve" title="CVE-2026-3083" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3085" id="CVE-2026-3085" type="cve" title="CVE-2026-3085" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447496" id="2447496" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447492" id="2447492" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447495" id="2447495" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447498" id="2447498" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447503" id="2447503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447490" id="2447490" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447500" id="2447500" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6259" id="RLSA-2026:6259" type="self" title="RLSA-2026:6259" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-ugly-free" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-ugly-free-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">90fee47f4214e4bc8a1a2027625606ead4449f22005364886760c3f5c42aa7eb</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="x86_64" epoch="0" version="1.24.11" release="3.el10_1" src="gstreamer1-plugins-bad-free-1.24.11-3.el10_1.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.24.11-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">502a66251cb8bcf1bd9fbaa5d878bdc2ff1c936874db0a22d841f44d69cd6b0d</sum>
        </package>
        <package name="gstreamer1-plugins-base-devel" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-base-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-base-devel-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">09eb997ea0c338c5069eb170470b98ca68b089b7b8140dfd2dabe333214ac2f5</sum>
        </package>
        <package name="gstreamer1-plugins-good" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-good-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-good-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e80ee1ee49716047f7f3e5413252bcb67a0eae9a3fa2f4e254a00981a376cb4e</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" arch="x86_64" epoch="0" version="1.24.11" release="3.el10_1" src="gstreamer1-plugins-bad-free-1.24.11-3.el10_1.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.24.11-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a7c2239b0b54705286b844f858f36631729bd710fe8e00ba9e8a7f8b74afab3e</sum>
        </package>
        <package name="gstreamer1-plugins-base-tools" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-base-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-base-tools-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">78e512e12338b4febe1ab9013f7ffc9da7cb6e773863f8d4ba08ae0de18f42f7</sum>
        </package>
        <package name="gstreamer1-plugins-base" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-base-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-base-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">20c08a993e6067492ba945d8e85ecd6b9a351a010ec12bde66a69bea88422d51</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-good-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.24.11-2.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d0a354e36f6a6683568ee8e38fabcb9e39524420f83bcf02d07c550276a9cda6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6342</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

* firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

* firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)

* firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

* firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

* firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)

* firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)

* firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

* firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)

* thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371)

* thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3889" id="CVE-2026-3889" type="cve" title="CVE-2026-3889" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4371" id="CVE-2026-4371" type="cve" title="CVE-2026-4371" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4684" id="CVE-2026-4684" type="cve" title="CVE-2026-4684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4685" id="CVE-2026-4685" type="cve" title="CVE-2026-4685" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4686" id="CVE-2026-4686" type="cve" title="CVE-2026-4686" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4687" id="CVE-2026-4687" type="cve" title="CVE-2026-4687" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4688" id="CVE-2026-4688" type="cve" title="CVE-2026-4688" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4689" id="CVE-2026-4689" type="cve" title="CVE-2026-4689" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4690" id="CVE-2026-4690" type="cve" title="CVE-2026-4690" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4691" id="CVE-2026-4691" type="cve" title="CVE-2026-4691" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4692" id="CVE-2026-4692" type="cve" title="CVE-2026-4692" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4693" id="CVE-2026-4693" type="cve" title="CVE-2026-4693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4694" id="CVE-2026-4694" type="cve" title="CVE-2026-4694" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4695" id="CVE-2026-4695" type="cve" title="CVE-2026-4695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4696" id="CVE-2026-4696" type="cve" title="CVE-2026-4696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4697" id="CVE-2026-4697" type="cve" title="CVE-2026-4697" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4698" id="CVE-2026-4698" type="cve" title="CVE-2026-4698" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4699" id="CVE-2026-4699" type="cve" title="CVE-2026-4699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4700" id="CVE-2026-4700" type="cve" title="CVE-2026-4700" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4701" id="CVE-2026-4701" type="cve" title="CVE-2026-4701" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4702" id="CVE-2026-4702" type="cve" title="CVE-2026-4702" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4704" id="CVE-2026-4704" type="cve" title="CVE-2026-4704" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4705" id="CVE-2026-4705" type="cve" title="CVE-2026-4705" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4706" id="CVE-2026-4706" type="cve" title="CVE-2026-4706" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4707" id="CVE-2026-4707" type="cve" title="CVE-2026-4707" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4708" id="CVE-2026-4708" type="cve" title="CVE-2026-4708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4709" id="CVE-2026-4709" type="cve" title="CVE-2026-4709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4710" id="CVE-2026-4710" type="cve" title="CVE-2026-4710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4711" id="CVE-2026-4711" type="cve" title="CVE-2026-4711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4712" id="CVE-2026-4712" type="cve" title="CVE-2026-4712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4713" id="CVE-2026-4713" type="cve" title="CVE-2026-4713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4714" id="CVE-2026-4714" type="cve" title="CVE-2026-4714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4715" id="CVE-2026-4715" type="cve" title="CVE-2026-4715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4716" id="CVE-2026-4716" type="cve" title="CVE-2026-4716" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4717" id="CVE-2026-4717" type="cve" title="CVE-2026-4717" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4718" id="CVE-2026-4718" type="cve" title="CVE-2026-4718" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4719" id="CVE-2026-4719" type="cve" title="CVE-2026-4719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4720" id="CVE-2026-4720" type="cve" title="CVE-2026-4720" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4721" id="CVE-2026-4721" type="cve" title="CVE-2026-4721" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450733" id="2450733" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450741" id="2450741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450744" id="2450744" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450752" id="2450752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450747" id="2450747" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450738" id="2450738" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450710" id="2450710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450755" id="2450755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450725" id="2450725" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450739" id="2450739" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450726" id="2450726" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450714" id="2450714" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450727" id="2450727" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450723" id="2450723" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450724" id="2450724" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451006" id="2451006" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450734" id="2450734" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450748" id="2450748" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450757" id="2450757" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450730" id="2450730" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450713" id="2450713" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450711" id="2450711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450719" id="2450719" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451001" id="2451001" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450729" id="2450729" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450722" id="2450722" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450720" id="2450720" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450712" id="2450712" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450718" id="2450718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450751" id="2450751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450735" id="2450735" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450721" id="2450721" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450715" id="2450715" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450732" id="2450732" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450742" id="2450742" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450746" id="2450746" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450756" id="2450756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450740" id="2450740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450728" id="2450728" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6342" id="RLSA-2026:6342" type="self" title="RLSA-2026:6342" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.9.0" release="1.el10_1" src="thunderbird-140.9.0-1.el10_1.src.rpm">
          <filename>thunderbird-140.9.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">53bb93ccdb6a0cb7c4fd1e5f109b2b708161a4d43b43d3d0b67f778bed72afbc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6344</id>
    <title>Important: grafana security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6344" id="RLSA-2026:6344" type="self" title="RLSA-2026:6344" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="23.el10_1" src="grafana-10.2.6-23.el10_1.src.rpm">
          <filename>grafana-10.2.6-23.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8f56a2763097d7692750dbd4720fcd8c811010d92087c88c9dc6068bd5bfb34c</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="23.el10_1" src="grafana-10.2.6-23.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-23.el10_1.x86_64.rpm</filename>
          <sum type="sha256">778cf1846d17b188d22265bda24b939736b11841b0610d48edd6a47387e109a2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6388</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6388" id="RLSA-2026:6388" type="self" title="RLSA-2026:6388" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-pcp" arch="x86_64" epoch="0" version="5.3.0" release="3.el10_1" src="grafana-pcp-5.3.0-3.el10_1.src.rpm">
          <filename>grafana-pcp-5.3.0-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3144a6f761221f9db3fbc8f8c1f07eee48ad86f335b6f78eccafc7dcb083b08b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6622</id>
    <title>Moderate: crun security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for crun.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>crun is a OCI runtime

Security Fix(es):

* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30892" id="CVE-2026-30892" type="cve" title="CVE-2026-30892" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451576" id="2451576" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6622" id="RLSA-2026:6622" type="self" title="RLSA-2026:6622" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="crun" arch="x86_64" epoch="0" version="1.27" release="1.el10_1" src="crun-1.27-1.el10_1.src.rpm">
          <filename>crun-1.27-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ac79b86cee5d368e4bf60f16e4fc49bc93dd0c749abee1c5ebc17637e7e76e07</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6799</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

* freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

* freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

* freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

* freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

* freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

* freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

* freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free (CVE-2026-24682)

* freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)

* freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

* freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

* freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages (CVE-2026-31806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22852" id="CVE-2026-22852" type="cve" title="CVE-2026-22852" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22854" id="CVE-2026-22854" type="cve" title="CVE-2026-22854" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22856" id="CVE-2026-22856" type="cve" title="CVE-2026-22856" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23732" id="CVE-2026-23732" type="cve" title="CVE-2026-23732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23948" id="CVE-2026-23948" type="cve" title="CVE-2026-23948" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24491" id="CVE-2026-24491" type="cve" title="CVE-2026-24491" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24675" id="CVE-2026-24675" type="cve" title="CVE-2026-24675" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24676" id="CVE-2026-24676" type="cve" title="CVE-2026-24676" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24679" id="CVE-2026-24679" type="cve" title="CVE-2026-24679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24681" id="CVE-2026-24681" type="cve" title="CVE-2026-24681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24682" id="CVE-2026-24682" type="cve" title="CVE-2026-24682" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24683" id="CVE-2026-24683" type="cve" title="CVE-2026-24683" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24684" id="CVE-2026-24684" type="cve" title="CVE-2026-24684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31806" id="CVE-2026-31806" type="cve" title="CVE-2026-31806" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438207" id="2438207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429652" id="2429652" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438217" id="2438217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429654" id="2429654" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438216" id="2438216" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430881" id="2430881" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438202" id="2438202" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438221" id="2438221" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447376" id="2447376" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429650" id="2429650" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438201" id="2438201" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438212" id="2438212" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438210" id="2438210" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438208" id="2438208" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6799" id="RLSA-2026:6799" type="self" title="RLSA-2026:6799" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.5" src="freerdp-3.10.3-5.el10_1.5.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">2de810860042c9a2f41676c3a270d76cf06611eca85f950e4275764889533b25</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.5" src="freerdp-3.10.3-5.el10_1.5.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">b89356db455451566de063e3e47c2a33b55ba5eb5b471ed4aeb976dab5ea24b2</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.5" src="freerdp-3.10.3-5.el10_1.5.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">efe0451f4af8e2d642bb31585bdbb46b8bb48f5d9df5f30bfae35436f18e71a7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6817</id>
    <title>Important: capstone security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for capstone.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community.

Security Fix(es):

* capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114)

* capstone: Capstone: Heap buffer overflow via skipdata callback allows denial of service or arbitrary code execution. (CVE-2025-67873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67873" id="CVE-2025-67873" type="cve" title="CVE-2025-67873" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68114" id="CVE-2025-68114" type="cve" title="CVE-2025-68114" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2423416" id="2423416" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2423419" id="2423419" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6817" id="RLSA-2026:6817" type="self" title="RLSA-2026:6817" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="capstone" arch="x86_64" epoch="0" version="5.0.1" release="7.el10_1" src="capstone-5.0.1-7.el10_1.src.rpm">
          <filename>capstone-5.0.1-7.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e21f3fbdf6e92358d088550c3c0cc6cd342195a0eb8015c7b81bb83a3584937f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6906</id>
    <title>Important: nginx security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647)

* NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654)

* NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784)

* NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27651" id="CVE-2026-27651" type="cve" title="CVE-2026-27651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27654" id="CVE-2026-27654" type="cve" title="CVE-2026-27654" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27784" id="CVE-2026-27784" type="cve" title="CVE-2026-27784" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32647" id="CVE-2026-32647" type="cve" title="CVE-2026-32647" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450776" id="2450776" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450791" id="2450791" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449598" id="2449598" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450785" id="2450785" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6906" id="RLSA-2026:6906" type="self" title="RLSA-2026:6906" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-all-modules-1.26.3-2.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">0cf5d43356d16886e4f7d968b477fef07cda8f308e07da83bcade0af8a691d45</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">6e52dc6fea20ae093c3d1c8e23bc1de226169e7e2b3d6016c3d0b04663ce2860</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-filesystem-1.26.3-2.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">945bf06d1fdc8c45505929a01d6b1ef0a0341bd292a4a118850bbf05d3acdb66</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">27a12413889bb7d05f520fe84d6ea22cdcbebed01e0144e20160261b78e84982</sum>
        </package>
        <package name="nginx-mod-mail" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-mail-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">d1e241b974a5798c1892a36cf96fe7142f6519d70c68f75c8fde4fec4002ffa5</sum>
        </package>
        <package name="nginx-core" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-core-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">80289b3c7bbdd94d85ead32ecf669e6b2acc27b5358f286c11a17018b575ae9f</sum>
        </package>
        <package name="nginx" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">fda291c600c12078980ca21966f06dd73d7b3b7414605b0e965c385df733be11</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">fe486b24c97e86f356e587d0a928b423812879188438f74b3548e0ad9d4107ab</sum>
        </package>
        <package name="nginx-mod-stream" arch="x86_64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-stream-1.26.3-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">57afb80b63a8716c15f32c50663e46c93df1496d769c5534239a41df2dd6c1c6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7682</id>
    <title>Important: openexr security update</title>
    <issued date="2026-04-16 18:06:57" />
    <updated date="2026-04-30 18:08:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openexr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.

Security Fix(es):

* openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27622" id="CVE-2026-27622" type="cve" title="CVE-2026-27622" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2444251" id="2444251" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7682" id="RLSA-2026:7682" type="self" title="RLSA-2026:7682" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="openexr-libs" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_1.1" src="openexr-3.1.10-8.el10_1.1.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">67220e04bec910a9a7732bbb733ca2ce360bba0d6219dc72d45a2332c0240550</sum>
        </package>
        <package name="openexr" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_1.1" src="openexr-3.1.10-8.el10_1.1.src.rpm">
          <filename>openexr-3.1.10-8.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">05c23288d0ff65964479f28a7edfaf4cb216ba694ddf55a7c87aa01002f6539c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8312</id>
    <title>Important: bind security update</title>
    <issued date="2026-04-16 18:06:57" />
    <updated date="2026-04-30 18:08:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for bind.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1519" id="CVE-2026-1519" type="cve" title="CVE-2026-1519" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451305" id="2451305" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8312" id="RLSA-2026:8312" type="self" title="RLSA-2026:8312" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="bind-utils" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-utils-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">ac86f2a4a6e7e028c6b5098ba2a21fba8e0c71e1568107283e910007ad5d1eba</sum>
        </package>
        <package name="bind-chroot" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-chroot-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">8df2f0cd9ba313a30ed97fe5468122888e9325d7fa522d0b673029db442d5f45</sum>
        </package>
        <package name="bind-libs" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-libs-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">e4b199c1d6bab99a907b28ae7d9c5c55c4a0f868abd54f400912792e0e55b06f</sum>
        </package>
        <package name="bind-license" arch="noarch" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-license-9.18.33-10.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">90e75203bd53bc0e6581db642fb9c148b0b20799bcb7cb181ba24b59c5d16611</sum>
        </package>
        <package name="bind" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">fc64b91c2a3de06eb13b0ad15690553a83ac02239bd505067205f18d6b6feb57</sum>
        </package>
        <package name="bind-dnssec-utils" arch="x86_64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-10.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">d65186db2fe4d5cf636d5e23cdb3a69284faefbba849c18276f9f22124b5bd8a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8472</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.116 and .NET Runtime 9.0.15.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

* dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

* dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

* dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26171" id="CVE-2026-26171" type="cve" title="CVE-2026-26171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32178" id="CVE-2026-32178" type="cve" title="CVE-2026-32178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32203" id="CVE-2026-32203" type="cve" title="CVE-2026-32203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33116" id="CVE-2026-33116" type="cve" title="CVE-2026-33116" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457741" id="2457741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457740" id="2457740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457781" id="2457781" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457739" id="2457739" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8472" id="RLSA-2026:8472" type="self" title="RLSA-2026:8472" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0c7c008020216c0c590678da0c8e661e1c2c1c757f1a01904ed6961bd685489c</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">27e88fb3f909f23bf8233c6aa72071412a38bea4bad5e9781b8f8804f1f49311</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f8db1719b903133d9bbc1eaf255dea47c1557465e3117fbc10cb0a8aac7f645b</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">667539593e8f48bf8023d97ec91c51875d733b40682ff2882801fec7bf37c883</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-templates-9.0-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">aab29daedf806babe3b9ded8e24bd36e072a97d1115c15c7444cdd9004c473bd</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">25642b8fe93d10b9b95eb122aa125cb3814ec82352acaa2507c2e6f142cb6599</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9c688d6890da7960e1ec15a320b4a6c53fcaf50691745f530799f50c0d6b0af1</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">194de292b0b71a7699683a25db28b8cff23796e4a0cf951fc9cb49fc749b520d</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">bc6d920012d806f17e8c3bc384d34c65d175525403cc7785a8f7f9a661509cf5</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">67695a190787bdfb9812192c8be1e2f610cbe19453fe2adccd12d1090e3cb625</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1b12256decf40558cf142712a7162b2ecb1b10d37df170c9a629ed087c25b2ea</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.116-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4bdb94b80db20f0239b97e2f23af695c4a3260135c847055fbb4bae243710ea8</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.15-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a85690dbe864f01dcfff2bb1ad8c6cb6e3aae78dde838b3a68f3dc2003d9b332</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8467</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.106 and .NET Runtime 10.0.6.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

* dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

* dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

* dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26171" id="CVE-2026-26171" type="cve" title="CVE-2026-26171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32178" id="CVE-2026-32178" type="cve" title="CVE-2026-32178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32203" id="CVE-2026-32203" type="cve" title="CVE-2026-32203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33116" id="CVE-2026-33116" type="cve" title="CVE-2026-33116" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457741" id="2457741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457740" id="2457740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457781" id="2457781" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457739" id="2457739" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8467" id="RLSA-2026:8467" type="self" title="RLSA-2026:8467" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dotnet-sdk-dbg-10.0" arch="x86_64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.106-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c975355736c293630ff24a2fd1f6004bba422b065ea149b670dc2deaf93c8763</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="x86_64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.106-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">90f0169cb3385b9fc4ef0acd0de4a31e2cf137ea6efc9e9ef84ff696f3da9358</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">aaa56b12495b5d84ad00c59efd710673ebd61994efe7ae0d3f2f495e5616f815</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="x86_64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-templates-10.0-10.0.106-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">fe8eb4b92c3262cf354832f22aa48914b85d2c8e37a4fc18405846c874320876</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-host-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">f4e8f52851edc851ca2576237b06a6c1fbbf2c31af9c97c20d11f2f1f8a7b166</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">b271c72018f14bf9e762ab5c2daff4a466f9c3ba95f363356f58e3da25e6d8ca</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2cb5f0346350271b3065f3a2a9f3533de4ea6ef45222ed26d26eb23bdef856eb</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e5cc179f7d1a84aa7464acb2ce68284289464718286d6b5f73df30a29377c32d</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9fa0d633ae68a13ecf55b3f995fd9bb42cea848f459993f3537a368f3d0a11a0</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e91090e6fd45464499ef7c0d706ca82c0d908821f3642826a991f9c65c9a77f1</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="x86_64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.106-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d859fc6728101c26d3ff140765e4aa2a0cf057130795466ace5d0f3c01efb5fc</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">98845113e93174af0f535405d1c2c97729269db0d639c7cd0469a2c50d6f0451</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="x86_64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.6-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c6b575eb13e86ba0b221c43b94a933c1344386f0ae7fe3f6f94dc149e1eed645</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8840</id>
    <title>Important: go-rpm-macros security update</title>
    <issued date="2026-04-21 12:07:14" />
    <updated date="2026-05-05 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-rpm-macros.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages.  It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8840" id="RLSA-2026:8840" type="self" title="RLSA-2026:8840" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-filesystem" arch="x86_64" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-filesystem-3.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0b24e4faa5a5b201bd6edd0c36089b55c17aef60e91bf00ecf06657ac3514611</sum>
        </package>
        <package name="go-srpm-macros" arch="noarch" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-srpm-macros-3.6.0-8.el10_1.noarch.rpm</filename>
          <sum type="sha256">ff881959d3210ef017fb6dd6a8a138c214d341f70d7e38f34fd4adb6efd956c7</sum>
        </package>
        <package name="go-rpm-macros" arch="x86_64" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-rpm-macros-3.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">524ff43725bc80b68d12eed61311d711796bc9b9c6ab56d8d3d730a2a106aff2</sum>
        </package>
        <package name="go-rpm-templates" arch="x86_64" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-rpm-templates-3.6.0-8.el10_1.x86_64.rpm</filename>
          <sum type="sha256">7e8f6698e0495cdc9ad87f2804f934a42b8f73ad086ef1d762764b3ce444d327</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8842</id>
    <title>Important: delve security update</title>
    <issued date="2026-04-21 12:07:14" />
    <updated date="2026-05-05 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445345" id="2445345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8842" id="RLSA-2026:8842" type="self" title="RLSA-2026:8842" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.25.2" release="3.el10_1" src="delve-1.25.2-3.el10_1.src.rpm">
          <filename>delve-1.25.2-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">90a75f6099678ecea3a66581b553f6557fcd6536b93013bd4cd90b7fa63ef0b3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8858</id>
    <title>Important: giflib security update</title>
    <issued date="2026-04-21 12:07:14" />
    <updated date="2026-05-05 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for giflib.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>giflib is a library for reading and writing gif images.

Security Fix(es):

* giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23868" id="CVE-2026-23868" type="cve" title="CVE-2026-23868" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446207" id="2446207" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8858" id="RLSA-2026:8858" type="self" title="RLSA-2026:8858" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="giflib" arch="x86_64" epoch="0" version="5.2.1" release="22.el10_1.1" src="giflib-5.2.1-22.el10_1.1.src.rpm">
          <filename>giflib-5.2.1-22.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">1f45ccfa0cb24d080d7d158827acf1f06164a7b039602c49d06d8f0e56f218a6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7080</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-04-12 06:07:10" />
    <updated date="2026-04-26 06:08:43" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1525" id="CVE-2026-1525" type="cve" title="CVE-2026-1525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1526" id="CVE-2026-1526" type="cve" title="CVE-2026-1526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1528" id="CVE-2026-1528" type="cve" title="CVE-2026-1528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21710" id="CVE-2026-21710" type="cve" title="CVE-2026-21710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2229" id="CVE-2026-2229" type="cve" title="CVE-2026-2229" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25547" id="CVE-2026-25547" type="cve" title="CVE-2026-25547" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26996" id="CVE-2026-26996" type="cve" title="CVE-2026-26996" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135" id="CVE-2026-27135" type="cve" title="CVE-2026-27135" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27904" id="CVE-2026-27904" type="cve" title="CVE-2026-27904" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447142" id="2447142" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442922" id="2442922" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447144" id="2447144" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2441268" id="2441268" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448754" id="2448754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447143" id="2447143" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2436942" id="2436942" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453151" id="2453151" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447145" id="2447145" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7080" id="RLSA-2026:7080" type="self" title="RLSA-2026:7080" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs-full-i18n" arch="x86_64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-full-i18n-22.22.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">58e629ba81ffd6a5d457b2bee67655476ec695261f872e5f39f8fc379b2ab360</sum>
        </package>
        <package name="nodejs" arch="x86_64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-22.22.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">8cc93ca6e9f77b9fa1dced29c06824e43b31587ee68d932d6ba2110e47c19cf3</sum>
        </package>
        <package name="nodejs-devel" arch="x86_64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-devel-22.22.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4eb5f45ee4eea040c529847310f859c4389cce8049a4ffcd2a150723b932663a</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-docs-22.22.2-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">fa500ed62f11dffa01482db76251ee423b1cabe3ae9f406e6630204b7aa3949c</sum>
        </package>
        <package name="nodejs-npm" arch="x86_64" epoch="1" version="10.9.7" release="1.22.22.2.1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-npm-10.9.7-1.22.22.2.1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">de5fd7ffd391052023dbe0386a72d1fd14b9a910ddfc776c5fe8c741c4e96df4</sum>
        </package>
        <package name="nodejs-libs" arch="x86_64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-libs-22.22.2-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4f5627252bf9fe1e51273e59ff3b5c5010201ffe8fbf73de7d122a10484c8de8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10223</id>
    <title>Important: grafana security update</title>
    <issued date="2026-04-28 12:06:44" />
    <updated date="2026-05-12 12:09:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27877" id="CVE-2026-27877" type="cve" title="CVE-2026-27877" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452293" id="2452293" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10223" id="RLSA-2026:10223" type="self" title="RLSA-2026:10223" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="24.el10_1" src="grafana-10.2.6-24.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-24.el10_1.x86_64.rpm</filename>
          <sum type="sha256">1d587dfc3c9dc75297f2ce8947b49a7eb3344e7829a785750a8566359f9a79e2</sum>
        </package>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="24.el10_1" src="grafana-10.2.6-24.el10_1.src.rpm">
          <filename>grafana-10.2.6-24.el10_1.x86_64.rpm</filename>
          <sum type="sha256">378c0773c41fbc1272a2966ea98df6b921eb5671d1f75283c46da2893525dd70</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10707</id>
    <title>Important: gdk-pixbuf2 security update</title>
    <issued date="2026-04-28 12:06:44" />
    <updated date="2026-05-12 12:09:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gdk-pixbuf2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.

Security Fix(es):

* gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5201" id="CVE-2026-5201" type="cve" title="CVE-2026-5201" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453291" id="2453291" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10707" id="RLSA-2026:10707" type="self" title="RLSA-2026:10707" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gdk-pixbuf2" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">0f10e2b54827459dc8d4d0c0a5b693c99f30fe993618d13fc9f6c1c49aa29204</sum>
        </package>
        <package name="gdk-pixbuf2-modules" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">de5a7450e05a6ac80992886ef49a286abe72c5ac2df44a62b236faed2052c073</sum>
        </package>
        <package name="gdk-pixbuf2-devel" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_1.5.x86_64.rpm</filename>
          <sum type="sha256">ec62d18124f5b9275b7439732fc4088d82d0b7a90e38003089c482403315cdd2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10767</id>
    <title>Important: firefox security update</title>
    <issued date="2026-04-28 12:06:44" />
    <updated date="2026-05-12 12:09:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

* firefox: thunderbird: Spoofing issue in the DOM: Core &amp; HTML component (CVE-2026-6762)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

* firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

* firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

* firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

* firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

* firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)

* firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

* firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

* firefox: thunderbird: Use-after-free in the DOM: Core &amp; HTML component (CVE-2026-6746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6746" id="CVE-2026-6746" type="cve" title="CVE-2026-6746" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6747" id="CVE-2026-6747" type="cve" title="CVE-2026-6747" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6748" id="CVE-2026-6748" type="cve" title="CVE-2026-6748" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6749" id="CVE-2026-6749" type="cve" title="CVE-2026-6749" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6750" id="CVE-2026-6750" type="cve" title="CVE-2026-6750" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6751" id="CVE-2026-6751" type="cve" title="CVE-2026-6751" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6752" id="CVE-2026-6752" type="cve" title="CVE-2026-6752" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6753" id="CVE-2026-6753" type="cve" title="CVE-2026-6753" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6754" id="CVE-2026-6754" type="cve" title="CVE-2026-6754" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6757" id="CVE-2026-6757" type="cve" title="CVE-2026-6757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6759" id="CVE-2026-6759" type="cve" title="CVE-2026-6759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6761" id="CVE-2026-6761" type="cve" title="CVE-2026-6761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6762" id="CVE-2026-6762" type="cve" title="CVE-2026-6762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6763" id="CVE-2026-6763" type="cve" title="CVE-2026-6763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6764" id="CVE-2026-6764" type="cve" title="CVE-2026-6764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6765" id="CVE-2026-6765" type="cve" title="CVE-2026-6765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6766" id="CVE-2026-6766" type="cve" title="CVE-2026-6766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6767" id="CVE-2026-6767" type="cve" title="CVE-2026-6767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6769" id="CVE-2026-6769" type="cve" title="CVE-2026-6769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6770" id="CVE-2026-6770" type="cve" title="CVE-2026-6770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6771" id="CVE-2026-6771" type="cve" title="CVE-2026-6771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6772" id="CVE-2026-6772" type="cve" title="CVE-2026-6772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6776" id="CVE-2026-6776" type="cve" title="CVE-2026-6776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6785" id="CVE-2026-6785" type="cve" title="CVE-2026-6785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6786" id="CVE-2026-6786" type="cve" title="CVE-2026-6786" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460109" id="2460109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460112" id="2460112" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460076" id="2460076" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460075" id="2460075" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460086" id="2460086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460104" id="2460104" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460099" id="2460099" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460106" id="2460106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460094" id="2460094" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460088" id="2460088" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460105" id="2460105" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460101" id="2460101" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460092" id="2460092" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460107" id="2460107" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460079" id="2460079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460097" id="2460097" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460078" id="2460078" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460096" id="2460096" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460085" id="2460085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460095" id="2460095" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460102" id="2460102" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460108" id="2460108" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460074" id="2460074" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460110" id="2460110" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460103" id="2460103" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10767" id="RLSA-2026:10767" type="self" title="RLSA-2026:10767" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.10.0" release="1.el10_1" src="firefox-140.10.0-1.el10_1.src.rpm">
          <filename>firefox-140.10.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">9cbee92b756eb0536bc0d9ba28c77ca9dac9f05be9a9337560691a9555e81844</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:9638</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-04-24 12:06:29" />
    <updated date="2026-05-08 12:09:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5731" id="CVE-2026-5731" type="cve" title="CVE-2026-5731" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5732" id="CVE-2026-5732" type="cve" title="CVE-2026-5732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5734" id="CVE-2026-5734" type="cve" title="CVE-2026-5734" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451819" id="2451819" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455897" id="2455897" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451805" id="2451805" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455908" id="2455908" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455901" id="2455901" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:9638" id="RLSA-2026:9638" type="self" title="RLSA-2026:9638" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.9.1" release="1.el10_1" src="thunderbird-140.9.1-1.el10_1.src.rpm">
          <filename>thunderbird-140.9.1-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">3d4ecd88bb9a95f975e28829475f7c15d32f0f7b4fb1d5e9497c5a22bd3fa88e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:9666</id>
    <title>Moderate: wireshark security update</title>
    <issued date="2026-04-24 12:06:29" />
    <updated date="2026-05-08 12:09:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Buffer Over-read in Wireshark (CVE-2026-3203)

* wireshark: Improperly Controlled Sequential Memory Allocation in Wireshark (CVE-2026-3201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3201" id="CVE-2026-3201" type="cve" title="CVE-2026-3201" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3203" id="CVE-2026-3203" type="cve" title="CVE-2026-3203" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442639" id="2442639" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442641" id="2442641" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:9666" id="RLSA-2026:9666" type="self" title="RLSA-2026:9666" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="wireshark" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.4" src="wireshark-4.4.2-4.el10_1.4.src.rpm">
          <filename>wireshark-4.4.2-4.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">b416fa143f93d81aaa12c3ca589ad57f77985458bdf11d6671fcaae59ec01e30</sum>
        </package>
        <package name="wireshark-cli" arch="x86_64" epoch="1" version="4.4.2" release="4.el10_1.4" src="wireshark-4.4.2-4.el10_1.4.src.rpm">
          <filename>wireshark-cli-4.4.2-4.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">b5c40b0d6899158a8bcc0bfd477b0c07f7c6f78be404853be7c91bc578aa80d9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11352</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)

* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)

* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999" id="CVE-2026-33999" type="cve" title="CVE-2026-33999" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001" id="CVE-2026-34001" type="cve" title="CVE-2026-34001" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003" id="CVE-2026-34003" type="cve" title="CVE-2026-34003" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451106" id="2451106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451109" id="2451109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451113" id="2451113" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11352" id="RLSA-2026:11352" type="self" title="RLSA-2026:11352" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="x86_64" epoch="0" version="24.1.5" release="6.el10_1" src="xorg-x11-server-Xwayland-24.1.5-6.el10_1.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-6.el10_1.x86_64.rpm</filename>
          <sum type="sha256">2773b6f4f548e184215b454d564c7b4c1d0ceb7f2a14b836b59712bd912aaf52</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11412</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11412" id="RLSA-2026:11412" type="self" title="RLSA-2026:11412" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="x86_64" epoch="0" version="0.2.3" release="5.el10_1" src="yggdrasil-worker-package-manager-0.2.3-5.el10_1.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-5.el10_1.x86_64.rpm</filename>
          <sum type="sha256">a5bf4faee56bfb43ae7e1496caad25d997f8d22957769284250b5fad8b190a8a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11413</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11413" id="RLSA-2026:11413" type="self" title="RLSA-2026:11413" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.8" release="4.el10_1" src="yggdrasil-0.4.8-4.el10_1.src.rpm">
          <filename>yggdrasil-0.4.8-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">301f3dde22e7cfb6f410c85a21194367458c4ac23972c691898051eae3149048</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:12265</id>
    <title>Important: libtiff security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4775" id="CVE-2026-4775" type="cve" title="CVE-2026-4775" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450768" id="2450768" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:12265" id="RLSA-2026:12265" type="self" title="RLSA-2026:12265" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libtiff-devel" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_1.3" src="libtiff-4.6.0-6.el10_1.3.src.rpm">
          <filename>libtiff-devel-4.6.0-6.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">8d58c22ff69659212b8263e3819e712375fcf3311e2fa1f8c917fdf20cb80c23</sum>
        </package>
        <package name="libtiff" arch="x86_64" epoch="0" version="4.6.0" release="6.el10_1.3" src="libtiff-4.6.0-6.el10_1.3.src.rpm">
          <filename>libtiff-4.6.0-6.el10_1.3.x86_64.rpm</filename>
          <sum type="sha256">1d765509d1db530e4f0a24fe7c84e300ac08ab30e08318ef3e77841ab54a47fe</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10217</id>
    <title>Important: golang security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

* cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140)

* golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27140" id="CVE-2026-27140" type="cve" title="CVE-2026-27140" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27143" id="CVE-2026-27143" type="cve" title="CVE-2026-27143" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27144" id="CVE-2026-27144" type="cve" title="CVE-2026-27144" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456341" id="2456341" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456340" id="2456340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456342" id="2456342" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10217" id="RLSA-2026:10217" type="self" title="RLSA-2026:10217" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>go-toolset-1.25.9-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0b72fef1b0adb0b8c083ca2bc340f234a08cf12025a96940ab6abf3d38e041e5</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-src-1.25.9-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">c8b2050f6299348f527c137cbaaa7506f9b75b3ab33aa4774466bfb457992552</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-docs-1.25.9-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">d8753380e42606a0653d181ffc42dc2d495e83274148de2507dc155cd7479389</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-1.25.9-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">d11ef07c488d717b67d6afcd6d105206bbba04a0f77682e29bc67fe9cdbd34be</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-misc-1.25.9-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">c558ade72ee5699903008d671f4a6085cff226e0b1ae13bdf4166fd411199d09</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-tests-1.25.9-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">f72d0bbd4d6733ded6f92f86b84d8263eea767ec20aca905e01ad00dc4f77c42</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-bin-1.25.9-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0f81147626b4f4519534dcd7dc06a7388b815b41b0052a09ec24498c8e214032</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-race-1.25.9-3.el10_1.x86_64.rpm</filename>
          <sum type="sha256">5c1ad077142b578af8ca3b2fe5483275430dfd9b0e1e1cc40aa60f1e4dc40966</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11712</id>
    <title>Important: grafana security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11712" id="RLSA-2026:11712" type="self" title="RLSA-2026:11712" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="25.el10_1" src="grafana-10.2.6-25.el10_1.src.rpm">
          <filename>grafana-10.2.6-25.el10_1.x86_64.rpm</filename>
          <sum type="sha256">0a851e7a14e0db4c8552161dc46495f34adfc723b5f8693ecc952fc227e6186a</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="25.el10_1" src="grafana-10.2.6-25.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-25.el10_1.x86_64.rpm</filename>
          <sum type="sha256">14a8d98876f454fd2ae2487b19bb712d8db59b814b4c8c9aaf64d5cd204a4371</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11881</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11881" id="RLSA-2026:11881" type="self" title="RLSA-2026:11881" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-pcp" arch="x86_64" epoch="0" version="5.3.0" release="4.el10_1" src="grafana-pcp-5.3.0-4.el10_1.src.rpm">
          <filename>grafana-pcp-5.3.0-4.el10_1.x86_64.rpm</filename>
          <sum type="sha256">e629e1e89931581586db2cfad9f1971af054fbbafab1b6669f5d5360ab7d4931</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13498</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dovecot.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. 

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)

* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59032" id="CVE-2025-59032" type="cve" title="CVE-2025-59032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27857" id="CVE-2026-27857" type="cve" title="CVE-2026-27857" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27858" id="CVE-2026-27858" type="cve" title="CVE-2026-27858" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452175" id="2452175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452179" id="2452179" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452172" id="2452172" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13498" id="RLSA-2026:13498" type="self" title="RLSA-2026:13498" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="dovecot-pigeonhole" arch="x86_64" epoch="1" version="2.3.21" release="16.el10_1.1" src="dovecot-2.3.21-16.el10_1.1.src.rpm">
          <filename>dovecot-pigeonhole-2.3.21-16.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">22d7b94ec2063211bf21e43744b88f3a50c4c2e2a6a929d38d4c8db1670a78e4</sum>
        </package>
        <package name="dovecot" arch="x86_64" epoch="1" version="2.3.21" release="16.el10_1.1" src="dovecot-2.3.21-16.el10_1.1.src.rpm">
          <filename>dovecot-2.3.21-16.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">a4e5f5616cb971c30be88578dcb238a8164193dd208007e85576dd4976348252</sum>
        </package>
        <package name="dovecot-mysql" arch="x86_64" epoch="1" version="2.3.21" release="16.el10_1.1" src="dovecot-2.3.21-16.el10_1.1.src.rpm">
          <filename>dovecot-mysql-2.3.21-16.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">d3de000723aad22e006e94b07ebd506193bc59fe560c9dbda368da7b17ca84bf</sum>
        </package>
        <package name="dovecot-pgsql" arch="x86_64" epoch="1" version="2.3.21" release="16.el10_1.1" src="dovecot-2.3.21-16.el10_1.1.src.rpm">
          <filename>dovecot-pgsql-2.3.21-16.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">4e125164e56f67537642418d75e8ac5e0f0dec95fd57205442b600d0e36b2716</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13515</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freeipmi.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.

Security Fix(es):

* freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33554" id="CVE-2026-33554" type="cve" title="CVE-2026-33554" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450778" id="2450778" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13515" id="RLSA-2026:13515" type="self" title="RLSA-2026:13515" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freeipmi-ipmidetectd" arch="x86_64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-ipmidetectd-1.6.17-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">4b466bba50319c478e7bededa2f5dec95050e64b4443ffe7ce009ade563c0522</sum>
        </package>
        <package name="freeipmi" arch="x86_64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-1.6.17-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">ed8ea06e7e73615c3bf4e92edebd9dc0d7e0c9b0c8fa8bd99a8496b573975438</sum>
        </package>
        <package name="freeipmi-bmc-watchdog" arch="x86_64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-bmc-watchdog-1.6.17-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">56fc51540800512cf3152f00a8367af46ee5eb56160abda903b6a0479740d3f5</sum>
        </package>
        <package name="freeipmi-ipmiseld" arch="x86_64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-ipmiseld-1.6.17-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c499c00f4aaf8175ef4743a78434c524b5cf77d1eff09e87a58fa52f086752ac</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13641</id>
    <title>Moderate: python-tornado security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for python-tornado.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31958" id="CVE-2026-31958" type="cve" title="CVE-2026-31958" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35536" id="CVE-2026-35536" type="cve" title="CVE-2026-35536" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2454716" id="2454716" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446765" id="2446765" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13641" id="RLSA-2026:13641" type="self" title="RLSA-2026:13641" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-tornado" arch="x86_64" epoch="0" version="6.5.5" release="1.el10_1.1" src="python-tornado-6.5.5-1.el10_1.1.src.rpm">
          <filename>python3-tornado-6.5.5-1.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">0dbba37952b979e3e36e80ff671a9af7c16ad7a732854526c84e0a9c5a34aa4c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13644</id>
    <title>Moderate: corosync security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for corosync.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.

Security Fix(es):

* corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)

* corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35091" id="CVE-2026-35091" type="cve" title="CVE-2026-35091" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35092" id="CVE-2026-35092" type="cve" title="CVE-2026-35092" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453814" id="2453814" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453813" id="2453813" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13644" id="RLSA-2026:13644" type="self" title="RLSA-2026:13644" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="corosynclib" arch="x86_64" epoch="0" version="3.1.9" release="2.el10_1.1" src="corosync-3.1.9-2.el10_1.1.src.rpm">
          <filename>corosynclib-3.1.9-2.el10_1.1.x86_64.rpm</filename>
          <sum type="sha256">b2f2f70927ccab0630bbc1f7769754b30e4327bcdc3a8705212cb4f1de7632cd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:12285</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-05-07 12:06:53" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

* firefox: thunderbird: Spoofing issue in the DOM: Core &amp; HTML component (CVE-2026-6762)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

* firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

* firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

* firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

* firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

* firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)

* firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

* firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

* firefox: thunderbird: Use-after-free in the DOM: Core &amp; HTML component (CVE-2026-6746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6746" id="CVE-2026-6746" type="cve" title="CVE-2026-6746" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6747" id="CVE-2026-6747" type="cve" title="CVE-2026-6747" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6748" id="CVE-2026-6748" type="cve" title="CVE-2026-6748" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6749" id="CVE-2026-6749" type="cve" title="CVE-2026-6749" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6750" id="CVE-2026-6750" type="cve" title="CVE-2026-6750" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6751" id="CVE-2026-6751" type="cve" title="CVE-2026-6751" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6752" id="CVE-2026-6752" type="cve" title="CVE-2026-6752" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6753" id="CVE-2026-6753" type="cve" title="CVE-2026-6753" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6754" id="CVE-2026-6754" type="cve" title="CVE-2026-6754" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6757" id="CVE-2026-6757" type="cve" title="CVE-2026-6757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6759" id="CVE-2026-6759" type="cve" title="CVE-2026-6759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6761" id="CVE-2026-6761" type="cve" title="CVE-2026-6761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6762" id="CVE-2026-6762" type="cve" title="CVE-2026-6762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6763" id="CVE-2026-6763" type="cve" title="CVE-2026-6763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6764" id="CVE-2026-6764" type="cve" title="CVE-2026-6764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6765" id="CVE-2026-6765" type="cve" title="CVE-2026-6765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6766" id="CVE-2026-6766" type="cve" title="CVE-2026-6766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6767" id="CVE-2026-6767" type="cve" title="CVE-2026-6767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6769" id="CVE-2026-6769" type="cve" title="CVE-2026-6769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6770" id="CVE-2026-6770" type="cve" title="CVE-2026-6770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6771" id="CVE-2026-6771" type="cve" title="CVE-2026-6771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6772" id="CVE-2026-6772" type="cve" title="CVE-2026-6772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6776" id="CVE-2026-6776" type="cve" title="CVE-2026-6776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6785" id="CVE-2026-6785" type="cve" title="CVE-2026-6785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6786" id="CVE-2026-6786" type="cve" title="CVE-2026-6786" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460109" id="2460109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460112" id="2460112" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460076" id="2460076" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460075" id="2460075" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460086" id="2460086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460104" id="2460104" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460099" id="2460099" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460106" id="2460106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460094" id="2460094" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460088" id="2460088" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460105" id="2460105" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460101" id="2460101" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460092" id="2460092" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460107" id="2460107" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460079" id="2460079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460097" id="2460097" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460078" id="2460078" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460096" id="2460096" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460085" id="2460085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460095" id="2460095" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460102" id="2460102" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460108" id="2460108" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460074" id="2460074" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460110" id="2460110" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460103" id="2460103" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:12285" id="RLSA-2026:12285" type="self" title="RLSA-2026:12285" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.10.0" release="1.el10_1" src="thunderbird-140.10.0-1.el10_1.src.rpm">
          <filename>thunderbird-140.10.0-1.el10_1.x86_64.rpm</filename>
          <sum type="sha256">c56aef091d8ab54d5522e8fadc00473b99d6d479ffac3e6ef8edb0f2bf31896d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13916</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-05-07 12:06:53" />
    <updated date="2026-05-14 06:09:16" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

* pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30922" id="CVE-2026-30922" type="cve" title="CVE-2026-30922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32597" id="CVE-2026-32597" type="cve" title="CVE-2026-32597" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448553" id="2448553" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447194" id="2447194" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13916" id="RLSA-2026:13916" type="self" title="RLSA-2026:13916" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="fence-virtd-libvirt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-libvirt-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">fb4e6b75469a906eefa7bd3d653c941693d8344141a556a2535e895eff0e5a15</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-lpar-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">981ff44f226405eca95e6de80f296cd96e6d1b4aa44e2add42962d867cb76720</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">f2ef46ed7dcc733ea9b38e016f831a1b135f2893c60d14eb562e4e4a6da73d17</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">1fab49a737ba68c2d3077e671b149205440fa5382d881d812652b39ef6b47329</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-rsa-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">1490f943d5a44cf0007134f184c9795fcd14ebe6b5ad11944a9af07dabaf36b2</sum>
        </package>
        <package name="fence-agents-aws" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-aws-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">7d469bca8834b7c4d161a6fad56bbc19dbb297369e57e4dd2fd0e61987e92b21</sum>
        </package>
        <package name="fence-virtd-serial" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-serial-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">a63d74935705bcf6eeceacb34495da459cf6aea612fe5c87089d4e8dbadf464c</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">5bae7f51f65347a95f2ecfbf3966ede1047342b13c1a13328f4d43de4fcbf5db</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">f1777031e8cc51d50ad0e0c15ea32088bfae61dcffc4936d5497504cdbe6fa90</sum>
        </package>
        <package name="fence-agents-common" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-common-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">b0d99066aaecb88bcbd1f7969764bf83fe8b5d6c7c085d52b75de432c641c326</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">e6a389f09ec2978e64f892d7503d2a80e3754d02607463515c891bedabd045f5</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-mpath-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9061470a51469ddd08a181189747e894f7bda0c5588ba853bc0eaf8e232043b8</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-eps-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">2ced8e456e9e92ffb16fb6294dc77efaac9063b8ed4f54b81036530016a12580</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">10df6b8aa47e2444576424418b573fc242cee671365a867baf0db20901ecf06b</sum>
        </package>
        <package name="fence-agents-azure-arm" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-azure-arm-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">ec0e32b0e1d8fa4467927f91639cf074bbf2a9cdc9f624e1e5cedbf2db9e94bc</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9cd6497f78ad316d505950136f9ea2c06b462d6aefed93419db61fcc71cf08d9</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">38c924f9968238922e30064aae6be6e51fed28f09160e5e919a55d9ab2284b93</sum>
        </package>
        <package name="fence-agents-aliyun" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-aliyun-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">8f50d15317190913281165cb75681808c2abf931f80414f067cca075cce91e59</sum>
        </package>
        <package name="fence-virtd-multicast" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-multicast-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">fc53e4d84eff596107d78d9fae525d51806a8fbfd15ce3e92c7c7742a527b383</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">021df5b65d9523b053bcde8500aa3c8bffdb5c64f58dfb164d14f106d66a8d62</sum>
        </package>
        <package name="fence-agents-all" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-all-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">ff83d5ab9dec375cf4385a31dfe7c912e242c42c43fd7a376d0aef669381322c</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9f506bf9b726167aa665206b4108b5e96cfac636aa2257e564101fbdfbab0d94</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-wti-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">fabd7b4f7ae8f35f1643de268e666997d841520ae6e47c3f8474ff482519bca8</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">bb36d6d3accb87981f37038b330011c9986a995cf600eaf8c77ca5d465cd26cd</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">ce7d9b7547f3dd857702ca013289e8bc6f32a1da6a9e2b81b51894eb244ee3ae</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-brocade-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">32eebe0a7a2388ca850db416e3c36f580449aa1ae55217d89a5a58fe50d5c674</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">e5cf28ffff5766813020949d9fef4b6ce4bcc4873a6aa44b7543492b4097fb95</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">4bf67a266a26a0b3d5b6de075c81b4464003b7d594504d7522f00dc3aaf35a37</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">aafb5992aacf5cf9009ab898c89b53b347970fb1f53ce8d33a04f8519e061fd3</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">0271eadca27a8a77590ab8bc06935fa8700ae773e690963bbae3a5bda3fa828e</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-rsb-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">16b0e55ce0217b852ebe2ab9e0cf4049885644b34d6b393d0e51ec256f868da1</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-apc-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">8251bb5b72d1d2e816ac108fc3acec1eb97f954d8a69f0c89c291e58c5185bc0</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-drac5-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9ef0494a9ce4c3a8d62e0bf9fac7aae830d07b51223e49cbb494f60d0cea40ed</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-emerson-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">3488879b0d9eb2daaa441ea673f2dd6581e56a43cdb35f72122e89d9fe1b3dc7</sum>
        </package>
        <package name="fence-agents-gce" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-gce-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">a78056774c49199077a37a87016ff15bc1d6df6171ca7c95adec6ec897866344</sum>
        </package>
        <package name="fence-agents-redfish" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-redfish-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">928d27053cc8789437a700ea1474e702bbb2915f85b4216bc780b6c4413a6421</sum>
        </package>
        <package name="fence-virt" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virt-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">08f1dc1f449f4458b77dc8fec9b8121b70efad0d1836261c13c1244aa31f9dab</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">0c4374f6d9e78fab3292eaf0d0e7cac5d07715b39f22ae7a8cdcaabbb8caa449</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-virsh-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">81b8f85345b49f128204ba2b7746efe3225b3d21154dc4f2c5f93cf485a25f9b</sum>
        </package>
        <package name="fence-virtd-tcp" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-tcp-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">9cf961c8c3b8a009f63534a47c35dc50ced6380a7df9a4825f102f7f7f57c1bd</sum>
        </package>
        <package name="fence-virtd" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">7193111dd76aa50b08a639c17e2267149d29c450e0b09783b5d78ebd557d4557</sum>
        </package>
        <package name="fence-agents-kdump" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-kdump-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">f48566127b8587be8f307636295c3459e49f8512dc0240293b8442e92d6708d0</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">7bcdbce5f15b9018f580617c5fa053b9430e36e42ba8fc35bf9dca753587d6db</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">020b810f275075663aac2863fd6723eb956aa61c4d9de642304064457a1374a2</sum>
        </package>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">f15d108229f811d4c04d1d82bacdd9fbd217c5781080057dafbbe8786fe58b20</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">b893c4330a530902ba09aee58d5814639d4a162d9454ea4bc9e778fe8d301846</sum>
        </package>
        <package name="fence-virtd-cpg" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-virtd-cpg-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">b5950530183471ec4c987272e4ded11f28f9ea1ba9623f74f150224893cd31bd</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">96e28b353c60bf7c8196aedcf938f3479458df1f39c735abd70a1aae2a214c27</sum>
        </package>
        <package name="ha-cloud-support" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>ha-cloud-support-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">d1ad7d466384a5660a90d13fb5d10985ea7e220d869ea6f559447bbd8092f554</sum>
        </package>
        <package name="fence-agents-openstack" arch="x86_64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-openstack-4.16.0-13.el10_1.4.x86_64.rpm</filename>
          <sum type="sha256">a8d5991126e9346358e51f0bb607f82d00c860ad6591c1948ca28a672d810472</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">5e77f44c1f102777aab4827a4df540d381444cc562272fc62eddcd978081f201</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-scsi-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">5f2cc5c2b757a06f976d74b6e33911904380286ab62827cb364f56e6d626b212</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-sbd-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">7df0ffe235bc1349d7945fa8bb51e6e464e6eeb32910d9eaea3b4d0ff3870c54</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:16014</id>
    <title>Moderate: freerdp security update</title>
    <issued date="2026-05-13 12:06:54" />
    <updated date="2026-05-14 06:09:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)

* freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

* freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

* freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

* freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

* freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

* freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

* FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

* FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982)

* FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25952" id="CVE-2026-25952" type="cve" title="CVE-2026-25952" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25997" id="CVE-2026-25997" type="cve" title="CVE-2026-25997" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26986" id="CVE-2026-26986" type="cve" title="CVE-2026-26986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29775" id="CVE-2026-29775" type="cve" title="CVE-2026-29775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31883" id="CVE-2026-31883" type="cve" title="CVE-2026-31883" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31884" id="CVE-2026-31884" type="cve" title="CVE-2026-31884" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31885" id="CVE-2026-31885" type="cve" title="CVE-2026-31885" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33982" id="CVE-2026-33982" type="cve" title="CVE-2026-33982" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33985" id="CVE-2026-33985" type="cve" title="CVE-2026-33985" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33987" id="CVE-2026-33987" type="cve" title="CVE-2026-33987" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442782" id="2442782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442768" id="2442768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453226" id="2453226" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447383" id="2447383" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442764" id="2442764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453217" id="2453217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447386" id="2447386" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447385" id="2447385" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447379" id="2447379" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453218" id="2453218" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:16014" id="RLSA-2026:16014" type="self" title="RLSA-2026:16014" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.8" src="freerdp-3.10.3-5.el10_1.8.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">c7cedd841f12da93d0a3948a912ec65438201166e169e62fa0045c5aa1496a07</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.8" src="freerdp-3.10.3-5.el10_1.8.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">ae3c984490f5372f899e68a17b3fe16a76858078b3fc40960b51215aa3cc2c4c</sum>
        </package>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="5.el10_1.8" src="freerdp-3.10.3-5.el10_1.8.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.8.x86_64.rpm</filename>
          <sum type="sha256">35845c40d8072ed276075bfe5fa1cfcea90ddded9814922fdeb830cd73742a9a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:15888</id>
    <title>Important: openexr security update</title>
    <issued date="2026-05-13 12:06:54" />
    <updated date="2026-05-14 06:09:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openexr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.

Security Fix(es):

* OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34588" id="CVE-2026-34588" type="cve" title="CVE-2026-34588" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455408" id="2455408" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:15888" id="RLSA-2026:15888" type="self" title="RLSA-2026:15888" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="openexr-libs" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_1.2" src="openexr-3.1.10-8.el10_1.2.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">d95244d2dde18211d2aa58d3d0e1ada9dfdfa5395f6c5d5db297cf57280c447e</sum>
        </package>
        <package name="openexr" arch="x86_64" epoch="0" version="3.1.10" release="8.el10_1.2" src="openexr-3.1.10-8.el10_1.2.src.rpm">
          <filename>openexr-3.1.10-8.el10_1.2.x86_64.rpm</filename>
          <sum type="sha256">9613951acfc1801ea2073e60eadf9a7ff74e129394db0571db924c28ee87e6cd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:15968</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2026-05-13 12:06:54" />
    <updated date="2026-05-14 06:09:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)

* libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4271" id="CVE-2026-4271" type="cve" title="CVE-2026-4271" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5119" id="CVE-2026-5119" type="cve" title="CVE-2026-5119" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452932" id="2452932" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448044" id="2448044" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:15968" id="RLSA-2026:15968" type="self" title="RLSA-2026:15968" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.11" src="libsoup3-3.6.5-3.el10_1.11.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.11.x86_64.rpm</filename>
          <sum type="sha256">4285234397e16121f49d99fef660a2a7c801c793dd0d7b46688f2bfe06614cf8</sum>
        </package>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_1.11" src="libsoup3-3.6.5-3.el10_1.11.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.11.x86_64.rpm</filename>
          <sum type="sha256">624ef4e2d67b28d44b59fdf018fa21e490524f0899e9f993e2a7f25ea90b68d1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="bugfix" version="2">
    <id>RLBA-2025:5309</id>
    <title>Moderate:mod_proxy_cluster bug fix and enhancement update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_proxy_cluster.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>For detailed information on changes in this release, see the Rocky Linux 10.0 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10306" id="CVE-2024-10306" type="cve" title="CVE-2024-10306" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2321302" id="2321302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLBA-2025:5309" id="RLBA-2025:5309" type="self" title="RLBA-2025:5309" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_proxy_cluster" arch="x86_64" epoch="0" version="1.3.21" release="1.el10" src="mod_proxy_cluster-1.3.21-1.el10.src.rpm">
          <filename>mod_proxy_cluster-1.3.21-1.el10.x86_64.rpm</filename>
          <sum type="sha256">d47c785dca12aa85b80b4bb5a951c494434e77e0b6b1002fa9706aaf88706f29</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7496</id>
    <title>Important: libxslt security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libxslt.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. 

Security Fix(es):

* libxslt: Use-After-Free in libxslt numbers.c (CVE-2025-24855)

* libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) (CVE-2024-55549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55549" id="CVE-2024-55549" type="cve" title="CVE-2024-55549" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24855" id="CVE-2025-24855" type="cve" title="CVE-2025-24855" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2352483" id="2352483" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2352484" id="2352484" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7496" id="RLSA-2025:7496" type="self" title="RLSA-2025:7496" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libxslt" arch="x86_64" epoch="0" version="1.1.39" release="7.el10_0" src="libxslt-1.1.39-7.el10_0.src.rpm">
          <filename>libxslt-1.1.39-7.el10_0.x86_64.rpm</filename>
          <sum type="sha256">424ec2d278a17b6e0d7d062eb36acc9cc27dc9d7899342b8ff3595482909aab9</sum>
        </package>
        <package name="libxslt-devel" arch="x86_64" epoch="0" version="1.1.39" release="7.el10_0" src="libxslt-1.1.39-7.el10_0.src.rpm">
          <filename>libxslt-devel-1.1.39-7.el10_0.x86_64.rpm</filename>
          <sum type="sha256">45f92355021a4ea8aff8065a9d34a3c6497d528c6f9238774f96f303e10407d2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7466</id>
    <title>Moderate: delve and golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for delve, golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341)

* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)

* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336" id="CVE-2024-45336" type="cve" title="CVE-2024-45336" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45341" id="CVE-2024-45341" type="cve" title="CVE-2024-45341" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22866" id="CVE-2025-22866" type="cve" title="CVE-2025-22866" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2341750" id="2341750" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2341751" id="2341751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2344219" id="2344219" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7466" id="RLSA-2025:7466" type="self" title="RLSA-2025:7466" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.24.1" release="1.el10_0" src="delve-1.24.1-1.el10_0.src.rpm">
          <filename>delve-1.24.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3d8994c1eefdff65ec281695346f895e11411b23cdc99e0cb242746705e9742f</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-1.23.7-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">92a4267a632e10f6758bc0d347033ed0c1774c52aeff82bedc59b0a24b2e8682</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-bin-1.23.7-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">eefc1975a747f63c479e9426811a77a3db5332310d57719e611107592d936abe</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-docs-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">a173b0da2e4752bfec1cf06f363224f6fa16ddba7370e6f2ffb8247587a4bcf4</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-misc-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">7bc05ee75edf98cb9343ef66d21fe35c1c592c61ba91484f778ac863170b4c0f</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-src-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">96f3dbb87940a6cfb09e7cc728c9fa35b1823688d51cdc133a0f9d051890835a</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-tests-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">859c5d5d9e4832afaeaf815e3564bfe80ada878f8e9efec2845d1c0e0cadbe4f</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>go-toolset-1.23.7-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3e3532f951f9e51ad82f778aa05129910b1a9ea887588c3258a903af48d65884</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7476</id>
    <title>Important: python-jinja2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-jinja2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27516" id="CVE-2025-27516" type="cve" title="CVE-2025-27516" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2350190" id="2350190" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7476" id="RLSA-2025:7476" type="self" title="RLSA-2025:7476" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-jinja2" arch="noarch" epoch="0" version="3.1.6" release="1.el10_0" src="python-jinja2-3.1.6-1.el10_0.src.rpm">
          <filename>python3-jinja2-3.1.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">0be3f5f469b49779d362bfeb982bfa4e089c5ba06907aea63c842224e044f287</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7484</id>
    <title>Important: gvisor-tap-vsock security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gvisor-tap-vsock.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

Security Fix(es):

* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22869" id="CVE-2025-22869" type="cve" title="CVE-2025-22869" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2348367" id="2348367" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7484" id="RLSA-2025:7484" type="self" title="RLSA-2025:7484" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gvisor-tap-vsock" arch="x86_64" epoch="6" version="0.8.5" release="1.el10_0" src="gvisor-tap-vsock-0.8.5-1.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-0.8.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">807c60e65b497f3a7439d900e72dd8c7efe2f0d6d32a52a4f626953fc47ceec2</sum>
        </package>
        <package name="gvisor-tap-vsock-gvforwarder" arch="x86_64" epoch="6" version="0.8.5" release="1.el10_0" src="gvisor-tap-vsock-0.8.5-1.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-gvforwarder-0.8.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9ef0ba89cb4ea139e96688f28f124a4d4c433fcf63f821d85ac33d3fee278cce</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7500</id>
    <title>Important: perl security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

* perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (CVE-2024-56406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56406" id="CVE-2024-56406" type="cve" title="CVE-2024-56406" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359290" id="2359290" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7500" id="RLSA-2025:7500" type="self" title="RLSA-2025:7500" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl" arch="x86_64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dab36262fee2fcd5d657f2ed802f7f537ef92f365c0460fe5820a9336d284801</sum>
        </package>
        <package name="perl-Attribute-Handlers" arch="noarch" epoch="0" version="1.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Attribute-Handlers-1.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">df82bff8696134f3dc521dd8b8443178771c46142a732b5626990b8c50b7f322</sum>
        </package>
        <package name="perl-AutoLoader" arch="noarch" epoch="0" version="5.74" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-AutoLoader-5.74-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2b4fca6da03e83a1f282dd4752b9f8f01c285fbabd0ff41d03ab8726d63cf223</sum>
        </package>
        <package name="perl-AutoSplit" arch="noarch" epoch="0" version="5.74" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-AutoSplit-5.74-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">47d60990ce13c089eea37d3a61fcd0f19f9cd592c76e7f37c61feabc2dc9b63e</sum>
        </package>
        <package name="perl-autouse" arch="noarch" epoch="0" version="1.11" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-autouse-1.11-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2aed9a5c5c3c64195602f3745dfae8ce3810635d8cffadc3c000cc890ddd103c</sum>
        </package>
        <package name="perl-B" arch="x86_64" epoch="0" version="1.89" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-B-1.89-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d7ce945009413f1423683bd51953c68814fd1bfd44e099420407281a71b1c7cd</sum>
        </package>
        <package name="perl-base" arch="noarch" epoch="0" version="2.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-base-2.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">64cb01cd07d0b974b1fe31dafc1ee5b2de90cd38f9e6a7885ec3903b83e8f0b4</sum>
        </package>
        <package name="perl-Benchmark" arch="noarch" epoch="0" version="1.25" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Benchmark-1.25-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">74ac8e111917550e3ae4bdc752e4021ce8d84ac96ea09db372c5902e59db11ae</sum>
        </package>
        <package name="perl-blib" arch="noarch" epoch="0" version="1.07" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-blib-1.07-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9105b51ea0d25e084761b4c0090ac6a7920e6ec963b8205050ef0bd5953b9adf</sum>
        </package>
        <package name="perl-Class-Struct" arch="noarch" epoch="0" version="0.68" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Class-Struct-0.68-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b0a5b9a9669ac59df8d16e5f193cc73e2cf6533f56f865fafc28ef0c9bcbe536</sum>
        </package>
        <package name="perl-Config-Extensions" arch="noarch" epoch="0" version="0.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Config-Extensions-0.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6f685d02211fce93b0617d99de4c02719ee94e418aaafa7e907a88e11fd861ec</sum>
        </package>
        <package name="perl-DBM_Filter" arch="noarch" epoch="0" version="0.06" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-DBM_Filter-0.06-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6f8f99b4dd16050e8554ca0dd65a11c063a26dfdffb224a626ccb3ae0633c5f8</sum>
        </package>
        <package name="perl-debugger" arch="noarch" epoch="0" version="1.60" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-debugger-1.60-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8fc7bfa0a4fe63fd2e0da152b148598355d27c933e2460d2e9cc79050b352a65</sum>
        </package>
        <package name="perl-deprecate" arch="noarch" epoch="0" version="0.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-deprecate-0.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9f0afea047f8b7135faf0867cddc951eb1866c137a2cdc16ed9d99c6498aba75</sum>
        </package>
        <package name="perl-devel" arch="x86_64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-devel-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">40a2bb840b71193175aac0ed8afa89591a5cc6eba95ce1409b65843599632207</sum>
        </package>
        <package name="perl-Devel-Peek" arch="x86_64" epoch="0" version="1.34" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Devel-Peek-1.34-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">981ab4855b79771240b99baf1c1e09020394177ac61cefb51229a45b871c8fdd</sum>
        </package>
        <package name="perl-Devel-SelfStubber" arch="noarch" epoch="0" version="1.06" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Devel-SelfStubber-1.06-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c5e20dc46a76c81d39581bec7dba3cd34e8bcbd55d0d1695738030c898c97bed</sum>
        </package>
        <package name="perl-diagnostics" arch="noarch" epoch="0" version="1.40" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-diagnostics-1.40-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9b993ecbf537f9b8cf7fcc2bba8e9237dcbe10fbd1e00fe8b8055b5e3d6a7a8f</sum>
        </package>
        <package name="perl-DirHandle" arch="noarch" epoch="0" version="1.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-DirHandle-1.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d64e1eccf3366c9be2a3998b26bdb732314caedfede71f45729f2b66e700a3aa</sum>
        </package>
        <package name="perl-doc" arch="noarch" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-doc-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ccbbf526615bcc2b8076d26e5b957bd587df1185b8a89f10050c80049edd50fc</sum>
        </package>
        <package name="perl-Dumpvalue" arch="noarch" epoch="0" version="2.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Dumpvalue-2.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">cae22391d31b927192b3be47b2727061f4455c0a2102000ae3ccdec554d5e0f6</sum>
        </package>
        <package name="perl-DynaLoader" arch="x86_64" epoch="0" version="1.56" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-DynaLoader-1.56-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e3d1b95e960eb91daf888d364117c261fa212d6a1c7467b99c10d882f8b5861a</sum>
        </package>
        <package name="perl-encoding-warnings" arch="noarch" epoch="0" version="0.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-encoding-warnings-0.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1fbd441fd14bde577f07caa18c9a65a54555bbc379fc93216692240e744d8d74</sum>
        </package>
        <package name="perl-English" arch="noarch" epoch="0" version="1.11" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-English-1.11-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b29f221e1a50532d874cd57b0640ccdab73bef336d474dc63b91370b064faa06</sum>
        </package>
        <package name="perl-Errno" arch="x86_64" epoch="0" version="1.38" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Errno-1.38-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d07b66dc675781913395f181004b92c5410bb757acddc907d718eadd8125832f</sum>
        </package>
        <package name="perl-ExtUtils-Constant" arch="noarch" epoch="0" version="0.25" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ExtUtils-Constant-0.25-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">673d5d8970de686dee8373ff9f98ac1c2402e68c83f39265122a76385961bc96</sum>
        </package>
        <package name="perl-ExtUtils-Embed" arch="noarch" epoch="0" version="1.35" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ExtUtils-Embed-1.35-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">fdb1db30f202624588f7cbf745a4a6c8fca01afdf97210a5770510e7b9c2ace5</sum>
        </package>
        <package name="perl-ExtUtils-Miniperl" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ExtUtils-Miniperl-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e72582fed4537442ae4e4a003b1dda5d9698598fb496633807bc081f0e9c15b9</sum>
        </package>
        <package name="perl-Fcntl" arch="x86_64" epoch="0" version="1.18" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Fcntl-1.18-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3bca9c5caef530dc901cb922df7b1b9df0bf8b01ad837417b2755c923a3186cb</sum>
        </package>
        <package name="perl-fields" arch="noarch" epoch="0" version="2.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-fields-2.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">76406839f2803d7b0cb0e251407e0b2a962badf80d05a23875258f25fce023b6</sum>
        </package>
        <package name="perl-File-Basename" arch="noarch" epoch="0" version="2.86" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Basename-2.86-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">18fe7a38257dc997a05f6c6c28982b7eeb3b2f3e5faf691fb96d0e937841428a</sum>
        </package>
        <package name="perl-FileCache" arch="noarch" epoch="0" version="1.10" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-FileCache-1.10-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2b487ea17c1aa09778b7dbbd7ac1b47dc6a93b26530fe20371b2bdb51258ad20</sum>
        </package>
        <package name="perl-File-Compare" arch="noarch" epoch="0" version="1.100.800" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Compare-1.100.800-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1881005b6b2bde554c16be1802d9bbcd5a909de38ee51ffec32a02583ddb0382</sum>
        </package>
        <package name="perl-File-Copy" arch="noarch" epoch="0" version="2.41" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Copy-2.41-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">fba17e4e04679f16bd6d6504978b8c6d087c92272c84dee25556d094a11c6d74</sum>
        </package>
        <package name="perl-File-DosGlob" arch="x86_64" epoch="0" version="1.12" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-DosGlob-1.12-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e67158989a020a01a02f76713b2de4af5602c6a5f0f00e5d1b4f400d8dfc3015</sum>
        </package>
        <package name="perl-File-Find" arch="noarch" epoch="0" version="1.44" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Find-1.44-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">4340329aebc6d4e2a20a4a0262490a02eab3c3f8c14cdbc56167041bfc406da6</sum>
        </package>
        <package name="perl-FileHandle" arch="noarch" epoch="0" version="2.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-FileHandle-2.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3e39fb116ad7d27753bedcef1a6e820f63a60b4c5063bc43fdb243b9650a993a</sum>
        </package>
        <package name="perl-File-stat" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-stat-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">69584b304b37a71085d1b1999832552e3dc1f121fa56d4f69a4e29a2e537fa65</sum>
        </package>
        <package name="perl-filetest" arch="noarch" epoch="0" version="1.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-filetest-1.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">40840e2b871078b6563e722341b7b125b6c9d53966929daeca5120eb6c5dd388</sum>
        </package>
        <package name="perl-FindBin" arch="noarch" epoch="0" version="1.54" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-FindBin-1.54-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9cad58324085e230d93182830c46360a175d1a0ffba308ceebc7b25f5a7a8038</sum>
        </package>
        <package name="perl-GDBM_File" arch="x86_64" epoch="1" version="1.24" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-GDBM_File-1.24-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1b7766f5326ea66720f16e17aa3637b8723b88213993ea30445b6f887f51614a</sum>
        </package>
        <package name="perl-Getopt-Std" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Getopt-Std-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">99dcfad5e06149134c3ec786f6740c6c72b20ab6edb1cdc03369e2d4b2eb7767</sum>
        </package>
        <package name="perl-Hash-Util" arch="x86_64" epoch="0" version="0.32" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Hash-Util-0.32-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">68bac4efc4c630bd9a9314b88518b44b1b09f0863cbc70f14453be380cb69085</sum>
        </package>
        <package name="perl-Hash-Util-FieldHash" arch="x86_64" epoch="0" version="1.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Hash-Util-FieldHash-1.27-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0e280af670366baac4b0dc2ddd745a8270d5ffbadbc919031e2f512fb88db7d5</sum>
        </package>
        <package name="perl-I18N-Collate" arch="noarch" epoch="0" version="1.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-I18N-Collate-1.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6d20a8498404c9197de54883101b165edfe2b93c5c62070b361e40ae8e3b7f30</sum>
        </package>
        <package name="perl-I18N-Langinfo" arch="x86_64" epoch="0" version="0.24" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-I18N-Langinfo-0.24-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2fc394642249abdecf6d7fd9cfef95afa28f48c55a920df9c39ccf8453aa73d7</sum>
        </package>
        <package name="perl-I18N-LangTags" arch="noarch" epoch="0" version="0.45" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-I18N-LangTags-0.45-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">7f3c00984f9daf4674a3946e5cd3e42d38241c28cd50a538ad65b933038acb3b</sum>
        </package>
        <package name="perl-if" arch="noarch" epoch="0" version="0.61.000" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-if-0.61.000-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">0e7302913d6133623cbe84b6f7cac2e372e6b05d5f79158b1856baf46a731c51</sum>
        </package>
        <package name="perl-interpreter" arch="x86_64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-interpreter-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8b422784838b09c8b7fdf74245dd28af4e1977ef5bc79a1684b8d930ae4dd645</sum>
        </package>
        <package name="perl-IO" arch="x86_64" epoch="0" version="1.55" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-IO-1.55-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e1855bc4c63117138c9babff75d7144eaad8e208c36b6f1d00dd410124f182eb</sum>
        </package>
        <package name="perl-IPC-Open3" arch="noarch" epoch="0" version="1.22" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-IPC-Open3-1.22-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b457c4435a6f06fbc648180db5a51c4438d66b150001498f77ea7c211b372769</sum>
        </package>
        <package name="perl-less" arch="noarch" epoch="0" version="0.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-less-0.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">670ebc3d46f7503f84b3d69f79b0cb7ff7958b8e7253c1b33c195be31fc9e680</sum>
        </package>
        <package name="perl-lib" arch="x86_64" epoch="0" version="0.65" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-lib-0.65-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d1dd10cd7302af86e9936fea486efa016e7cebfa81a6f1d7cda157cb86888938</sum>
        </package>
        <package name="perl-libnetcfg" arch="noarch" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-libnetcfg-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">41de6c67a452247623014006b4ddb34678ea17acceb43e9df3d2c76725d51ae2</sum>
        </package>
        <package name="perl-libs" arch="x86_64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-libs-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e661a2a8107bd9cf2698c50adfa0163a166e57cc3820531ed99946c791a7540b</sum>
        </package>
        <package name="perl-locale" arch="noarch" epoch="0" version="1.12" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-locale-1.12-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d20218fb1d4cfb6ba774c3c65ada3fc3ed221a352046a7888d828c9cc1f04b53</sum>
        </package>
        <package name="perl-Locale-Maketext-Simple" arch="noarch" epoch="1" version="0.21" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Locale-Maketext-Simple-0.21-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">0748651e441428a3fe630edd8e59c7c4bd1298c11f73609870dd47f6f1fdbdea</sum>
        </package>
        <package name="perl-macros" arch="noarch" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-macros-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">29508d63ad1c04709cc244b49fee772f1b739c98a5cf40ef77655047e9cb9ab4</sum>
        </package>
        <package name="perl-Math-Complex" arch="noarch" epoch="0" version="1.62" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Math-Complex-1.62-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c65895672c9bb24c35443a82c397d44f2f1eaba3153f78cac25c474240025754</sum>
        </package>
        <package name="perl-Memoize" arch="noarch" epoch="0" version="1.16" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Memoize-1.16-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d7bce1afae95fba04201089bb45eda58f4a6dffe75e15396ae01735f47020508</sum>
        </package>
        <package name="perl-meta-notation" arch="noarch" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-meta-notation-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ceb2b652e10eb44fa6b0ab9d404ea5d1a504148c788298974b7f0dda845c996b</sum>
        </package>
        <package name="perl-Module-Loaded" arch="noarch" epoch="1" version="0.08" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Module-Loaded-0.08-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c4802ec4db4c080bf27de5740f4460b02dac0afcf04c90e96895d73d81e70caa</sum>
        </package>
        <package name="perl-mro" arch="x86_64" epoch="0" version="1.29" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-mro-1.29-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3eac9e5583d2d83d280027dc43136fe0a8b104607e8758cff91ec393da0e4e1f</sum>
        </package>
        <package name="perl-NDBM_File" arch="x86_64" epoch="0" version="1.17" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-NDBM_File-1.17-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ea2d682eb97e5b124ca61c1b93e142d79dbb115c45fd22672fa25027501079aa</sum>
        </package>
        <package name="perl-Net" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Net-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3f05fb3a1ccdbf490a8da8d17a6b2f49eb891ce079d12d37896a678226717001</sum>
        </package>
        <package name="perl-NEXT" arch="noarch" epoch="0" version="0.69" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-NEXT-0.69-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9bc98bc8feb85d727a82b56b0005d351538fa826649abcdc0d7f94dda0a3f72a</sum>
        </package>
        <package name="perl-ODBM_File" arch="x86_64" epoch="0" version="1.18" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ODBM_File-1.18-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d64775f4e228d5e4a4a74a7c395e64d9a413e83f296c4e8ec4f7f0ce5f176449</sum>
        </package>
        <package name="perl-Opcode" arch="x86_64" epoch="0" version="1.65" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Opcode-1.65-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">66f32a70830cf973627ff5ab77425032e44736460175530425957c66f2d06fd6</sum>
        </package>
        <package name="perl-open" arch="noarch" epoch="0" version="1.13" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-open-1.13-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">5805aba0d8aac827b89fa9b1c6af7998c911c1189b0967b32307a0216270d0d5</sum>
        </package>
        <package name="perl-overload" arch="noarch" epoch="0" version="1.37" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-overload-1.37-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9c701c301917c4cd0a536917ee80b2fc29c532745afa6d840aac1e73ae420502</sum>
        </package>
        <package name="perl-overloading" arch="noarch" epoch="0" version="0.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-overloading-0.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1567b7808f7d0a3664abddb60175c5009f301886b2b15a1c81ead50987300c5b</sum>
        </package>
        <package name="perl-ph" arch="x86_64" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ph-5.40.2-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9f95abe13ef1f4cf36936ee77de025740289a025ad0ca91f166d42aedc584869</sum>
        </package>
        <package name="perl-Pod-Functions" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Pod-Functions-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">eeb09288b3ad9d99f248311e87142e9a46f7bc9989727a881b363ba4f6005c22</sum>
        </package>
        <package name="perl-Pod-Html" arch="noarch" epoch="0" version="1.35" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Pod-Html-1.35-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8221ab5df8c2b1ee30ecb1582bbdf7ec18586516e5c84ebf0cb4f6555da9a7c2</sum>
        </package>
        <package name="perl-POSIX" arch="x86_64" epoch="0" version="2.20" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-POSIX-2.20-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">47b661a5a42f9159ad9b8e5ab4f736c9449eab86f06ee996916767d6ea4ef83f</sum>
        </package>
        <package name="perl-Safe" arch="noarch" epoch="0" version="2.46" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Safe-2.46-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6144a8a3c79c9e5a80b8607af9c539b134abb4008bcfa2eb0880a18a8459441f</sum>
        </package>
        <package name="perl-Search-Dict" arch="noarch" epoch="0" version="1.07" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Search-Dict-1.07-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">51c258972fdd46bbd373502c17e6b48644f119ea220152a0d3a4b51c1700a0c5</sum>
        </package>
        <package name="perl-SelectSaver" arch="noarch" epoch="0" version="1.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-SelectSaver-1.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8431cdd6e9d962bbf1298e488b9e5af8bc7f184ecb81ddadb8fadf58ca223e88</sum>
        </package>
        <package name="perl-SelfLoader" arch="noarch" epoch="0" version="1.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-SelfLoader-1.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">28d0a2be3dc6a6d05b9e81f46a68fee3d91b26b4461388400dce5b0f27966800</sum>
        </package>
        <package name="perl-sigtrap" arch="noarch" epoch="0" version="1.10" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-sigtrap-1.10-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d02f886ef561027bc19c4418b8de4b5bc7537fe3d35a17db4c2be08d5db132f6</sum>
        </package>
        <package name="perl-sort" arch="noarch" epoch="0" version="2.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-sort-2.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f1430143b9693f9bc1e12d1a9df1544d48cd424fc43c3ba61502be710bc60740</sum>
        </package>
        <package name="perl-subs" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-subs-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8918c1a21617b7914d8634e7eac6abde85e395b50e6a6e321b93a3968e7f3da4</sum>
        </package>
        <package name="perl-Symbol" arch="noarch" epoch="0" version="1.09" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Symbol-1.09-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">17ead97396a311f64f762f306ccf538c25d49404c16e5012fcfff7795db9a969</sum>
        </package>
        <package name="perl-Sys-Hostname" arch="x86_64" epoch="0" version="1.25" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Sys-Hostname-1.25-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">49b9ac284a4348889a6b0477402b103528ad8667b27068ddbc4217e4fa013f50</sum>
        </package>
        <package name="perl-Term-Complete" arch="noarch" epoch="0" version="1.403" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Term-Complete-1.403-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">66b362c03c004559eb0df57b25449a54fee5c3c473bf9ad824a949a0b9b7de9a</sum>
        </package>
        <package name="perl-Term-ReadLine" arch="noarch" epoch="0" version="1.17" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Term-ReadLine-1.17-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9634510df64298d518d9da81f0498e3c32b5770f5b09ca13b173d29b223c7621</sum>
        </package>
        <package name="perl-Test" arch="noarch" epoch="0" version="1.31" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Test-1.31-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">526ad97e3b7dcd8863fc3e778974b1472368f7d1a8f17b80a05788fa8a6fdd98</sum>
        </package>
        <package name="perl-Text-Abbrev" arch="noarch" epoch="0" version="1.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Text-Abbrev-1.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">4281e15c48c90708addcc97d41dd25ed9b69c773df3edfc024191d6446d1a506</sum>
        </package>
        <package name="perl-Thread" arch="noarch" epoch="0" version="3.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Thread-3.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">cc65ce65130f119bce6de89dccb7175ccb960bd6bbbbb2adfc271c4f74ea68cd</sum>
        </package>
        <package name="perl-Thread-Semaphore" arch="noarch" epoch="0" version="2.13" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Thread-Semaphore-2.13-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">86a92e6eb3c9000fb6ea1184ee93b94e0fb0a3ebb51fc4a69672ddf1dbb39749</sum>
        </package>
        <package name="perl-Tie" arch="noarch" epoch="0" version="4.6" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Tie-4.6-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c504397313693520cb3b5ac42a41f4e460526b0a166eba98ebfe0267c58f9aff</sum>
        </package>
        <package name="perl-Tie-File" arch="noarch" epoch="0" version="1.09" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Tie-File-1.09-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">81d7b7e5cbc4c391f219ebb42adc67dabfe157c3f33b1d3f1ad9e54aa2b884d4</sum>
        </package>
        <package name="perl-Tie-Memoize" arch="noarch" epoch="0" version="1.1" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Tie-Memoize-1.1-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">21cc178b7ea848ba45ef3ffa2fe36ed8904fcae31f89b18a48d6cc535ac83a09</sum>
        </package>
        <package name="perl-Time" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Time-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1086aba3487a8b2a57d839272fb1e3cf43753f814604070a7469ef0e965d27ed</sum>
        </package>
        <package name="perl-Time-Piece" arch="x86_64" epoch="0" version="1.3401" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Time-Piece-1.3401-512.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">16d923b15f2098b493159dd7a66f279d59486e7ddd4971c0d29a2e0f9b0dc400</sum>
        </package>
        <package name="perl-Unicode-UCD" arch="noarch" epoch="0" version="0.78" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Unicode-UCD-0.78-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e946bb7b7bea19f5129b8a8f51f60b33fb9ef11f48252c61ba0821caa8348088</sum>
        </package>
        <package name="perl-User-pwent" arch="noarch" epoch="0" version="1.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-User-pwent-1.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2e134003c8129f2b32aa4fe533959d092ec05a46c8dcca4388ba21cc680aef6e</sum>
        </package>
        <package name="perl-utils" arch="noarch" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-utils-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b57e93b65d5b1b9382282af8ae96173bc97169fa2afabb3eb3890745f973e30a</sum>
        </package>
        <package name="perl-vars" arch="noarch" epoch="0" version="1.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-vars-1.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">5a825accc7d995c71c719ec15ab84221c533a3abe6be6b061381d7606a4854b6</sum>
        </package>
        <package name="perl-vmsish" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-vmsish-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1105ceabfffbdb6623a09ef153437cf83399cf3c9e90886af08debdef5ea9efb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7494</id>
    <title>Moderate: tomcat9 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24813" id="CVE-2025-24813" type="cve" title="CVE-2025-24813" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2351129" id="2351129" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7494" id="RLSA-2025:7494" type="self" title="RLSA-2025:7494" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">b437e4fc937d6b74f899196746d369a6a92329101a31896fa56218c02f46d8f2</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">9d89438b2d7d2e13b6ca687b167d642ffaeaa56759ff8ae29ed4b0c6f999c116</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">da4573e35e6a878c5d8b183fca36afb47d21bd6ddf6986b5036c8fda3a50c899</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">633995220500848334199accb63d5fb50138965dc0ea0be7ba15ff6781f0bfcf</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">6998f6dff03a9fe84d0f74fe7d58d24d7e852dc4120eece360bfad99e4fd026b</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-lib-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">b4ad34cca71a8de6a211fca37ab3c96e9b9c7ea305fed7b854295b1b4b834f5c</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">18e71ac028c3f2d5029044ab9c6f2b8b1f9e7807d493ae50a4cc5ca943de0197</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-webapps-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">249400041e694a3f0a2163c207d03ea61a785931ebc8a089e7b48bfaf645da9e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7497</id>
    <title>Moderate: tomcat security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)

* tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)

* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52316" id="CVE-2024-52316" type="cve" title="CVE-2024-52316" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54677" id="CVE-2024-54677" type="cve" title="CVE-2024-54677" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24813" id="CVE-2025-24813" type="cve" title="CVE-2025-24813" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2326972" id="2326972" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2332815" id="2332815" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2351129" id="2351129" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7497" id="RLSA-2025:7497" type="self" title="RLSA-2025:7497" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">4cf0f9042968d70ef2898c37fac49a01de1b1cfa3c328bb07b209e3d8dbff610</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-admin-webapps-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9d6f90224fc1711fe2b7abdd716b0731eeffed54dd5cc1aa367e2b363761005f</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-docs-webapp-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6d0065b1bf9c100520228fb27d19e05a21a94c08f7afb93cccc1b8c481217c8a</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3976c9f95398f8f87e813ac6f2c3a79195a292f9e82730aa3c2eaaf89eb584c5</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e1d02f3b4da77ba27efd41c2081f47ff826e02cdb6f7178d694c7f0d690a79ff</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-lib-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ea3e898fec9e468462d24e57789c94a1715e2bee582c87c2323232f238570be5</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ef37f975774200329ec5683bb10febc6cd7f6be8d8713a6834f245f604f6cf1e</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-webapps-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">5001b035bd821674c28eca7704f915abfad1d76546fce19420e00a3452040571</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7490</id>
    <title>Important: mod_auth_openidc security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mod_auth_openidc.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. 

Security Fix(es):

* mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31492" id="CVE-2025-31492" type="cve" title="CVE-2025-31492" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357738" id="2357738" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7490" id="RLSA-2025:7490" type="self" title="RLSA-2025:7490" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_auth_openidc" arch="x86_64" epoch="0" version="2.4.15" release="4.el10_0.1" src="mod_auth_openidc-2.4.15-4.el10_0.1.src.rpm">
          <filename>mod_auth_openidc-2.4.15-4.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">200ee122f0118eb9f7c1c3bea634efabf91983e047d60e13a03da69d44960702</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7458</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)

* X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)

* xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)

* xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)

* xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)

* xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)

* xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)

* xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)

* Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9632" id="CVE-2024-9632" type="cve" title="CVE-2024-9632" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26594" id="CVE-2025-26594" type="cve" title="CVE-2025-26594" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26595" id="CVE-2025-26595" type="cve" title="CVE-2025-26595" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26596" id="CVE-2025-26596" type="cve" title="CVE-2025-26596" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26597" id="CVE-2025-26597" type="cve" title="CVE-2025-26597" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26598" id="CVE-2025-26598" type="cve" title="CVE-2025-26598" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26599" id="CVE-2025-26599" type="cve" title="CVE-2025-26599" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26600" id="CVE-2025-26600" type="cve" title="CVE-2025-26600" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26601" id="CVE-2025-26601" type="cve" title="CVE-2025-26601" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2317233" id="2317233" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345248" id="2345248" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345251" id="2345251" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345252" id="2345252" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345253" id="2345253" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345254" id="2345254" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345255" id="2345255" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345256" id="2345256" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345257" id="2345257" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7458" id="RLSA-2025:7458" type="self" title="RLSA-2025:7458" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="x86_64" epoch="0" version="24.1.5" release="3.el10_0" src="xorg-x11-server-Xwayland-24.1.5-3.el10_0.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">33bc714d090fe12fddc4f7a93cca1497332d91736d55ed279e0a275819191b22</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7462</id>
    <title>Important: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22869" id="CVE-2025-22869" type="cve" title="CVE-2025-22869" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2348367" id="2348367" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7462" id="RLSA-2025:7462" type="self" title="RLSA-2025:7462" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="6" version="5.4.0" release="9.el10_0" src="podman-5.4.0-9.el10_0.src.rpm">
          <filename>podman-5.4.0-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a60ad650635c9cedd8468de0c971c474907afa160071ee37315bf5f3d0aab5d2</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="9.el10_0" src="podman-5.4.0-9.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-9.el10_0.noarch.rpm</filename>
          <sum type="sha256">7ae66cfa21aa2ec6ca3c8a9071719dbd74044bbae59aa125845f0deb025a6329</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="6" version="5.4.0" release="9.el10_0" src="podman-5.4.0-9.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">cf075af04f31aec31f85746393fc679a5d5dbac880a5adde66b0d689f75d2851</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7482</id>
    <title>Moderate: git security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for git.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

* git: The sideband payload is passed unfiltered to the terminal in git (CVE-2024-52005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52005" id="CVE-2024-52005" type="cve" title="CVE-2024-52005" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2338289" id="2338289" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7482" id="RLSA-2025:7482" type="self" title="RLSA-2025:7482" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git" arch="x86_64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-2.47.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8341a005b5afbd3da5cf2085ac0495c40c375ece5c27c9414ab20a5c027040d1</sum>
        </package>
        <package name="git-all" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-all-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bdac5c5ba4bfafed747139711d4f1914945210296dc86facf5432c7f99084f22</sum>
        </package>
        <package name="git-core" arch="x86_64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-core-2.47.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a8cdd559dffec0d1057ece75c9faf968b98286785da2d62aa1cddb6ec2b4b0c6</sum>
        </package>
        <package name="git-core-doc" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-core-doc-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">dff88d5bf97778c8ffa84c94fba0c513a974d8a22377dacb9d0d3d144e8ac113</sum>
        </package>
        <package name="git-credential-libsecret" arch="x86_64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-credential-libsecret-2.47.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">63ff1cc5ca367d61093adf5b77d4b97a9bd562672f043b7dd5b05c73543bd79a</sum>
        </package>
        <package name="git-daemon" arch="x86_64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-daemon-2.47.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">91769656949b236f1b97ad5c846a34d7fca4aea23ef0eb69e8f6763933136040</sum>
        </package>
        <package name="git-email" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-email-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">302cbdefd3aeef9e3cb6a60171ca3ff7359992cb4a9152b7108d104ea115f6d9</sum>
        </package>
        <package name="git-gui" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-gui-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d7de5ac4a009799fac2ddf54a02931c705ee1a98dfbb9c68d7896e07dd1d639a</sum>
        </package>
        <package name="git-instaweb" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-instaweb-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a7b51b56a736417cf73bce8edb49e630148261994fafcf7452aadc661590c3f7</sum>
        </package>
        <package name="gitk" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>gitk-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b3aee409817b28b7d56de0fb83098e1cc9beb2e16a62e94090dd8cfdebab8fcc</sum>
        </package>
        <package name="git-subtree" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-subtree-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">46242bbebcd1ad2839abfd60513fb03fd03784110b4f23a33292b9b36b2767e2</sum>
        </package>
        <package name="git-svn" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-svn-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3bcd83dd028d37947088d1f3cd86a662a008b0ca693c9e3540f7e9b50b858c28</sum>
        </package>
        <package name="gitweb" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>gitweb-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">0decb63454ebe01d56cde889e20f36c21e1a53be754ff0371ace2d49352d47cd</sum>
        </package>
        <package name="perl-Git" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>perl-Git-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a71275b85f0a971d28ad5a09f367052c44662020585c0053e7ae7dda0527c0db</sum>
        </package>
        <package name="perl-Git-SVN" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>perl-Git-SVN-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">43f3df75d8bf0c722c592f13c33b87d3e1cb0939f38aa0849043d9b7a60c20b0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7478</id>
    <title>Moderate: corosync security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for corosync.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.

Security Fix(es):

* corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30472" id="CVE-2025-30472" type="cve" title="CVE-2025-30472" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2354229" id="2354229" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7478" id="RLSA-2025:7478" type="self" title="RLSA-2025:7478" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="corosynclib" arch="x86_64" epoch="0" version="3.1.9" release="1.el10_0.1" src="corosync-3.1.9-1.el10_0.1.src.rpm">
          <filename>corosynclib-3.1.9-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">ab55164562ae56b3a6ef10fa4c21ef2fab92e30d2c4e4a1e704c3c76dc7e1345</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7489</id>
    <title>Important: php security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

* php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

* php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

* php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

* php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

* php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11235" id="CVE-2024-11235" type="cve" title="CVE-2024-11235" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1217" id="CVE-2025-1217" type="cve" title="CVE-2025-1217" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1219" id="CVE-2025-1219" type="cve" title="CVE-2025-1219" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1734" id="CVE-2025-1734" type="cve" title="CVE-2025-1734" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1736" id="CVE-2025-1736" type="cve" title="CVE-2025-1736" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1861" id="CVE-2025-1861" type="cve" title="CVE-2025-1861" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2355917" id="2355917" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356041" id="2356041" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356042" id="2356042" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356043" id="2356043" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356046" id="2356046" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357531" id="2357531" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7489" id="RLSA-2025:7489" type="self" title="RLSA-2025:7489" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="php" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f8e369c37b1c94d4852411a992e20e579d7cc08e8d313db5fad599f6178bc0b3</sum>
        </package>
        <package name="php-bcmath" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-bcmath-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8ffc76244a39ad99ca2ea05d4bdc447e89061f2b35537d7f5eff23a0e487b123</sum>
        </package>
        <package name="php-cli" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-cli-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8f312184ffd2d6b1576b2affced456276dd2d8d1b76686a8f3c66cd782e6f51b</sum>
        </package>
        <package name="php-common" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-common-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">79cc5ed19a42a4971bdb63b126567d4eb69bb0dfea86f78073e229654351748b</sum>
        </package>
        <package name="php-dba" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-dba-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dc30e19bca69bd947d8fabadf606b1baa1904b08f38d54421f7cc2c94127be1a</sum>
        </package>
        <package name="php-dbg" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-dbg-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">559b9e61692aa55585f3076475379fa1f2b55a439b82d3a617527c2eea4582da</sum>
        </package>
        <package name="php-devel" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-devel-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a196b86f49e94e7f46a0dcf3424e3a09de782ae186650a9482c09e9cf8d3ec72</sum>
        </package>
        <package name="php-embedded" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-embedded-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c7e88f82cead8bd8ff92720d2658449fed821500fa1fbab37ec57e476920a215</sum>
        </package>
        <package name="php-enchant" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-enchant-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">76f78ccd85de0704cbbb6d730e0f3657504734f216df2f7a06ffdd998f31b3c7</sum>
        </package>
        <package name="php-ffi" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-ffi-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">85ad92a3fab46500bf8fd98dd997a7863bffeb9074fc9c4ef8ff8433691a35c0</sum>
        </package>
        <package name="php-fpm" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-fpm-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6b4e908b9a44007a0e55437326eb007ba5034cd0ec3f892d0aa601e248b3bbbb</sum>
        </package>
        <package name="php-gd" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-gd-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">332c477127b88ec94da412f50c03fadd0af3d715614adcf26ac8745fbf241c25</sum>
        </package>
        <package name="php-gmp" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-gmp-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5ea2b7b1c7116e2786b4c9a11755dd4b7be61bb0c9da65988271eec7a212d0af</sum>
        </package>
        <package name="php-intl" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-intl-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">82403da93300e71a3f542a14d410e9108a2ec8920b403565cf2e7339222c139c</sum>
        </package>
        <package name="php-ldap" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-ldap-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8c40ab1878378d643b2283b00e89d45e5d3d3af0d5b8013f7f06ad7a8d303e24</sum>
        </package>
        <package name="php-mbstring" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-mbstring-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7e8df612af62c3fa51fc67f3dc898b69196598196e8f01d4b0dcdf0dd137918a</sum>
        </package>
        <package name="php-mysqlnd" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-mysqlnd-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6e686debf68f89b6a9d3a4037adcdab5c9c341271ce9b590064bcacc1c27eb3f</sum>
        </package>
        <package name="php-odbc" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-odbc-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4b3ca8a4f7f26ca1bd402dc622c3d8a69938bb6b08fc95a7d2fda6e7073a7727</sum>
        </package>
        <package name="php-opcache" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-opcache-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dc8dc81f917a68bf69bdd02dd132185a44099e1aaca8fe692f72f3fa1997162b</sum>
        </package>
        <package name="php-pdo" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-pdo-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2b0a25bc1b8fac2e6318221d8e51bbff165c3a60eedaf7b9c55a6f53a547a992</sum>
        </package>
        <package name="php-pgsql" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-pgsql-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e7dcbef58d5ff4e4dc7befaf2c161eef18366a22573fc7a3baf3b4f49e0c7b40</sum>
        </package>
        <package name="php-process" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-process-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5fa288c16df4c15b4d67f304c5bd54388b567b0b2a595ef2b5e987b69c1ba6cd</sum>
        </package>
        <package name="php-snmp" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-snmp-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6684d678ac5a11d08d4cfbafac71655c778e60603546e6ae86454699cb6e62ee</sum>
        </package>
        <package name="php-soap" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-soap-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1a5877ebc41576509a1b0d47d874c02b7120e12f58c7e65d4316fdb88b06af44</sum>
        </package>
        <package name="php-xml" arch="x86_64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-xml-8.3.19-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1c715bb6977badb91349ee50c7a78b23b76d0284205f1693dc50e6131eb6bbd1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7479</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

* golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868)

* github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input (CVE-2025-29786)

* golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22868" id="CVE-2025-22868" type="cve" title="CVE-2025-22868" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29786" id="CVE-2025-29786" type="cve" title="CVE-2025-29786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30204" id="CVE-2025-30204" type="cve" title="CVE-2025-30204" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2348366" id="2348366" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2352914" id="2352914" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2354195" id="2354195" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7479" id="RLSA-2025:7479" type="self" title="RLSA-2025:7479" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.107.0" release="9.el10_0" src="opentelemetry-collector-0.107.0-9.el10_0.src.rpm">
          <filename>opentelemetry-collector-0.107.0-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6a85dd7963eb1b9b0e6a76c5fab1ec5aeedad8c476e4001d728924c40e2863c8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7509</id>
    <title>Important: valkey security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVE-2025-21605)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21605" id="CVE-2025-21605" type="cve" title="CVE-2025-21605" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2361883" id="2361883" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7509" id="RLSA-2025:7509" type="self" title="RLSA-2025:7509" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.3" release="1.el10_0" src="valkey-8.0.3-1.el10_0.src.rpm">
          <filename>valkey-8.0.3-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b9baa033f01c694f8b123802069c7b1ebbdd101c1c477e316687c674aa40abc0</sum>
        </package>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.3" release="1.el10_0" src="valkey-8.0.3-1.el10_0.src.rpm">
          <filename>valkey-devel-8.0.3-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">30d4068383ee9e088c80496a42c74d0b6cb66907ae468412d5e495085f92c2ca</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7467</id>
    <title>Moderate: skopeo security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7467" id="RLSA-2025:7467" type="self" title="RLSA-2025:7467" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.18.1" release="1.el10_0" src="skopeo-1.18.1-1.el10_0.src.rpm">
          <filename>skopeo-1.18.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">51cbb69f69f7b361ead598157c4202f8c28ec55191b2bb82394518bdcab0a963</sum>
        </package>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.18.1" release="1.el10_0" src="skopeo-1.18.1-1.el10_0.src.rpm">
          <filename>skopeo-tests-1.18.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f602b7c4fa46a57f34a64d291f49d6a2f4dd3acea602199b3812c5384213286e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7459</id>
    <title>Moderate: buildah security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7459" id="RLSA-2025:7459" type="self" title="RLSA-2025:7459" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah" arch="x86_64" epoch="2" version="1.39.4" release="1.el10_0" src="buildah-1.39.4-1.el10_0.src.rpm">
          <filename>buildah-1.39.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">424860a41a3c6be30509aafd6dad1d6233609a859c207ed598a46811849a26d1</sum>
        </package>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.39.4" release="1.el10_0" src="buildah-1.39.4-1.el10_0.src.rpm">
          <filename>buildah-tests-1.39.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">04de794150732cf258bbc0fa53691ab7c901ddc05fa33e0f2e8dbfc4de4a3fbc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7457</id>
    <title>Moderate: exiv2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for exiv2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats.

Security Fix(es):

* exiv2: Use After Free in Exiv2 (CVE-2025-26623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26623" id="CVE-2025-26623" type="cve" title="CVE-2025-26623" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2346345" id="2346345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7457" id="RLSA-2025:7457" type="self" title="RLSA-2025:7457" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="exiv2" arch="x86_64" epoch="0" version="0.28.3" release="3.el10_0.2" src="exiv2-0.28.3-3.el10_0.2.src.rpm">
          <filename>exiv2-0.28.3-3.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">6c494c65bdd05728ba7601311720dee26fc03e84ee413c96543e1d46461c3b0e</sum>
        </package>
        <package name="exiv2-libs" arch="x86_64" epoch="0" version="0.28.3" release="3.el10_0.2" src="exiv2-0.28.3-3.el10_0.2.src.rpm">
          <filename>exiv2-libs-0.28.3-3.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">f3e64409cde39e2b739b5d23066d3dce6a76a7353dad1e1ce14705fbd9aa58a7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7592</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336" id="CVE-2024-45336" type="cve" title="CVE-2024-45336" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3931" id="CVE-2025-3931" type="cve" title="CVE-2025-3931" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2341751" id="2341751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362345" id="2362345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7592" id="RLSA-2025:7592" type="self" title="RLSA-2025:7592" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="yggdrasil" arch="x86_64" epoch="0" version="0.4.5" release="3.el10_0" src="yggdrasil-0.4.5-3.el10_0.src.rpm">
          <filename>yggdrasil-0.4.5-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a2e40405821fcfb9e4fca51f0937adbff423bf3f683318f3a05d058d737b674b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7593</id>
    <title>Moderate: ghostscript security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for ghostscript.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

* Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27832" id="CVE-2025-27832" type="cve" title="CVE-2025-27832" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2354949" id="2354949" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7593" id="RLSA-2025:7593" type="self" title="RLSA-2025:7593" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ghostscript" arch="x86_64" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-10.02.1-16.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8f6a4f89f0bca9dc3bfcb6e1a38e955b5979ac45660fff9fae3bf53c56ee994f</sum>
        </package>
        <package name="ghostscript-doc" arch="noarch" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-doc-10.02.1-16.el10_0.noarch.rpm</filename>
          <sum type="sha256">f4914cfd80f9e897646ac8e36f35e168dff0f5d687bedd1ecc1e5136f57ddfa7</sum>
        </package>
        <package name="ghostscript-tools-fonts" arch="noarch" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-tools-fonts-10.02.1-16.el10_0.noarch.rpm</filename>
          <sum type="sha256">c86349f057a12bd7dcb6abc7f6f0724a83df500266b99fe894462a62ef242058</sum>
        </package>
        <package name="ghostscript-tools-printing" arch="noarch" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-tools-printing-10.02.1-16.el10_0.noarch.rpm</filename>
          <sum type="sha256">f20d5ba7b32a253d2c2a24a263142c8d24062116a76f8bb2d82a0ece4b9875ea</sum>
        </package>
        <package name="libgs" arch="x86_64" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>libgs-10.02.1-16.el10_0.x86_64.rpm</filename>
          <sum type="sha256">14e42def6c713f54bd548ca9760c2dd068f4255da1f09c4963b61850d11044e4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7599</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es):

* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26646" id="CVE-2025-26646" type="cve" title="CVE-2025-26646" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2365317" id="2365317" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7599" id="RLSA-2025:7599" type="self" title="RLSA-2025:7599" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">388c835ccd252cc0087f329e3151759bd62255988ffeeba1f43c75f29819fec4</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5eed04e6362f189503c6d2389f673ffdb96d4c7f7bf7f00161ba7915e2b72b70</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">95f95ee75f965d636a6bcd3843b60618a35aa93e18fefc53dbfb0d8e3f896675</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">485cca658dc494f97b61b371d618482fd20120138259d2b9a35b44fc5507a1cf</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">cdfecdda4a6ae5f6cf1c0b94426c51d332be54ec9e09e0907563b5bd7a5dcc6a</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">709e2143ec66a3efe307657b235a7770fefd0174084f8ddee3ce7ffce64aa3cd</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8b8e566060a08ea726e0e6e26d14cbabda5d970335db923db0042a056b96168b</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.116" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.116-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">52d6f8d1d0e667f5b4cae116f534c4da070b1cef024674428d2bf2eb095cd2ca</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.116" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.116-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8fd865e497f7b279ed97d0b4fb3b5df2f71b8d573ffa739e4f7905dfd3810672</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.16-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bcb942acc76d01a5094f992427abdbc25fce49a41d33dac94cbde6e560c7fdf9</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.116" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-templates-8.0-8.0.116-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">31962c23f79bae59a15fb08e8c48e7fe5e8976d340fe0a34e75a831120eeb198</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7601</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es):

* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26646" id="CVE-2025-26646" type="cve" title="CVE-2025-26646" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2365317" id="2365317" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7601" id="RLSA-2025:7601" type="self" title="RLSA-2025:7601" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">29e72f17a57d888b5a3ed9b594059afd32e1664c47ad167958b402c68e83ad5c</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e791e64d8375f5caa1e970fc51510285f30b56ee1bfeeb3b748e716a19b7c5a7</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3c1bb33824d0a4f7bdd4c611df65e5416a9de602e3909fd56ee5915cfca7f471</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8ebf077e29a7810ed204ede184bd8d862b4c45ea109004045478f2438df2e8c7</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-host-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">186319456ef83970cf81b2a846bb31d4fa84dacd27f26eb9aeacae488a3acca4</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8c4f3478f89f3ab7520d6b41d9f9de9c33aebd63f54e30e244de0bb5233acaa4</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f308f45b2324473c7f48781adf497d2b527d7e9a1975a1d25fd45497eaba55dd</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8cc16b3c42814ec7047f3896d8461dd89e708a49fcda3a5d95316eb620a5891a</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3b314a3c7894c06988dcece55d973cfd42f98bc1c286d32e14bcd6e26b0e17de</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">abdbd5c282409b15febaddba8220c4bb257dcb03c0a454705b6eca8b539c9c22</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9585d8759ea3275360a5e6315de6f97924542229f84fcda1ecae89d9db313c88</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.5-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">43a3b483221a2b52f88b9517d832dba94d8c619987aa57bdb47fc040b9774878</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-templates-9.0-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">41f83dc2d6220e62cc12b9ca062254dc5056fd36031eb29e6d465c44c4879c9f</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.106-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">271def804dc9ac7627dbf2e55833511db5597d42a9390d22d2d634d1983a77a8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7892</id>
    <title>Important: grafana security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4123" id="CVE-2025-4123" type="cve" title="CVE-2025-4123" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2364632" id="2364632" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7892" id="RLSA-2025:7892" type="self" title="RLSA-2025:7892" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="17.el10_0" src="grafana-10.2.6-17.el10_0.src.rpm">
          <filename>grafana-10.2.6-17.el10_0.x86_64.rpm</filename>
          <sum type="sha256">98f2710f0993ab1b4309dee440cca877018da3f8d780f2be74dc0296e7ac5899</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="17.el10_0" src="grafana-10.2.6-17.el10_0.src.rpm">
          <filename>grafana-selinux-10.2.6-17.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f6badba70fc34869aa6b6b792b77d264eca32195efefac9fe87bdb7e9dbc2eaa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8047</id>
    <title>Moderate: unbound security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8508" id="CVE-2024-8508" type="cve" title="CVE-2024-8508" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2316321" id="2316321" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8047" id="RLSA-2025:8047" type="self" title="RLSA-2025:8047" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-unbound" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>python3-unbound-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">189faad55c71c1103536f0328d17ce4b1f0b23f2e8979dad6a83f427d40b4424</sum>
        </package>
        <package name="unbound" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dd86a42294f9867ee0518a95e4e63134f958701204de2541d6ef388784c85224</sum>
        </package>
        <package name="unbound-anchor" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-anchor-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0028c3dbb07a1f7d3dd7f4004fbe2ce6ee3835fb242905e5ab4690f198553bc1</sum>
        </package>
        <package name="unbound-dracut" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-dracut-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3951aa3e66adca42cd1633fb3e4a91d62ffc50b223decd90a222d5a3ac12ff7c</sum>
        </package>
        <package name="unbound-libs" arch="x86_64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-libs-1.20.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6ea2493c22b4b81d59b954ed77ebe1f83680298a5a803106bbf5dad90ddc09a4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8125</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)

* firefox: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4918" id="CVE-2025-4918" type="cve" title="CVE-2025-4918" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4919" id="CVE-2025-4919" type="cve" title="CVE-2025-4919" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367016" id="2367016" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367018" id="2367018" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8125" id="RLSA-2025:8125" type="self" title="RLSA-2025:8125" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.10.1" release="1.el10_0" src="firefox-128.10.1-1.el10_0.src.rpm">
          <filename>firefox-128.10.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b329dbb46adde07165c8d5ffcd03f060f4b87652bd06a0f9eac07b005ad69ce8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8128</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

* libsoup: Denial of service in server when client requests a large amount of  overlapping ranges with Range header (CVE-2025-32907)

* libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)

* libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32049" id="CVE-2025-32049" type="cve" title="CVE-2025-32049" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32907" id="CVE-2025-32907" type="cve" title="CVE-2025-32907" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4035" id="CVE-2025-4035" type="cve" title="CVE-2025-4035" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4948" id="CVE-2025-4948" type="cve" title="CVE-2025-4948" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357066" id="2357066" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359342" id="2359342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362651" id="2362651" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367183" id="2367183" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8128" id="RLSA-2025:8128" type="self" title="RLSA-2025:8128" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libsoup3" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.6" src="libsoup3-3.6.5-3.el10_0.6.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_0.6.x86_64.rpm</filename>
          <sum type="sha256">f29e0a4b17589325465b8ef7a415ea18a97c013435838f7a6711335c9661abf5</sum>
        </package>
        <package name="libsoup3-devel" arch="x86_64" epoch="0" version="3.6.5" release="3.el10_0.6" src="libsoup3-3.6.5-3.el10_0.6.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_0.6.x86_64.rpm</filename>
          <sum type="sha256">7a1e6c299bc4add67e0c398b48cfb486c204f68abbdc4b56f14245d63c6692ef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8131</id>
    <title>Moderate: ruby security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186)

* CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)

* uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25186" id="CVE-2025-25186" type="cve" title="CVE-2025-25186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27219" id="CVE-2025-27219" type="cve" title="CVE-2025-27219" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221" id="CVE-2025-27221" type="cve" title="CVE-2025-27221" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2344680" id="2344680" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2349699" id="2349699" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2349700" id="2349700" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8131" id="RLSA-2025:8131" type="self" title="RLSA-2025:8131" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ruby" arch="x86_64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-3.3.8-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">70ae95a297053e87cbb2e9341cca336a7c9f8a867ef60ff7a562882f2ae618e6</sum>
        </package>
        <package name="ruby-bundled-gems" arch="x86_64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-bundled-gems-3.3.8-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">89936986d2afc2161b8071165951bee3761164715b7cd629a73311473807f9fd</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-default-gems-3.3.8-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">2904c2be6de7adbab5728cba1bf5f581345a9ec634bf41d756b327d5df6cdc1d</sum>
        </package>
        <package name="ruby-devel" arch="x86_64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-devel-3.3.8-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5a20093ead897937ce445bc3e2bee224ed290d9cc056ae02cc8d6be710dffba7</sum>
        </package>
        <package name="rubygem-bigdecimal" arch="x86_64" epoch="0" version="3.1.5" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">46079b4b796342aa70c1c5894c9b5a877b6532b84c97a2f645e086b6a99b1976</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-bundler-2.5.22-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">d7b4cd0ea6f73904a04b3406e6ae24ec8054e6d370477622248c6da2d0cbba61</sum>
        </package>
        <package name="rubygem-io-console" arch="x86_64" epoch="0" version="0.7.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-io-console-0.7.1-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">87ac52e2d9bb3ce44e48e6aa84b7e235a5313254aa4356e86d4b7fa13edb477f</sum>
        </package>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-irb-1.13.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">47789a9d47f47375f2265bbfba6a021f98d2f2840f774b8c8dcb2d64a11c79f1</sum>
        </package>
        <package name="rubygem-json" arch="x86_64" epoch="0" version="2.7.2" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-json-2.7.2-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">cccb4ffae8ed26a79e679cc86c735f13ea845a4b1a68b7b52c8408b46b65dede</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-minitest-5.20.0-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">443713643e31df383a0adb8f57a219441de801e241bcb862d3be37542d8c3d72</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-power_assert-2.0.3-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">fd83ea41220fdd4bcd8e00f692c937507141e2fac3adae231441766600ac83a9</sum>
        </package>
        <package name="rubygem-psych" arch="x86_64" epoch="0" version="5.1.2" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-psych-5.1.2-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6f543d900d338437ce57036bf04f1eb5b08e3f6d5a9e00b6c6d1778abf737c7e</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rake-13.1.0-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">18f422e254af9edb5743dd00a53c2ce7a4d0e04939a2ab9ac711a7bd264a1e84</sum>
        </package>
        <package name="rubygem-rbs" arch="x86_64" epoch="0" version="3.4.0" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rbs-3.4.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d93ff9b87c443fcab891bf9534cfc659b1fa5de3c5c0677e1cd01ad4a075bc4f</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">656cedbc171c0d9924948b15bb319b8220c71e29a74a040d6f4a4f1b3358dde0</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.3.9" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rexml-3.3.9-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">f63afbc11ae33c3c780e6b46f2f7274c2ef874656cfb4633779181a508e8cf9a</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rss-0.3.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">312bb55e83f14b500d7a0e5c911f8745d5b5d06a3fcd847fb314c943deb18d1a</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygems-3.5.22-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">bb066d3068ce2da7cefc8f9f89d01e223d2870bd4a509e0aad5ebf7432a860be</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygems-devel-3.5.22-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">d44c057b948919daf238b6b1463d7b1c47c91420a539346ccc8436b77387b527</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-test-unit-3.6.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">cde1cbfe9e860af0cd849fb742cffa0fe5128ceb80f93497b3f8571fa0752517</sum>
        </package>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-typeprof-0.21.9-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">79fec13dace5e8b27fabccda2bf8904f5279779a88b3a67a4c156db8c03003da</sum>
        </package>
        <package name="ruby-libs" arch="x86_64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-libs-3.3.8-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a811f03c640287ffd60053dbd416ee4f060b57912d567fa6e0cba899c6e551ea</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8135</id>
    <title>Important: python-tornado security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-tornado.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47287" id="CVE-2025-47287" type="cve" title="CVE-2025-47287" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366703" id="2366703" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8135" id="RLSA-2025:8135" type="self" title="RLSA-2025:8135" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-tornado" arch="x86_64" epoch="0" version="6.4.2" release="1.el10_0.1" src="python-tornado-6.4.2-1.el10_0.1.src.rpm">
          <filename>python3-tornado-6.4.2-1.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">a000958cae7270e410a7c66849cbeea85cb91c411d01364bf8bb3416a8798498</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8184</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-bad-free.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3887" id="CVE-2025-3887" type="cve" title="CVE-2025-3887" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367919" id="2367919" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8184" id="RLSA-2025:8184" type="self" title="RLSA-2025:8184" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gstreamer1-plugins-bad-free" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_0" src="gstreamer1-plugins-bad-free-1.24.11-2.el10_0.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.24.11-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e6a0104c96cb43068cf5e534fbf4a72ceafd7e5e1d8a0ba846a6506156fbbf31</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="x86_64" epoch="0" version="1.24.11" release="2.el10_0" src="gstreamer1-plugins-bad-free-1.24.11-2.el10_0.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.24.11-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6c4cbda231626cc4a4a0402f167ccc46f39f9cd165f3288a91dfa8dc58f6c3b9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8196</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)

* thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)

* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)

* thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3875" id="CVE-2025-3875" type="cve" title="CVE-2025-3875" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3877" id="CVE-2025-3877" type="cve" title="CVE-2025-3877" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3909" id="CVE-2025-3909" type="cve" title="CVE-2025-3909" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3932" id="CVE-2025-3932" type="cve" title="CVE-2025-3932" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366283" id="2366283" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366287" id="2366287" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366291" id="2366291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366297" id="2366297" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8196" id="RLSA-2025:8196" type="self" title="RLSA-2025:8196" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.10.1" release="1.el10_0" src="thunderbird-128.10.1-1.el10_0.src.rpm">
          <filename>thunderbird-128.10.1-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">df38eef7d3514705fcb0c7be5a0e458f87fee4b6fa7d6d7a3c1399ea002a4d96</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8341</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)

* firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)

* firefox: thunderbird: Memory safety bugs (CVE-2025-5268)

* firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)

* firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)

* firefox: thunderbird: Memory safety bug (CVE-2025-5269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5263" id="CVE-2025-5263" type="cve" title="CVE-2025-5263" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5264" id="CVE-2025-5264" type="cve" title="CVE-2025-5264" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5266" id="CVE-2025-5266" type="cve" title="CVE-2025-5266" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5267" id="CVE-2025-5267" type="cve" title="CVE-2025-5267" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5268" id="CVE-2025-5268" type="cve" title="CVE-2025-5268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5269" id="CVE-2025-5269" type="cve" title="CVE-2025-5269" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5283" id="CVE-2025-5283" type="cve" title="CVE-2025-5283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368749" id="2368749" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368750" id="2368750" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368751" id="2368751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368752" id="2368752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368755" id="2368755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368756" id="2368756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368757" id="2368757" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8341" id="RLSA-2025:8341" type="self" title="RLSA-2025:8341" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.11.0" release="1.el10_0" src="firefox-128.11.0-1.el10_0.src.rpm">
          <filename>firefox-128.11.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3c07a0f3bcc326c61d866fb7492809e20822bb93398d11284404c095be4a1bc8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8477</id>
    <title>Moderate: golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8477" id="RLSA-2025:8477" type="self" title="RLSA-2025:8477" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-tests-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3215e7950d792a9a14b68b16cc720ae61ec83fe3b50223d9fb441bcaee76e7c9</sum>
        </package>
        <package name="golang" arch="x86_64" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-1.23.9-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6faa1847c883a4569a060f1f6c9c9d5e36228eaa78c9ff52e60d9a9c2ce57816</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-bin-1.23.9-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">921831308c55a262edbb2eb845c909b54a7e477f08e4c15daba9bd602295478c</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-docs-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">bdd2760b73c9324ad1b4499a8f0ac93db56f828057b077941bb8e625050d26a7</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-misc-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">69b802400d4176e7bad9d0c1f1b5d73e5b76c67b3e976c8e150d266ce45a7ced</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-src-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">431c56db3fafa2e52ebeaf24f7722efd266be7ac65dfbb6ce76ec106d22711b8</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>go-toolset-1.23.9-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a7ab5309bfb0665bcd87d7502ca18178c886850cde21d423ff84b4b2516788f5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8493</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23165" id="CVE-2025-23165" type="cve" title="CVE-2025-23165" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23166" id="CVE-2025-23166" type="cve" title="CVE-2025-23166" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367162" id="2367162" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367163" id="2367163" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8493" id="RLSA-2025:8493" type="self" title="RLSA-2025:8493" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="nodejs" arch="x86_64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-22.16.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e0a3bb6b73c924de382fdda4c2e31c8219df51688af75db1ac7adc756c20027c</sum>
        </package>
        <package name="nodejs-devel" arch="x86_64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-devel-22.16.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">86c85e51c743291cc691708da372f6c57b325c900c35bc4473a0d0304aed0e5c</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-docs-22.16.0-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f120d25fe9ff48ab63fa1691b7c726ce10a6aea9d36e5fd8d312b8da1618d995</sum>
        </package>
        <package name="nodejs-full-i18n" arch="x86_64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-full-i18n-22.16.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c1edee59ad58d62edc8dbfd89090e590e5cac438ecd29be812591c4999d714de</sum>
        </package>
        <package name="nodejs-libs" arch="x86_64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-libs-22.16.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">200941a2cd22cf289eab52ec40b0c5d557fd47af01d2f84a3c4f0a9aa3f3c356</sum>
        </package>
        <package name="nodejs-npm" arch="x86_64" epoch="1" version="10.9.2" release="1.22.16.0.1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-npm-10.9.2-1.22.16.0.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">87e9b446e12688563c6ab9d6db073d00cf52b91b9f7b9061b6af9cc0c8d7eb96</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8550</id>
    <title>Important: varnish security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for varnish.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

* varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47905" id="CVE-2025-47905" type="cve" title="CVE-2025-47905" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2364235" id="2364235" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8550" id="RLSA-2025:8550" type="self" title="RLSA-2025:8550" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="varnish" arch="x86_64" epoch="0" version="7.6.1" release="2.el10_0.1" src="varnish-7.6.1-2.el10_0.1.src.rpm">
          <filename>varnish-7.6.1-2.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">c20f035f05607334518cae9c3a647021a7f0c65029e69b632c7f535d4bccf3b2</sum>
        </package>
        <package name="varnish-docs" arch="x86_64" epoch="0" version="7.6.1" release="2.el10_0.1" src="varnish-7.6.1-2.el10_0.1.src.rpm">
          <filename>varnish-docs-7.6.1-2.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">f24c53c020983c8fe892c808c5a30718400dda1446876f02b55ed88d59a2dbd5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8608</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)

* firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)

* firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)

* firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)

* firefox: thunderbird: Memory safety bugs (CVE-2025-5268)

* firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)

* firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)

* firefox: thunderbird: Memory safety bug (CVE-2025-5269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4918" id="CVE-2025-4918" type="cve" title="CVE-2025-4918" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4919" id="CVE-2025-4919" type="cve" title="CVE-2025-4919" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5263" id="CVE-2025-5263" type="cve" title="CVE-2025-5263" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5264" id="CVE-2025-5264" type="cve" title="CVE-2025-5264" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5266" id="CVE-2025-5266" type="cve" title="CVE-2025-5266" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5267" id="CVE-2025-5267" type="cve" title="CVE-2025-5267" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5268" id="CVE-2025-5268" type="cve" title="CVE-2025-5268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5269" id="CVE-2025-5269" type="cve" title="CVE-2025-5269" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5283" id="CVE-2025-5283" type="cve" title="CVE-2025-5283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367016" id="2367016" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367018" id="2367018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368749" id="2368749" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368750" id="2368750" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368751" id="2368751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368752" id="2368752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368755" id="2368755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368756" id="2368756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368757" id="2368757" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8608" id="RLSA-2025:8608" type="self" title="RLSA-2025:8608" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.11.0" release="1.el10_0" src="thunderbird-128.11.0-1.el10_0.src.rpm">
          <filename>thunderbird-128.11.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f1c1dc755fe7f836cfdf0b57c7b735be55384302c33d8d3a29c1c10ea837d92c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8636</id>
    <title>Important: perl-FCGI security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-FCGI.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FastCGI Perl bindings.

Security Fix(es):

* perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library (CVE-2025-40907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40907" id="CVE-2025-40907" type="cve" title="CVE-2025-40907" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366847" id="2366847" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8636" id="RLSA-2025:8636" type="self" title="RLSA-2025:8636" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl-FCGI" arch="x86_64" epoch="1" version="0.82" release="13.1.el10_0" src="perl-FCGI-0.82-13.1.el10_0.src.rpm">
          <filename>perl-FCGI-0.82-13.1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">22fe2f5b524dee635bbe9b23e8e0bdc3e0e9e9ae2c5fac9a8ab4b6040507c91d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8666</id>
    <title>Moderate: grafana security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8666" id="RLSA-2025:8666" type="self" title="RLSA-2025:8666" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana" arch="x86_64" epoch="0" version="10.2.6" release="18.el10_0" src="grafana-10.2.6-18.el10_0.src.rpm">
          <filename>grafana-10.2.6-18.el10_0.x86_64.rpm</filename>
          <sum type="sha256">62723e03850e9397dd62929a702071525c3b5dab747adf56f2ce0f69b16f0ebc</sum>
        </package>
        <package name="grafana-selinux" arch="x86_64" epoch="0" version="10.2.6" release="18.el10_0" src="grafana-10.2.6-18.el10_0.src.rpm">
          <filename>grafana-selinux-10.2.6-18.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9163eb0ff2c707faa39102249b4a1dbc0be6461aec1be27b53dc25c2af805566</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8814</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es):

* dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30399" id="CVE-2025-30399" type="cve" title="CVE-2025-30399" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369701" id="2369701" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8814" id="RLSA-2025:8814" type="self" title="RLSA-2025:8814" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d7457edcf64104290e89bcd6e67d4888b2dd228c73c898f07eb813922525fc6c</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">81b3d47f6a07283b88335cf508da39043582841f6abf74d48e860a0b809d7437</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5ba66ceb0130590205e56adb6d115b7ac8a7d87e75b627d3b500fd529bd9be76</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">20efa2a1037ec127a623051ff884b32c9a0c8bb24caaaee5556002603ec05c4b</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c7377e1e5e2d62ef184fdfe03aef71d0687b6d67b56728475be71279a71360f4</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">64485edea771c314b7e90d1d3d1da8b69425d90c8c501f916dc6997b3b80cb31</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">de112ccd80614b9347597f4d0e66f3cc6df90ba7f42bfb5dab1f7b2b5d57ab9c</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="x86_64" epoch="0" version="8.0.117" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.117-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">538191263c89b69b9170ff0d73824be46167996ab7d741c6880899e9d4a58fa7</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="x86_64" epoch="0" version="8.0.117" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.117-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bd7328292046cda9b169fdff431231efd38059fc3bb9da02be930e973fefc795</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="x86_64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.17-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b8deca062cf0d57437e15f5d92b16022fc1e861b6fe1fb76978e8d64d1c67bd9</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="x86_64" epoch="0" version="8.0.117" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-templates-8.0-8.0.117-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c35bd8d3d10e3984f953fc85da86334b2e69cae1749f0cc99cf4f8cf409d9f0a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8816</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es):

* dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30399" id="CVE-2025-30399" type="cve" title="CVE-2025-30399" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369701" id="2369701" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8816" id="RLSA-2025:8816" type="self" title="RLSA-2025:8816" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aspnetcore-runtime-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">705c491227203f85fe6499e8e02ad3015176324ead6195f39985c5eb01d86f52</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f052f013d30c77fc2ac9c9466a22181bd055019b93d82548dd94fd7e5c9aa3a7</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">652ea2e12d972630d963f998463286cc3704f7ade5190a394bf7fa6251c5513a</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">32619a78651556c03ed237d2909c8c846f516deb832683d3b207098c30481b02</sum>
        </package>
        <package name="dotnet-host" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-host-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bf48a5f3cc792ec3540947f59fccdbfdd9124824c5ffe75939b14de6f0b2ea2d</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">016df7700bf1c5268e708a87b76369ad7c46c73759b72ad667cf02e47447c9ad</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a9034080fadfd40c5c1688fa55cb61f649852fe4441dace19a0db77a3adf107e</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0ba7bc5bd42669e0ed5b2a8c606f2419fb6a7bbe2dea3780529b1048317abfac</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a1dbb49c11eb2d61bb5208edacb66ab385ede8682d8c3a642bd661db6b36e6e7</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a0ca032b71f16e9278c4b46b350b98a851b7866ee782d660da4975c9ea2aae5c</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">deb362101e4b64949568e6ecf0b17870eeeeb67490aab4e38a1e3c571d0a529d</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="x86_64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0e123835604160ac584d89fbc0bcd7870d31dedd3b91a49f64d2ec4acf843544</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-templates-9.0-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">49adfb4f8c2a633e811b2ab82c20851aea023c299973f1796e56c66104ddb068</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="x86_64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.107-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bf590a6382cb40226366e696d9dcef5665ade53de545d21198ea8b16bb1777ce</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8915</id>
    <title>Moderate: grafana-pcp security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8915" id="RLSA-2025:8915" type="self" title="RLSA-2025:8915" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="grafana-pcp" arch="x86_64" epoch="0" version="5.2.2" release="3.el10_0" src="grafana-pcp-5.2.2-3.el10_0.src.rpm">
          <filename>grafana-pcp-5.2.2-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">cd3df4b2432f3a954d7188e94c7652e52c30bb1a4bfccfae21d9cec5c528af78</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9063</id>
    <title>Moderate: git-lfs security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9063" id="RLSA-2025:9063" type="self" title="RLSA-2025:9063" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="git-lfs" arch="x86_64" epoch="0" version="3.6.1" release="2.el10_0" src="git-lfs-3.6.1-2.el10_0.src.rpm">
          <filename>git-lfs-3.6.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1c545e395f9feb53671d3ce7cfcba7a39e8b398c89c03a50dfd19584be853037</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9120</id>
    <title>Important: libvpx security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libvpx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

* libvpx: Double-free in libvpx encoder (CVE-2025-5283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5283" id="CVE-2025-5283" type="cve" title="CVE-2025-5283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368749" id="2368749" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9120" id="RLSA-2025:9120" type="self" title="RLSA-2025:9120" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libvpx" arch="x86_64" epoch="0" version="1.14.1" release="3.el10_0" src="libvpx-1.14.1-3.el10_0.src.rpm">
          <filename>libvpx-1.14.1-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f1c002b0172b5ffe79cdceac98fb2d2d793ce38280bf84b40704a7f4330d6da0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9121</id>
    <title>Moderate: wireshark security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Uncontrolled Recursion in Wireshark (CVE-2025-1492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1492" id="CVE-2025-1492" type="cve" title="CVE-2025-1492" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2346737" id="2346737" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9121" id="RLSA-2025:9121" type="self" title="RLSA-2025:9121" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="wireshark" arch="x86_64" epoch="1" version="4.4.2" release="3.el10_0" src="wireshark-4.4.2-3.el10_0.src.rpm">
          <filename>wireshark-4.4.2-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c6f11b228aea2c3e711af4b8938367d80ef51d2652de6e52fa18dbb8a16d7bf6</sum>
        </package>
        <package name="wireshark-cli" arch="x86_64" epoch="1" version="4.4.2" release="3.el10_0" src="wireshark-4.4.2-3.el10_0.src.rpm">
          <filename>wireshark-cli-4.4.2-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">aeb95e2aeb9a2276ef09580609cb934ede3119b27832303d651492fa572d6176</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9148</id>
    <title>Moderate: buildah security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9148" id="RLSA-2025:9148" type="self" title="RLSA-2025:9148" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="buildah" arch="x86_64" epoch="2" version="1.39.4" release="2.el10_0" src="buildah-1.39.4-2.el10_0.src.rpm">
          <filename>buildah-1.39.4-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">dd92f9af51c1f497e10caa6e8d25ab1bcd044e9c784b31e592a9d474f5d13a54</sum>
        </package>
        <package name="buildah-tests" arch="x86_64" epoch="2" version="1.39.4" release="2.el10_0" src="buildah-1.39.4-2.el10_0.src.rpm">
          <filename>buildah-tests-1.39.4-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5d6ab8d2b67d54722aa9929e4cc13b1a31221d2004fb4ec158212231e18c33f1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9146</id>
    <title>Moderate: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9146" id="RLSA-2025:9146" type="self" title="RLSA-2025:9146" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="6" version="5.4.0" release="10.el10_0" src="podman-5.4.0-10.el10_0.src.rpm">
          <filename>podman-5.4.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ac6b808b6d96e1432e7c69cbaf4d400959c8c0336bc934e5d832b88be6c7d5e4</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="10.el10_0" src="podman-5.4.0-10.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">72ee4b59f086d755726270ee648923634a2c7363eaecb7668975444143214d9f</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="6" version="5.4.0" release="10.el10_0" src="podman-5.4.0-10.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-10.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ab29ed6dbed2382d192acd0ba0218c1432b7a0dc16f659ae9829acf0cd6648b1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9149</id>
    <title>Moderate: skopeo security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9149" id="RLSA-2025:9149" type="self" title="RLSA-2025:9149" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="skopeo" arch="x86_64" epoch="2" version="1.18.1" release="2.el10_0" src="skopeo-1.18.1-2.el10_0.src.rpm">
          <filename>skopeo-1.18.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c7c0b6bdc3637038ea43981f6f352e50901b153409a6481ae24d3742922d806a</sum>
        </package>
        <package name="skopeo-tests" arch="x86_64" epoch="2" version="1.18.1" release="2.el10_0" src="skopeo-1.18.1-2.el10_0.src.rpm">
          <filename>skopeo-tests-1.18.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">46087c9efe78988ed397604f87cf55f004867f2372a9bcfe25612cee8e2c2806</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9151</id>
    <title>Moderate: gvisor-tap-vsock security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gvisor-tap-vsock.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9151" id="RLSA-2025:9151" type="self" title="RLSA-2025:9151" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gvisor-tap-vsock" arch="x86_64" epoch="6" version="0.8.5" release="2.el10_0" src="gvisor-tap-vsock-0.8.5-2.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-0.8.5-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d8da08df95c7101b812fc44286073a5bd8105e4aa182a10fcc844aafa5612aa4</sum>
        </package>
        <package name="gvisor-tap-vsock-gvforwarder" arch="x86_64" epoch="6" version="0.8.5" release="2.el10_0" src="gvisor-tap-vsock-0.8.5-2.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-gvforwarder-0.8.5-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">615e3023b9c853f240e62e60cd3fc850c3d95af1a155e2c09b8e8ff83fc55c37</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9156</id>
    <title>Moderate: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9156" id="RLSA-2025:9156" type="self" title="RLSA-2025:9156" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipp-usb" arch="x86_64" epoch="0" version="0.9.27" release="3.el10_0" src="golang-github-openprinting-ipp-usb-0.9.27-3.el10_0.src.rpm">
          <filename>ipp-usb-0.9.27-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0c2430bb72e5d3121209085be5a704cde4ab75affd241d021da44da388313ad6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9190</id>
    <title>Important: ipa security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ipa.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4404" id="CVE-2025-4404" type="cve" title="CVE-2025-4404" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2364606" id="2364606" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9190" id="RLSA-2025:9190" type="self" title="RLSA-2025:9190" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="ipa-client" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">db6e504bd578f3415fa12d81edb0f9e2a91fb85775aa9310e0b6bdb72b55b70e</sum>
        </package>
        <package name="ipa-client-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-common-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">6c1ae01a5131f824bf97c644496f68706f567b22085c430ca56bc03afb053207</sum>
        </package>
        <package name="ipa-client-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-encrypted-dns-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">d6a65274cbeeb61ac418a710f7681dafd11ac44cb5af1e36c3a087fb683bbf84</sum>
        </package>
        <package name="ipa-client-epn" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-epn-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">bd0c5c3276c9d3b414594cabc0b8a85559da55fcfff3bfc347d0e64ee9485a00</sum>
        </package>
        <package name="ipa-client-samba" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-samba-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">1b2db2f76203e45beaa4dd209eb334b82d7ba40ad12d54f4b78c1e4c3f64ad32</sum>
        </package>
        <package name="ipa-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-common-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">bd4658263915b86e0754a48dfef208eb3a06aeacef66b87e1e3e413c2c0d9423</sum>
        </package>
        <package name="ipa-selinux" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-selinux-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">9392af39d79b05f3d3584c5e2f8defe0aa763b7c26df19606b6ae69882e9d7f4</sum>
        </package>
        <package name="ipa-selinux-luna" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-selinux-luna-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">862cf3612971baf244e116d8f0860b18b99683e48e3a976f62be514c9e5ebe81</sum>
        </package>
        <package name="ipa-selinux-nfast" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-selinux-nfast-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">da232069356f6a7fed12c9b12c17d4e08adda805fbe718e9ffe83ce286498881</sum>
        </package>
        <package name="ipa-server" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">8bb7773a3a1e38ecfd6f53f344bb266d5ff6ad1bcd55d1745de95ecb8faa7502</sum>
        </package>
        <package name="ipa-server-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-common-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">89236fce67fe052cb19173070c2f50c2b514b865567328686e46a6f845ab302c</sum>
        </package>
        <package name="ipa-server-dns" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-dns-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">7303e5d8311880f7cae2058f4ed51096749cd5afa1d58e4303823207aefcfce4</sum>
        </package>
        <package name="ipa-server-encrypted-dns" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-encrypted-dns-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">00fe2c1ef71caa6780b937e2d5df5c59aaf3e616c7184b9a77d765411b8fc63c</sum>
        </package>
        <package name="ipa-server-trust-ad" arch="x86_64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-trust-ad-4.12.2-15.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">ea76d4074cccf30c0a4847af1c0e4109adc09cf47f4ec062dfce5f6385bb0b01</sum>
        </package>
        <package name="python3-ipaclient" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>python3-ipaclient-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">3acf20126fa2ebd03bd719db4b3fdee63e40f34cfc4a805cca9042354485004c</sum>
        </package>
        <package name="python3-ipalib" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>python3-ipalib-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">8296ccacd4fbd8cea4f94f0f3442e6dac1ef32e62d3c197cdfe69cdb6876b69b</sum>
        </package>
        <package name="python3-ipaserver" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>python3-ipaserver-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">9c5d1580ae5902f184e00a231e6482c31dcb76da4b9d3d4feaea0d772ff7bbd7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9304</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49175" id="CVE-2025-49175" type="cve" title="CVE-2025-49175" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49176" id="CVE-2025-49176" type="cve" title="CVE-2025-49176" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49177" id="CVE-2025-49177" type="cve" title="CVE-2025-49177" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49178" id="CVE-2025-49178" type="cve" title="CVE-2025-49178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49179" id="CVE-2025-49179" type="cve" title="CVE-2025-49179" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49180" id="CVE-2025-49180" type="cve" title="CVE-2025-49180" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369947" id="2369947" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369954" id="2369954" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369955" id="2369955" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369977" id="2369977" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369978" id="2369978" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369981" id="2369981" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9304" id="RLSA-2025:9304" type="self" title="RLSA-2025:9304" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="x86_64" epoch="0" version="24.1.5" release="4.el10_0" src="xorg-x11-server-Xwayland-24.1.5-4.el10_0.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6de43e3d252b64ddb0345445ad0d3fb4f995b2b9bace0d4aa8aa2d1010dd46a7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9317</id>
    <title>Moderate: delve security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9317" id="RLSA-2025:9317" type="self" title="RLSA-2025:9317" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="delve" arch="x86_64" epoch="0" version="1.24.1" release="2.el10_0" src="delve-1.24.1-2.el10_0.src.rpm">
          <filename>delve-1.24.1-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7efb8b95af246a461f1bfa2211d04b463f8c62b92a5ad8870f0887e0dabdc0ef</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9307</id>
    <title>Moderate: freerdp security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* gnome-remote-desktop: freerdp: Unauthenticated RDP Packet Causes Segfault in FreeRDP Leading to Denial of Service (CVE-2025-4478)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4478" id="CVE-2025-4478" type="cve" title="CVE-2025-4478" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2365232" id="2365232" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9307" id="RLSA-2025:9307" type="self" title="RLSA-2025:9307" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="freerdp" arch="x86_64" epoch="2" version="3.10.3" release="3.el10_0" src="freerdp-3.10.3-3.el10_0.src.rpm">
          <filename>freerdp-3.10.3-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">63ea45b480edbf4d06bd0c1cb4d383718aa3e8a032927e7602bc342507878523</sum>
        </package>
        <package name="freerdp-libs" arch="x86_64" epoch="2" version="3.10.3" release="3.el10_0" src="freerdp-3.10.3-3.el10_0.src.rpm">
          <filename>freerdp-libs-3.10.3-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">afd55ffed579ade915ed95ef2773ee4f41e1171fb76301199d01796bd1f1cbb9</sum>
        </package>
        <package name="libwinpr" arch="x86_64" epoch="2" version="3.10.3" release="3.el10_0" src="freerdp-3.10.3-3.el10_0.src.rpm">
          <filename>libwinpr-3.10.3-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">aa25ad4ab52995d2eb921fdea33f90ec4be3bd3533ba05d63e26ee4e75dfe18c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9328</id>
    <title>Important: libblockdev security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libblockdev.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID.

Security Fix(es):

* libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6019" id="CVE-2025-6019" type="cve" title="CVE-2025-6019" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2370051" id="2370051" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9328" id="RLSA-2025:9328" type="self" title="RLSA-2025:9328" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libblockdev" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d3a7f854798a5c6f6bb4621a08f0ec8e3771d7a29b0b61b4cc58dd365a92f7c8</sum>
        </package>
        <package name="libblockdev-crypto" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-crypto-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ce607a7814a0258101428f48a3ba09e03d68537dab4b54f55c8888e6a34a3681</sum>
        </package>
        <package name="libblockdev-dm" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-dm-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d14ce2625bea643ce8992ac7fb0a1c204d072a3f9484e667b3f7b9f229f56e4b</sum>
        </package>
        <package name="libblockdev-fs" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-fs-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e87b6e47a75db6a58bf782e1985a1dd4a33ea1afd0427e0aa48c9eb7c8b48878</sum>
        </package>
        <package name="libblockdev-loop" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-loop-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4543b21854976b9630426528012417f68c24532d1520b10c1ef0cfe1981174cc</sum>
        </package>
        <package name="libblockdev-lvm" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-lvm-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3a92cd5fcede975c771f81d08a5beb23be6a3b8e05c9f0ec190921e87638103d</sum>
        </package>
        <package name="libblockdev-lvm-dbus" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-lvm-dbus-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0508435a8b5a3552306013b4b6b733369b5c1693958ab4f6c2541b2795b54fe3</sum>
        </package>
        <package name="libblockdev-mdraid" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-mdraid-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">be9c8c67a1ca81bc6fc6364a928920b4abd1d633039986949453f02287baad27</sum>
        </package>
        <package name="libblockdev-mpath" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-mpath-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0c843a1d371bd2d338f6faeb6ebd6e8e19c8a58b6ebe3f631f399670af3979f4</sum>
        </package>
        <package name="libblockdev-nvdimm" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-nvdimm-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">53a4f5b0e2a3f64d460b9598bb9c5c3723947691dd46f1ffe1c58d1e29dcba88</sum>
        </package>
        <package name="libblockdev-nvme" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-nvme-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7fd761c59339de103b02bfafe12aeee0f5760217712f74a866268fd59dfbf3ea</sum>
        </package>
        <package name="libblockdev-part" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-part-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">46c08fbd4a93e47f6e7448ea31117e66cb457ab7509d6938f445a9736452abbd</sum>
        </package>
        <package name="libblockdev-plugins-all" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-plugins-all-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">227a181b251a28d6c4bb8d9d9c6deb9aedfdf14fe18f8cd87c9bfd8989b32d75</sum>
        </package>
        <package name="libblockdev-smart" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-smart-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8b698c8a0be374d0f622cb06b9ef608718b17aa47c5b22b826b6b9be60fe037a</sum>
        </package>
        <package name="libblockdev-smartmontools" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-smartmontools-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8586c0fa291f9ccdcfdebce9b9399d0e78d4fd7b3e16229dc637b19316400ff6</sum>
        </package>
        <package name="libblockdev-swap" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-swap-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">845e717de94c76b1e951d8447136ba27dc8f623c2fa47c67477745d136213f08</sum>
        </package>
        <package name="libblockdev-tools" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-tools-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6601c86706b4cf638ae995220a1d9a696dbb09370864a2a7c1e162c5eae3f920</sum>
        </package>
        <package name="libblockdev-utils" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-utils-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">11f89b9359ba8e7da8d59181e516c84dab609393f7fad876f82f7f557f677717</sum>
        </package>
        <package name="python3-blockdev" arch="x86_64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>python3-blockdev-3.2.0-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">07060a3647bd8c164f6c16346c786c8868ee935777f9dac156e75967096a199f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9466</id>
    <title>Moderate: mod_proxy_cluster security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_proxy_cluster.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.

Security Fix(es):

* mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10306" id="CVE-2024-10306" type="cve" title="CVE-2024-10306" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2321302" id="2321302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9466" id="RLSA-2025:9466" type="self" title="RLSA-2025:9466" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_proxy_cluster" arch="x86_64" epoch="0" version="1.3.22" release="1.el10_0.2" src="mod_proxy_cluster-1.3.22-1.el10_0.2.src.rpm">
          <filename>mod_proxy_cluster-1.3.22-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">2e606a51f4c524fa2d00d86a382c16db1e47539ff5edb32c6868bd5ed54a76c1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9486</id>
    <title>Moderate: qt6-qtbase security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qt6-qtbase.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Qt is a software toolkit for developing applications.  This package contains base tools, like string, xml, and network handling.

Security Fix(es):

* qt5: qt6: QtCore Assertion Failure Denial of Service (CVE-2025-5455)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5455" id="CVE-2025-5455" type="cve" title="CVE-2025-5455" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369722" id="2369722" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9486" id="RLSA-2025:9486" type="self" title="RLSA-2025:9486" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="qt6-qtbase" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2de3a60b2ccf066a9ae487a6abf862f85574ad6c89e0a110ce2153ebbdf623c8</sum>
        </package>
        <package name="qt6-qtbase-common" arch="noarch" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-common-6.8.1-9.el10_0.noarch.rpm</filename>
          <sum type="sha256">1cb71dc28df65692eeb4c2716a3648f044980fa7291152664beaccd2b7f5185e</sum>
        </package>
        <package name="qt6-qtbase-devel" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-devel-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6710f0b133f7348dfab7e7673e7061c516b01d1ce553b1aa979cc5bccb14ecf4</sum>
        </package>
        <package name="qt6-qtbase-gui" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-gui-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1e68bcf33a86231f5644a251e479bea888dae70562911fb3e9aedad40cdd7e2e</sum>
        </package>
        <package name="qt6-qtbase-mysql" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-mysql-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4bb179ef2aa0405528af0b57977da96245a7b898ce0c1366f0c3a386e77b626e</sum>
        </package>
        <package name="qt6-qtbase-odbc" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-odbc-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5669abff6d8d77e5bd31c7c68aa16dc0577e9826ed2e2a40b35094dcd60d11c2</sum>
        </package>
        <package name="qt6-qtbase-postgresql" arch="x86_64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-postgresql-6.8.1-9.el10_0.x86_64.rpm</filename>
          <sum type="sha256">91a8f6417b7e9e8235a0d367e8470f52f7856aa607c4b8b26de038285c394a93</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10073</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430)

* firefox: Use-after-free in FontFaceSet (CVE-2025-6424)

* firefox: Incorrect parsing of URLs could have allowed embedding of youtube.com (CVE-2025-6429)

* firefox: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVE-2025-6425)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6424" id="CVE-2025-6424" type="cve" title="CVE-2025-6424" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6425" id="CVE-2025-6425" type="cve" title="CVE-2025-6425" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6429" id="CVE-2025-6429" type="cve" title="CVE-2025-6429" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6430" id="CVE-2025-6430" type="cve" title="CVE-2025-6430" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374555" id="2374555" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374559" id="2374559" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374561" id="2374561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374562" id="2374562" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10073" id="RLSA-2025:10073" type="self" title="RLSA-2025:10073" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.12.0" release="1.el10_0" src="firefox-128.12.0-1.el10_0.src.rpm">
          <filename>firefox-128.12.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">caf622e42b0973dd60f92c487b4c3fcbf93d4117974a26e80143eea23fd77114</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10195</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-5986)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5986" id="CVE-2025-5986" type="cve" title="CVE-2025-5986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6424" id="CVE-2025-6424" type="cve" title="CVE-2025-6424" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6425" id="CVE-2025-6425" type="cve" title="CVE-2025-6425" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6429" id="CVE-2025-6429" type="cve" title="CVE-2025-6429" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6430" id="CVE-2025-6430" type="cve" title="CVE-2025-6430" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2372281" id="2372281" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374555" id="2374555" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374559" id="2374559" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374561" id="2374561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374562" id="2374562" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10195" id="RLSA-2025:10195" type="self" title="RLSA-2025:10195" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.12.0" release="1.el10_0" src="thunderbird-128.12.0-1.el10_0.src.rpm">
          <filename>thunderbird-128.12.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1a548cb962b29751d4c1496a61f2aeab52c776c11d5da114481e3c686ef04bc9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10549</id>
    <title>Important: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: podman missing TLS verification (CVE-2025-6032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6032" id="CVE-2025-6032" type="cve" title="CVE-2025-6032" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2372501" id="2372501" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10549" id="RLSA-2025:10549" type="self" title="RLSA-2025:10549" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="6" version="5.4.0" release="12.el10_0" src="podman-5.4.0-12.el10_0.src.rpm">
          <filename>podman-5.4.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">f55513d20fbf5bd077f99edc0b5a0d087f8b5a39d83755436d1b023f1223fec9</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="12.el10_0" src="podman-5.4.0-12.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-12.el10_0.noarch.rpm</filename>
          <sum type="sha256">50e57d06c0b4b9b5f81adc49cece6f8a36edbae57426c6f6b3b6cf9939b0ab15</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="6" version="5.4.0" release="12.el10_0" src="podman-5.4.0-12.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">50e674970307310bd884f2512522086fcc066269629714f3f69cc7cc30f44369</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10635</id>
    <title>Moderate: gnome-remote-desktop security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gnome-remote-desktop.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.

Security Fix(es):

* gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs (CVE-2025-5024)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5024" id="CVE-2025-5024" type="cve" title="CVE-2025-5024" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367717" id="2367717" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10635" id="RLSA-2025:10635" type="self" title="RLSA-2025:10635" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gnome-remote-desktop" arch="x86_64" epoch="0" version="47.3" release="2.el10_0" src="gnome-remote-desktop-47.3-2.el10_0.src.rpm">
          <filename>gnome-remote-desktop-47.3-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d640623005dd3b46759cf12b050d0243b828edde9a7c656d7c334cd5e2625775</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10677</id>
    <title>Moderate: golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4673" id="CVE-2025-4673" type="cve" title="CVE-2025-4673" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373305" id="2373305" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10677" id="RLSA-2025:10677" type="self" title="RLSA-2025:10677" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang" arch="x86_64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-1.24.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">47bcbc253bddea0ab4e17a0e7df155ef958cbeb647df179475b38109434c58ed</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-bin-1.24.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">725364e1f2a3f34187adb648235ef1637638a0dd1d27bf4deb40391005e2e578</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-docs-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f55ec9fb24d751ffe3187f8ca6c2726708bdf26cc2e04ed86d7500edf65a2eb9</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-misc-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c34922495aa0d17cd7ea49e63ba69169799423420eaf62cebd336663b16ba28a</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-race-1.24.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d398fefc9e578487f12aeba645b25156f05264fff13cd852d033b3df2ede8dd3</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-src-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f49a704a94a6fae26328780398d8a6f588082da9aa5dafa3d777cf1a0eb27434</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-tests-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e2ce7eb27332c70ecc199fc129838f7f8b37a285a616b50b04779e5e62e0c77f</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>go-toolset-1.24.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d8822654a0f59980f51d80b83aea1db0a28173f3de5f5da28a748c1750186ed0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10873</id>
    <title>Important: java-21-openjdk security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for java-21-openjdk.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

* JDK: Better Glyph drawing (CVE-2025-30749)
* JDK: Enhance TLS protocol support (CVE-2025-30754)
* JDK: Improve HTTP client header handling (CVE-2025-50059)
* JDK: Better Glyph drawing redux (CVE-2025-50106)

Bug Fix(es):

* In Rocky Linux 9 and Rocky Linux 10 systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (Rocky Linux-102683, Rocky Linux-102684, Rocky Linux-102685)
* On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (Rocky Linux-90307, Rocky Linux-90308, Rocky Linux-90311)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30749" id="CVE-2025-30749" type="cve" title="CVE-2025-30749" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30754" id="CVE-2025-30754" type="cve" title="CVE-2025-30754" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50059" id="CVE-2025-50059" type="cve" title="CVE-2025-50059" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50106" id="CVE-2025-50106" type="cve" title="CVE-2025-50106" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376783" id="2376783" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376784" id="2376784" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376785" id="2376785" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379031" id="2379031" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10873" id="RLSA-2025:10873" type="self" title="RLSA-2025:10873" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="java-21-openjdk" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">414b7b019f3d764f5085a9391a9da59c4217d3d5fbaa0f6eb528d82d30501c3f</sum>
        </package>
        <package name="java-21-openjdk-demo" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-demo-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">51cdacc5c442cfcc0a19b02c6631bc03a410700a02b9dcfb4984c2722d41ac7d</sum>
        </package>
        <package name="java-21-openjdk-devel" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-devel-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">75103cb2346fd169dbdf0ebc0f3c505f5028484edaab82597189d240b1cb60ec</sum>
        </package>
        <package name="java-21-openjdk-headless" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-headless-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">61e05b22711cd5ac0605a11d66198c1bb013f556e25ee2b1af0b9f343a262eae</sum>
        </package>
        <package name="java-21-openjdk-javadoc" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-javadoc-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">f31686b03b8f9653d851f7a888884dc250cc187b6ee3c515db17308b23eb0937</sum>
        </package>
        <package name="java-21-openjdk-javadoc-zip" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-javadoc-zip-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">20b79b5308c23166b48408ba4eeb67734a4b4d20838f472d9d8f6c2e345876e8</sum>
        </package>
        <package name="java-21-openjdk-jmods" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-jmods-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">55f8d134798e069b709c2c46ce4d30ddbb8cbcf7a952b032daccc8017806cf90</sum>
        </package>
        <package name="java-21-openjdk-src" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-src-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">927695c96d9cd38503339ef6e3d4fff73a528093e984b5f1dcf0b33a7edbc032</sum>
        </package>
        <package name="java-21-openjdk-static-libs" arch="x86_64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-static-libs-21.0.8.0.9-1.el10.x86_64.rpm</filename>
          <sum type="sha256">cd93b8ff3d5244e9933e22c1aa8df2e92cb892e1dd69aa4d9a45765db013e3b1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:11332</id>
    <title>Important: tomcat9 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337)

* tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56337" id="CVE-2024-56337" type="cve" title="CVE-2024-56337" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31650" id="CVE-2025-31650" type="cve" title="CVE-2025-31650" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2333521" id="2333521" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362783" id="2362783" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:11332" id="RLSA-2025:11332" type="self" title="RLSA-2025:11332" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">7c11353e58e4822db9739e90e1b99462f3be11ed491be1beb1be7807545181bd</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">3d6851aa27bf852945314cbad8a11ba59df3e3cbe7ed6ac0e5a5f29c58225d40</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">a9f4d0eeabb6df8ffa9e7a332446f5a161ada29c77a0d38fb801fc826504e033</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">38b76b62dec96d2400b4a5030c61a93d6865897a63fd032a2b9f1076eafe9c2d</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">cf01a3d83ada8424330926b49aaa536c4dfb24576f057cc989a0b3a14c441883</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-lib-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">29e509374ef0700c32eb589736d9d80bddbe255b252cd9f927e1e3f21bf5ec3e</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">0ca600cd745cbb59544aafe2278a75381d4da269d7ac01aaeb9b61eba69210df</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-webapps-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">f5b988b6558b3992d98428ec7af5cf620fc24157d925e3ab1cb9fa27488fa459</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:11401</id>
    <title>Important: valkey security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Redis Stack Buffer Overflow (CVE-2025-27151)

* redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)

* redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27151" id="CVE-2025-27151" type="cve" title="CVE-2025-27151" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32023" id="CVE-2025-32023" type="cve" title="CVE-2025-32023" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48367" id="CVE-2025-48367" type="cve" title="CVE-2025-48367" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369153" id="2369153" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376857" id="2376857" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376858" id="2376858" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:11401" id="RLSA-2025:11401" type="self" title="RLSA-2025:11401" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="valkey" arch="x86_64" epoch="0" version="8.0.4" release="1.el10_0" src="valkey-8.0.4-1.el10_0.src.rpm">
          <filename>valkey-8.0.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2d12afb4fcd325b1488ccdac49769189bf63f6b732c1a24badd090cb0a7372bb</sum>
        </package>
        <package name="valkey-devel" arch="x86_64" epoch="0" version="8.0.4" release="1.el10_0" src="valkey-8.0.4-1.el10_0.src.rpm">
          <filename>valkey-devel-8.0.4-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">23141aafa373e629b37c23cbe6e950f1d2c56d437b8c335ea2863ded3c76a87b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:11797</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

* firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

* firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

* firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

* firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

* firefox: Memory safety bugs (CVE-2025-8034)

* firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

* firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

* firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8027" id="CVE-2025-8027" type="cve" title="CVE-2025-8027" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8028" id="CVE-2025-8028" type="cve" title="CVE-2025-8028" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8029" id="CVE-2025-8029" type="cve" title="CVE-2025-8029" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8030" id="CVE-2025-8030" type="cve" title="CVE-2025-8030" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8031" id="CVE-2025-8031" type="cve" title="CVE-2025-8031" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8032" id="CVE-2025-8032" type="cve" title="CVE-2025-8032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8033" id="CVE-2025-8033" type="cve" title="CVE-2025-8033" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8034" id="CVE-2025-8034" type="cve" title="CVE-2025-8034" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8035" id="CVE-2025-8035" type="cve" title="CVE-2025-8035" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382701" id="2382701" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382703" id="2382703" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382704" id="2382704" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382707" id="2382707" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382710" id="2382710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382711" id="2382711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382717" id="2382717" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382718" id="2382718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382720" id="2382720" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:11797" id="RLSA-2025:11797" type="self" title="RLSA-2025:11797" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.13.0" release="1.el10_0" src="firefox-128.13.0-1.el10_0.src.rpm">
          <filename>firefox-128.13.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">ba59deecd32c170f47287be1d7a4f4096af6a9e8232c940727bac9af3aeec264</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12056</id>
    <title>Moderate: perl security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for perl.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

* perl: Perl threads have a working directory race condition where file operations may target unintended paths (CVE-2025-40909)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40909" id="CVE-2025-40909" type="cve" title="CVE-2025-40909" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369407" id="2369407" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12056" id="RLSA-2025:12056" type="self" title="RLSA-2025:12056" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="perl" arch="x86_64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b265994fcf986e3a92ee5a3969a0afb7989c9fa336f4c24305b867e4169d09b7</sum>
        </package>
        <package name="perl-Attribute-Handlers" arch="noarch" epoch="0" version="1.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Attribute-Handlers-1.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a50a47c9c8189cf7eec48d586f8816aa6273e5a84e24c8b38c98b3396378e0d7</sum>
        </package>
        <package name="perl-AutoLoader" arch="noarch" epoch="0" version="5.74" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-AutoLoader-5.74-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d11dee873d7d98224cb8b63b805b266025ff6e7a7c0bbddea102a1aef6b4c1ef</sum>
        </package>
        <package name="perl-AutoSplit" arch="noarch" epoch="0" version="5.74" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-AutoSplit-5.74-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">fc83da5b9f60869db73ea9335d11b087da8977bab44b669d2fc21d5ce7eedbdf</sum>
        </package>
        <package name="perl-autouse" arch="noarch" epoch="0" version="1.11" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-autouse-1.11-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">022a86f3a5975a041799ad17b807e59e335f57a29b3fcd9e7624ae13d9fc343f</sum>
        </package>
        <package name="perl-B" arch="x86_64" epoch="0" version="1.89" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-B-1.89-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d588891d25ed85721f393261d4ce734628f224ef96f7e63fdfbe148473bde45b</sum>
        </package>
        <package name="perl-base" arch="noarch" epoch="0" version="2.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-base-2.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">23294c4ee06f04f99e734a520e7118b3f69b4e973afdcfa435e7fdffacb6cb30</sum>
        </package>
        <package name="perl-Benchmark" arch="noarch" epoch="0" version="1.25" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Benchmark-1.25-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7f17cc9401a6998858fbfc634fd8cacb305dd95c5557fa60dd1efc7f9e40dd6c</sum>
        </package>
        <package name="perl-blib" arch="noarch" epoch="0" version="1.07" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-blib-1.07-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">26f1caf1fa8a54fea467f5e126a8b9d295cc763ee5e84029137ee6dd9ad12668</sum>
        </package>
        <package name="perl-Class-Struct" arch="noarch" epoch="0" version="0.68" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Class-Struct-0.68-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">142b33b254ad949b08e59aa746019c53c09a6f9b1e8f16612c23a2222c7890bd</sum>
        </package>
        <package name="perl-Config-Extensions" arch="noarch" epoch="0" version="0.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Config-Extensions-0.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">088dd306bf83eb27d4800a7dc8a74248a7655b27025f6a1096a32664ad3f7e71</sum>
        </package>
        <package name="perl-DBM_Filter" arch="noarch" epoch="0" version="0.06" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-DBM_Filter-0.06-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">594a8f1acb1be8bea0d80d76529e16e209ab76632573ec320a3a255c1d93030d</sum>
        </package>
        <package name="perl-debugger" arch="noarch" epoch="0" version="1.60" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-debugger-1.60-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">116632d66aecb227ec01b561039c998967e38b11605a08c26c6975f100d3f363</sum>
        </package>
        <package name="perl-deprecate" arch="noarch" epoch="0" version="0.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-deprecate-0.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">f9b6c6d93abe972e0898aed2bd517c9dd7492b589cc43f0f542ef879705eaa16</sum>
        </package>
        <package name="perl-devel" arch="x86_64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-devel-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">66ed028cae6824ce85994b61f7ca214e8c41d875e3f608dc8c4e86b46110bb25</sum>
        </package>
        <package name="perl-Devel-Peek" arch="x86_64" epoch="0" version="1.34" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Devel-Peek-1.34-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">6896ad09a4e892ffa003e93c2c5b5b4b68dfb06fcfb64bd0b87faae9b8387001</sum>
        </package>
        <package name="perl-Devel-SelfStubber" arch="noarch" epoch="0" version="1.06" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Devel-SelfStubber-1.06-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3333f3ddba623e1659029a71773b6fdd8b06009f52f630c617f5f06869d193ab</sum>
        </package>
        <package name="perl-diagnostics" arch="noarch" epoch="0" version="1.40" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-diagnostics-1.40-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">391498cf663012d9ec9bd910b4bf53cf4234304cea25b142debbb91bda3c79ba</sum>
        </package>
        <package name="perl-DirHandle" arch="noarch" epoch="0" version="1.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-DirHandle-1.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3b7143910af7251015a7a91b80280ebe2390424ccb7e1ce5172d6fe3a2b579a7</sum>
        </package>
        <package name="perl-doc" arch="noarch" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-doc-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">1f2e5dc38f4e1c91f43dac6269bb11d7c025b27eb55e7f4eb6461ea0220704ac</sum>
        </package>
        <package name="perl-Dumpvalue" arch="noarch" epoch="0" version="2.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Dumpvalue-2.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4e035ced3d3eae3c988ec32be73475af7f253d99e8fe456d829cbca7887fd3e6</sum>
        </package>
        <package name="perl-DynaLoader" arch="x86_64" epoch="0" version="1.56" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-DynaLoader-1.56-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7b230f3a36461975bb796bf60f0dcbca697e0e522b00747f781a01e971680d4f</sum>
        </package>
        <package name="perl-encoding-warnings" arch="noarch" epoch="0" version="0.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-encoding-warnings-0.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e0901d24894adcac12d89343604cf3e8775024483b6a83d3d5913153c41faf8a</sum>
        </package>
        <package name="perl-English" arch="noarch" epoch="0" version="1.11" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-English-1.11-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">cace3f6ec93d1dddf2a3880e90a746967df8ad4b18c65e3fab3d6d2837962a59</sum>
        </package>
        <package name="perl-Errno" arch="x86_64" epoch="0" version="1.38" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Errno-1.38-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5e32d206bff50b0b9f19b624dad1024ff14f5cda9d41ba6cfb6b6d7dc8aa537f</sum>
        </package>
        <package name="perl-ExtUtils-Constant" arch="noarch" epoch="0" version="0.25" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ExtUtils-Constant-0.25-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a5254c20224062ab3e006e8a816d71f6a6f7c392afebeaf67c08189a04820674</sum>
        </package>
        <package name="perl-ExtUtils-Embed" arch="noarch" epoch="0" version="1.35" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ExtUtils-Embed-1.35-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a3a81991583e28184db2748eb512c1a95788568a6da7aafaa5ec0fc4a39b594d</sum>
        </package>
        <package name="perl-ExtUtils-Miniperl" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ExtUtils-Miniperl-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bff285dd9b50eac452554962e9533a81440ab5b293a5f8a131ed217e159b4abd</sum>
        </package>
        <package name="perl-Fcntl" arch="x86_64" epoch="0" version="1.18" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Fcntl-1.18-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">23a9127922cf33f954b1e78053e60c9186f72add5090ccb1b7b90b9b23147673</sum>
        </package>
        <package name="perl-fields" arch="noarch" epoch="0" version="2.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-fields-2.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a5185e8c106dd42e6900b9594a894c8640301c4454d6e9130996d1d2c6619743</sum>
        </package>
        <package name="perl-File-Basename" arch="noarch" epoch="0" version="2.86" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Basename-2.86-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">0e52e24b6fe11614f52f85fac01887550aca5af48322b7297add18f8bae07af8</sum>
        </package>
        <package name="perl-FileCache" arch="noarch" epoch="0" version="1.10" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-FileCache-1.10-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">ddcec09ad7b7e78312d597efb775fd0795aca5064ba933ac3ba53de6ffb70ed3</sum>
        </package>
        <package name="perl-File-Compare" arch="noarch" epoch="0" version="1.100.800" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Compare-1.100.800-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">36d9a304d4513dd8ab9b8e98d02cc609541bdbba22be1ea88b247e37ca61671f</sum>
        </package>
        <package name="perl-File-Copy" arch="noarch" epoch="0" version="2.41" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Copy-2.41-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">eed099e78ffcf4332ed8a29bfb6ea948717fc3b61b312e205a8a3bb3783abcb0</sum>
        </package>
        <package name="perl-File-DosGlob" arch="x86_64" epoch="0" version="1.12" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-DosGlob-1.12-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5923b9d3b2d251fba23daf25c33a885f065789741fc319819cc7af803b848ea2</sum>
        </package>
        <package name="perl-File-Find" arch="noarch" epoch="0" version="1.44" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Find-1.44-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">1d72ea44720cc2edbea27771dd5708935c2b1f1165c12b7bd8053a281e31bff8</sum>
        </package>
        <package name="perl-FileHandle" arch="noarch" epoch="0" version="2.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-FileHandle-2.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">da293f041854918ba2ed671bc86e0fa2495c7c6bb6bb4ae6c1d1555aa0543ccf</sum>
        </package>
        <package name="perl-File-stat" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-stat-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e68ec3b54e4a04236a01260f76f52453974a71e4ba14a85a92357e611f8f0307</sum>
        </package>
        <package name="perl-filetest" arch="noarch" epoch="0" version="1.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-filetest-1.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d722cf0a055e441a8e7f804a6cb287f292ea823b01ffa0fd6aa6b9232d28a82b</sum>
        </package>
        <package name="perl-FindBin" arch="noarch" epoch="0" version="1.54" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-FindBin-1.54-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">309befe99d17047346772695df54eb58575c000cd4da46652dfc56edc7da597f</sum>
        </package>
        <package name="perl-GDBM_File" arch="x86_64" epoch="1" version="1.24" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-GDBM_File-1.24-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9dcacfb69263607b53dbe91ba37f0b7127434cb55644e860c653f2c5a55abc3f</sum>
        </package>
        <package name="perl-Getopt-Std" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Getopt-Std-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4c704ab2ee391d717797366dd5ed6e0b4972c6915dbaf0ed0079f4cb23dd2fb3</sum>
        </package>
        <package name="perl-if" arch="noarch" epoch="0" version="0.61.000" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-if-0.61.000-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">5f355e52e71146d71223f34451b5ff1c11bc471ae8eeb0a1a84258d15c32594f</sum>
        </package>
        <package name="perl-Hash-Util" arch="x86_64" epoch="0" version="0.32" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Hash-Util-0.32-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4617726e95f16d7227a56b906129576a3f6ca18ff3e2474e7bdfb25e6bb9a0c4</sum>
        </package>
        <package name="perl-Hash-Util-FieldHash" arch="x86_64" epoch="0" version="1.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Hash-Util-FieldHash-1.27-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2448474e9a9e2c5c6a95c30af5ea461e5b4230ada3b56b2d348ffa388d8f81f6</sum>
        </package>
        <package name="perl-I18N-Collate" arch="noarch" epoch="0" version="1.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-I18N-Collate-1.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bcba8afa4f930466ff0b74cd168d0223e120524176ce70249b765a1b1b7dd280</sum>
        </package>
        <package name="perl-I18N-Langinfo" arch="x86_64" epoch="0" version="0.24" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-I18N-Langinfo-0.24-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">fecbf0ab5d50f8e0f2b71a5afc68cf2ed17e3fb874c1c9fd8d3542c681ed60b8</sum>
        </package>
        <package name="perl-I18N-LangTags" arch="noarch" epoch="0" version="0.45" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-I18N-LangTags-0.45-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">76f6d8df29b37d36d869d540fe00fab661009cb9985b188caf23892bad7b52a8</sum>
        </package>
        <package name="perl-interpreter" arch="x86_64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-interpreter-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c7f42478109294d799ccbeea3d312babe50e1ec9a5aeb2680e710354474a1e4c</sum>
        </package>
        <package name="perl-IO" arch="x86_64" epoch="0" version="1.55" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-IO-1.55-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c1ff25c73bf4655f6cf840bc9ad42efd17c9e00bde426bc60a4f6f117025c319</sum>
        </package>
        <package name="perl-IPC-Open3" arch="noarch" epoch="0" version="1.22" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-IPC-Open3-1.22-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">86b148a2756784bdcbdaff5cff28c5393ac52f4bf0216907756b57a5ba5ca92b</sum>
        </package>
        <package name="perl-less" arch="noarch" epoch="0" version="0.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-less-0.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b5e848124b09387112c1d4231c76c8def385bc0538c73b2c6ec9aa685fa9200d</sum>
        </package>
        <package name="perl-lib" arch="x86_64" epoch="0" version="0.65" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-lib-0.65-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e1474e01430a36940d9ce1740d9a4053e50bf6e7990b53983384d96306161067</sum>
        </package>
        <package name="perl-libnetcfg" arch="noarch" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-libnetcfg-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7efe3f4939bc66049dfb3820be0b55a361dfc104ba96d7878399dee3e3d68a5d</sum>
        </package>
        <package name="perl-libs" arch="x86_64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-libs-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2f79c95832a0ea14dca174af34a3537933ec7d06e8bcf81ca9006af5fa9f2c96</sum>
        </package>
        <package name="perl-locale" arch="noarch" epoch="0" version="1.12" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-locale-1.12-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a9a3b66e223867d6208946406f5b1edf6726034cdb86c60594d1d1df8381fa18</sum>
        </package>
        <package name="perl-Locale-Maketext-Simple" arch="noarch" epoch="1" version="0.21" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Locale-Maketext-Simple-0.21-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">39e29184aa99c21e97a57e97dc02717f90d377f12a3202b0e93b71ce1ff113c6</sum>
        </package>
        <package name="perl-macros" arch="noarch" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-macros-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">c338c5d3a9bd8a1c1235f1c8da239f29b9d62bf58788f9983355db0106722eaf</sum>
        </package>
        <package name="perl-Math-Complex" arch="noarch" epoch="0" version="1.62" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Math-Complex-1.62-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">6be88deaf0001307cb42142a066d5bbb8355ca3c066f287cc1dfb6c70135de31</sum>
        </package>
        <package name="perl-Memoize" arch="noarch" epoch="0" version="1.16" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Memoize-1.16-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a8b43a7f26e0da134f559117be6ec1246f4403594c78bd2c028b93ee08086207</sum>
        </package>
        <package name="perl-meta-notation" arch="noarch" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-meta-notation-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e1de3da0d11590cde4c2f31ea22160f937639c4cb14852569b46be28b046c8ee</sum>
        </package>
        <package name="perl-Module-Loaded" arch="noarch" epoch="1" version="0.08" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Module-Loaded-0.08-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3639e9e7b65277a67c7409fe4f020b3913c7ef6b948bf577ed1ae9aa34f71efc</sum>
        </package>
        <package name="perl-mro" arch="x86_64" epoch="0" version="1.29" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-mro-1.29-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">97f250b301202873e08a3f63fb0e06c12863dff43dc267e2d0ebedd4f8241467</sum>
        </package>
        <package name="perl-NDBM_File" arch="x86_64" epoch="0" version="1.17" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-NDBM_File-1.17-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">87a01482c3942b0b1b0ae90f3bb263afb2b2971ec1be2382f43bac9ce83403fc</sum>
        </package>
        <package name="perl-Net" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Net-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">589d4504637d13e2435420455917884df8727581aa80fae5b51020650ac8169f</sum>
        </package>
        <package name="perl-NEXT" arch="noarch" epoch="0" version="0.69" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-NEXT-0.69-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">6cf667a4e215805092c31399b07088b9b53ac30571429737c26ff5633c93f107</sum>
        </package>
        <package name="perl-ODBM_File" arch="x86_64" epoch="0" version="1.18" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ODBM_File-1.18-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">5fb3da69617cfaaa0b7e0ef657628c0bfdecf784cc3d47dd4037b77cd0696234</sum>
        </package>
        <package name="perl-Opcode" arch="x86_64" epoch="0" version="1.65" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Opcode-1.65-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">107e99a01aa17849e6803029c1c31ebe52d5c9cbc99d8cdb79a1e3b524b9efbd</sum>
        </package>
        <package name="perl-open" arch="noarch" epoch="0" version="1.13" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-open-1.13-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e6faf552b3ef8663aa5c008bb0170bd1937c21b052e19b38338b17af0140a2fa</sum>
        </package>
        <package name="perl-overload" arch="noarch" epoch="0" version="1.37" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-overload-1.37-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">ef05e1e0a8d4186fd2b5fc8e9726345b0d14a30e4a7eb7a66943aa51c6032a4f</sum>
        </package>
        <package name="perl-overloading" arch="noarch" epoch="0" version="0.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-overloading-0.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">418913e1c6335e9aa8f039fa6903dbba59d713bc902191272692c655b2d8f63b</sum>
        </package>
        <package name="perl-ph" arch="x86_64" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ph-5.40.2-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">e490da935a82dbbf49a8562d6e249e4a09a4afa8d599c33187bce006e3b97ee7</sum>
        </package>
        <package name="perl-Pod-Functions" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Pod-Functions-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">9544e913bae26609c973b6fac8ef231fa230e79b79966696f27dc6169b0cce16</sum>
        </package>
        <package name="perl-Pod-Html" arch="noarch" epoch="0" version="1.35" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Pod-Html-1.35-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">56640ad227c8fb21e7f72fde247757f01d905d585bea3ede000adc8db4072b87</sum>
        </package>
        <package name="perl-POSIX" arch="x86_64" epoch="0" version="2.20" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-POSIX-2.20-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7efa2d4b9ceaf5b2ebc83e68a5257bb49e2de587204fe878202d3e9d248297e8</sum>
        </package>
        <package name="perl-Safe" arch="noarch" epoch="0" version="2.46" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Safe-2.46-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d8b10fade999abb3271355112bd700b47920bc3556996606e99cc4ac445e682d</sum>
        </package>
        <package name="perl-Search-Dict" arch="noarch" epoch="0" version="1.07" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Search-Dict-1.07-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7a93698979506fa211d4570b90132e5368cc45829985baec494f877a38ec0061</sum>
        </package>
        <package name="perl-SelectSaver" arch="noarch" epoch="0" version="1.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-SelectSaver-1.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4971816006a6fd214274853c95c74c1e4af34acb2fa145d7c36d3533f115969d</sum>
        </package>
        <package name="perl-SelfLoader" arch="noarch" epoch="0" version="1.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-SelfLoader-1.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">15a01d37dcd6c51415b3d2eb973d5e64ffe93455587282661129f31e39a37164</sum>
        </package>
        <package name="perl-sigtrap" arch="noarch" epoch="0" version="1.10" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-sigtrap-1.10-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d322121627446cea0a0ce9a162ac1e5cbc3c21fed5454a614f9f3231bcd6e819</sum>
        </package>
        <package name="perl-sort" arch="noarch" epoch="0" version="2.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-sort-2.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">9a656d27009bec4a4203f84e041407805e48189799413db9637a51d307666867</sum>
        </package>
        <package name="perl-subs" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-subs-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">6f51e398f25184efd9fa656c36b32f4a66b84db33473a0084c09d2564b1fa173</sum>
        </package>
        <package name="perl-Symbol" arch="noarch" epoch="0" version="1.09" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Symbol-1.09-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e44ddbdba11f7108309e1e8268ded90b30b45d4559d329b7598c194491e65cb7</sum>
        </package>
        <package name="perl-Sys-Hostname" arch="x86_64" epoch="0" version="1.25" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Sys-Hostname-1.25-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">c80b6bc8643d134daf7dffbbdabe21e8083c5bdd95009d04015d8410f84c4ca9</sum>
        </package>
        <package name="perl-Term-Complete" arch="noarch" epoch="0" version="1.403" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Term-Complete-1.403-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bca25218698dc5bec307ab2833f95c80979801a3a50bde8578e87f5b0a9e9c6e</sum>
        </package>
        <package name="perl-Term-ReadLine" arch="noarch" epoch="0" version="1.17" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Term-ReadLine-1.17-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">eacdcb68a50137a0b436f0c843963dd397f6a08953c66383e62b6cc416203cf0</sum>
        </package>
        <package name="perl-Test" arch="noarch" epoch="0" version="1.31" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Test-1.31-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7e9be4015583373451563d4ec380e02dd4acceb46311be07128844cee2bd3c99</sum>
        </package>
        <package name="perl-Text-Abbrev" arch="noarch" epoch="0" version="1.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Text-Abbrev-1.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">25b62a751bb2a0357cfcf9b4a9e159bbacbefd6cfe0748265e62219dc9683586</sum>
        </package>
        <package name="perl-Thread" arch="noarch" epoch="0" version="3.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Thread-3.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">491d0f80e3d887e45c217e46256d581c90fb3cb07830cc546e2a6f5691b629f6</sum>
        </package>
        <package name="perl-Thread-Semaphore" arch="noarch" epoch="0" version="2.13" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Thread-Semaphore-2.13-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">638204720d76bfff46b4232b6bac608876be8f587b9c7f3d1009e3dedf806dcb</sum>
        </package>
        <package name="perl-Tie" arch="noarch" epoch="0" version="4.6" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Tie-4.6-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">5c0753c9b84119f97ee29a79a6f85d2b9b8e7b43e7ccceff30076e592529fb4e</sum>
        </package>
        <package name="perl-Tie-File" arch="noarch" epoch="0" version="1.09" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Tie-File-1.09-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">979470cf5a306f3c4dea61028b98b449ca8befcfe02987ef6e147c7321f6d3fa</sum>
        </package>
        <package name="perl-Tie-Memoize" arch="noarch" epoch="0" version="1.1" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Tie-Memoize-1.1-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">caab07ab606928b27eff25c56d245649147171e90b94c8f4ebc6168c2c04d1a6</sum>
        </package>
        <package name="perl-Time" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Time-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">9f0208c626290f1e4e435ec425e901cb8c2db44c8e1caa64fc244a9172006d4f</sum>
        </package>
        <package name="perl-Time-Piece" arch="x86_64" epoch="0" version="1.3401" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Time-Piece-1.3401-512.2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9eff6fada2e6a517941b7527afbe3cb5532c66b8a87396a9a2d42f929e404de9</sum>
        </package>
        <package name="perl-Unicode-UCD" arch="noarch" epoch="0" version="0.78" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Unicode-UCD-0.78-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">8127dfa5d5006949b78316bea4cd438b83f616dbb2c9160dee0d3c88dd354d8e</sum>
        </package>
        <package name="perl-User-pwent" arch="noarch" epoch="0" version="1.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-User-pwent-1.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">61be0c87a8ef400af759697ab882a54dc62018958aa86f3a3f6a2bac93666b68</sum>
        </package>
        <package name="perl-utils" arch="noarch" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-utils-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">c89e6e8052e14ed8e1c2d3c9c09ef67d1f90be7705d624293c916ee926fd4ae8</sum>
        </package>
        <package name="perl-vars" arch="noarch" epoch="0" version="1.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-vars-1.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">877c2bdd38a85c3510e06a9a271b5badc4b80c917109f39f65f3ca4796eca380</sum>
        </package>
        <package name="perl-vmsish" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-vmsish-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b2e68ff6ffa4970afdeff6e1d9988decbf7cabe45d08dabee3d6b41284f869d7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12064</id>
    <title>Important: unbound security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: Unbound Cache poisoning (CVE-2025-5994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5994" id="CVE-2025-5994" type="cve" title="CVE-2025-5994" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380949" id="2380949" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12064" id="RLSA-2025:12064" type="self" title="RLSA-2025:12064" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="python3-unbound" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>python3-unbound-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3f1d7b1511a92a60cbbf5fb6bdc27feb1b86ec07d133c5c7ee971a9d2e2fc502</sum>
        </package>
        <package name="unbound" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8b6bfb2ad1af3f2986123b4f930110abff31d56c3cacd7923d4dbc59f754bd8e</sum>
        </package>
        <package name="unbound-anchor" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-anchor-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">bef18b9a20c9eaa3dafc398b2824fbc51fdb104fdd8dfa29846326fd90e7072e</sum>
        </package>
        <package name="unbound-dracut" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-dracut-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">447203d5e534856a98c91d8d2c9f72e69ae17ecc0b3202fa1dcd4fb63c3743d2</sum>
        </package>
        <package name="unbound-libs" arch="x86_64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-libs-1.20.0-12.el10_0.x86_64.rpm</filename>
          <sum type="sha256">fa5d9ac0e91388efaf14e083a357d85380e23bd4d75fdb678876ec11263019bf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12188</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

* firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

* firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

* firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

* firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

* firefox: Memory safety bugs (CVE-2025-8034)

* firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

* firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

* firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8027" id="CVE-2025-8027" type="cve" title="CVE-2025-8027" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8028" id="CVE-2025-8028" type="cve" title="CVE-2025-8028" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8029" id="CVE-2025-8029" type="cve" title="CVE-2025-8029" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8030" id="CVE-2025-8030" type="cve" title="CVE-2025-8030" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8031" id="CVE-2025-8031" type="cve" title="CVE-2025-8031" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8032" id="CVE-2025-8032" type="cve" title="CVE-2025-8032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8033" id="CVE-2025-8033" type="cve" title="CVE-2025-8033" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8034" id="CVE-2025-8034" type="cve" title="CVE-2025-8034" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8035" id="CVE-2025-8035" type="cve" title="CVE-2025-8035" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382701" id="2382701" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382703" id="2382703" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382704" id="2382704" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382707" id="2382707" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382710" id="2382710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382711" id="2382711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382717" id="2382717" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382718" id="2382718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382720" id="2382720" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12188" id="RLSA-2025:12188" type="self" title="RLSA-2025:12188" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.13.0" release="3.el10_0" src="thunderbird-128.13.0-3.el10_0.src.rpm">
          <filename>thunderbird-128.13.0-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">30a11093106c28a6ca4020c2bfdfca6cc81a2a7145fe070a6a25240adb93b1a5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12850</id>
    <title>Moderate: opentelemetry-collector security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12850" id="RLSA-2025:12850" type="self" title="RLSA-2025:12850" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.127.0" release="1.el10_0" src="opentelemetry-collector-0.127.0-1.el10_0.src.rpm">
          <filename>opentelemetry-collector-0.127.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2940b974c271bfea1804c3c4dbdbcb0d527235f3ad13b392c9309a310d01c8a3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12862</id>
    <title>Moderate: gdk-pixbuf2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gdk-pixbuf2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.

Security Fix(es):

* gdk?pixbuf: Heap?buffer?overflow in gdk?pixbuf (CVE-2025-7345)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7345" id="CVE-2025-7345" type="cve" title="CVE-2025-7345" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2377063" id="2377063" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12862" id="RLSA-2025:12862" type="self" title="RLSA-2025:12862" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="gdk-pixbuf2" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_0" src="gdk-pixbuf2-2.42.12-4.el10_0.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">66f9a4dc144d229ffa2350e27492e26ed49a41df8b0f54fea62831b9b1ecd2ad</sum>
        </package>
        <package name="gdk-pixbuf2-devel" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_0" src="gdk-pixbuf2-2.42.12-4.el10_0.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">d28d66b9305cb75791d81479126e06fcd9cef8dccdb21030df0da970051d7655</sum>
        </package>
        <package name="gdk-pixbuf2-modules" arch="x86_64" epoch="0" version="2.42.12" release="4.el10_0" src="gdk-pixbuf2-2.42.12-4.el10_0.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_0.x86_64.rpm</filename>
          <sum type="sha256">954d41c9ee099e28b99b2c821bf03882acd2f44fca29125a20cef2b3700f387e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:13674</id>
    <title>Important: toolbox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for toolbox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

* nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit (CVE-2025-23266)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23266" id="CVE-2025-23266" type="cve" title="CVE-2025-23266" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2381794" id="2381794" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:13674" id="RLSA-2025:13674" type="self" title="RLSA-2025:13674" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="toolbox" arch="x86_64" epoch="0" version="0.2" release="1.el10_0" src="toolbox-0.2-1.el10_0.src.rpm">
          <filename>toolbox-0.2-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8c91f2f041be1a66ed8e4ef273f2b475d7f19c5e2c3310a4d57e6ecfe4341920</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:13941</id>
    <title>Important: golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4674" id="CVE-2025-4674" type="cve" title="CVE-2025-4674" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2384329" id="2384329" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:13941" id="RLSA-2025:13941" type="self" title="RLSA-2025:13941" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="golang" arch="x86_64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-1.24.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">4773689eb73f17d4dfc979a97cf6f866e9c421587e9e450718119c21d368ea7d</sum>
        </package>
        <package name="golang-bin" arch="x86_64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-bin-1.24.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0755f0d4bf4c83bea230a5236c327a42d1fa55261b14c0ace6a6c68d6e85b75a</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-docs-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c8015b335c5881328c5e1ea21aab8e9487e278ded209f83b111b0a870925aea1</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-misc-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9d833125417d6f49f9dc2a9c19bf9454ea27c78b6d319168faff5c6491b640b7</sum>
        </package>
        <package name="golang-race" arch="x86_64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-race-1.24.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">21d2f7850eb3272690e57cd6e3675fbe62973228227ec905c3e03a8060f3385e</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-src-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">aace02df66e63925e08917bd1704188ea6726490a414e5f5f1f5b9b0ff6051c9</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-tests-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e7152f56606fe5f068a38d2d2e40d491f9670cc56cb216e7c1d8fc558ffd4491</sum>
        </package>
        <package name="go-toolset" arch="x86_64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>go-toolset-1.24.6-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a9c32946212048fb0933b6f4b254ba7021fdc56804b34aa806b13da9df58f2f3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:13944</id>
    <title>Important: openjpeg2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openjpeg2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.

Security Fix(es):

* openjpeg: OpenJPEG OOB heap memory write (CVE-2025-54874)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54874" id="CVE-2025-54874" type="cve" title="CVE-2025-54874" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2386543" id="2386543" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:13944" id="RLSA-2025:13944" type="self" title="RLSA-2025:13944" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="openjpeg2" arch="x86_64" epoch="0" version="2.5.2" release="4.el10_0.1" src="openjpeg2-2.5.2-4.el10_0.1.src.rpm">
          <filename>openjpeg2-2.5.2-4.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">661a071484cf048ff8d3fd27790cf566fc417093f8820e61124a3cf8eb638260</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14178</id>
    <title>Important: tomcat9 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

* tomcat: Apache Tomcat denial of service (CVE-2025-52520)

* tomcat: Apache Tomcat denial of service (CVE-2025-52434)

* tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48976" id="CVE-2025-48976" type="cve" title="CVE-2025-48976" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48988" id="CVE-2025-48988" type="cve" title="CVE-2025-48988" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989" id="CVE-2025-48989" type="cve" title="CVE-2025-48989" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49125" id="CVE-2025-49125" type="cve" title="CVE-2025-49125" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52434" id="CVE-2025-52434" type="cve" title="CVE-2025-52434" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52520" id="CVE-2025-52520" type="cve" title="CVE-2025-52520" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506" id="CVE-2025-53506" type="cve" title="CVE-2025-53506" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373015" id="2373015" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373018" id="2373018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373020" id="2373020" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373309" id="2373309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379374" id="2379374" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379382" id="2379382" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379386" id="2379386" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14178" id="RLSA-2025:14178" type="self" title="RLSA-2025:14178" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">74e2a6fbef93fe6dada5062baa99ea2ae81539c66150c379e326ceff3d5f00ae</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">d5991ed5ea05046e1b9ded1ee71728137bf6cd5265e7a85fd43cc234b4a63cf1</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">27e9f00f4b4db5a618c88766816ea04e334e413b81d6df87309f92e797f2af01</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">661c5eb96bedd37e4dd1988be1912a09dfb4246df01619be0a95decb6a739a0a</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">d564b100d3af37696d23407cbec19f38dc10d5f263bc6463526307f297f9e751</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-lib-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">56221df788f2fd94b729cbc24645ef14577c2a60e21394c4ccebbe3c466e437a</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">197343759673b4df77e1cd4b653ff18640c1145a111abcf65f293bdf2cd640b3</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-webapps-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">a92fb0bc741de5bed29ded39ffc1090c13d44d8e4663ed876455b9ec62dc79f0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14179</id>
    <title>Important: tomcat security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

* tomcat: Apache Tomcat denial of service (CVE-2025-52520)

* tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48976" id="CVE-2025-48976" type="cve" title="CVE-2025-48976" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48988" id="CVE-2025-48988" type="cve" title="CVE-2025-48988" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989" id="CVE-2025-48989" type="cve" title="CVE-2025-48989" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49125" id="CVE-2025-49125" type="cve" title="CVE-2025-49125" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52520" id="CVE-2025-52520" type="cve" title="CVE-2025-52520" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506" id="CVE-2025-53506" type="cve" title="CVE-2025-53506" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373015" id="2373015" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373018" id="2373018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373020" id="2373020" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373309" id="2373309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379374" id="2379374" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379386" id="2379386" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14179" id="RLSA-2025:14179" type="self" title="RLSA-2025:14179" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">ecb917e318806b30780490e980d3321c09c3a9d0a55191e03a6e6aa155bb2f9b</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-admin-webapps-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">a170a83d4db067f3716cc75b312457ae573a69b8abc08e35bf067456dd8d6556</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-docs-webapp-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">afc999a8b23e6e5bcd6fa3cb5dd0cec0c53b7092bdb3c8f5763ba7523102d44c</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">d74a96e6451c0457caf006ecf5cb3f9c05a335f5155526ff7e43ea76d96de5ec</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">40f0d2b7943d8439b32a461f3b324e8add8d7a2eb2989ca4c685b0a4ff0806bd</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-lib-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">ae430958b25c1ff702c75b963827c5cd5c79c9d0e1b7cc97c10a86e80c3e2625</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">eafac0514a1c171b579247cb0bd32de6b9e6446344213797e664d21eb1f5ee3f</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-webapps-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">b7378649e8898b6bbbbaaf8633261fdfb57139d41c243d6269728b2a2ecaf834</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14417</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182)

* thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179)

* thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180)

* thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9179" id="CVE-2025-9179" type="cve" title="CVE-2025-9179" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9180" id="CVE-2025-9180" type="cve" title="CVE-2025-9180" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9181" id="CVE-2025-9181" type="cve" title="CVE-2025-9181" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9182" id="CVE-2025-9182" type="cve" title="CVE-2025-9182" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9185" id="CVE-2025-9185" type="cve" title="CVE-2025-9185" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389575" id="2389575" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389580" id="2389580" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389581" id="2389581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389583" id="2389583" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389584" id="2389584" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14417" id="RLSA-2025:14417" type="self" title="RLSA-2025:14417" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="128.14.0" release="2.el10_0" src="firefox-128.14.0-2.el10_0.src.rpm">
          <filename>firefox-128.14.0-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">b97a2317f96b8feef7e492b4cb4ffbbb9782cce5c616b012d86aa3e66abf498e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14592</id>
    <title>Important: aide security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for aide.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the system, and then uses that database to ensure file integrity and detect system intrusions.

Security Fix(es):

* aide: improper output neutralization enables bypassing (CVE-2025-54389)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54389" id="CVE-2025-54389" type="cve" title="CVE-2025-54389" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388019" id="2388019" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14592" id="RLSA-2025:14592" type="self" title="RLSA-2025:14592" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="aide" arch="x86_64" epoch="0" version="0.18.6" release="8.el10_0.2" src="aide-0.18.6-8.el10_0.2.src.rpm">
          <filename>aide-0.18.6-8.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">300101ceefc672071558b57905fdb3c5a96576f3cbe095bf288ced153e54045d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14625</id>
    <title>Moderate: mod_http2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_http2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module (CVE-2025-49630)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49630" id="CVE-2025-49630" type="cve" title="CVE-2025-49630" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374578" id="2374578" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14625" id="RLSA-2025:14625" type="self" title="RLSA-2025:14625" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mod_http2" arch="x86_64" epoch="0" version="2.0.29" release="2.el10_0.1" src="mod_http2-2.0.29-2.el10_0.1.src.rpm">
          <filename>mod_http2-2.0.29-2.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">d1884648d02e52f78744980b0854319fdb9cc81785ecc0adc9539a034921e3ee</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14826</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715)

* postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8714" id="CVE-2025-8714" type="cve" title="CVE-2025-8714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8715" id="CVE-2025-8715" type="cve" title="CVE-2025-8715" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388551" id="2388551" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388553" id="2388553" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14826" id="RLSA-2025:14826" type="self" title="RLSA-2025:14826" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="postgresql" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">8cd80777b34c819cc7e4bc10b19d6d9ffbaed6ccdc1432f57acc67aa7b8dd396</sum>
        </package>
        <package name="postgresql-contrib" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-contrib-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">38364941fbc18245b63ddf2b13994fa782ba5024bace018f14f078f99d9d635e</sum>
        </package>
        <package name="postgresql-docs" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-docs-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9719920fa164c4907a97074fb5ac02709e7a8d619bc3af175882d865eafd5f25</sum>
        </package>
        <package name="postgresql-plperl" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-plperl-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0afb3c1c78b173ed3e796c79329c5274154b2a89078baf31ce09a2cda93f2e22</sum>
        </package>
        <package name="postgresql-plpython3" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-plpython3-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0960eb82e13777663b28b7d70cf3c723774829f888a095081d9442b8519f38f4</sum>
        </package>
        <package name="postgresql-pltcl" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-pltcl-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0396a671dbcec458076cae4d8a8a9cfb7b0d0ce3ed754376962614520cd65303</sum>
        </package>
        <package name="postgresql-private-devel" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-private-devel-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2f7b20cc8990ad2ccac0a23796109cdd66728729a79d650d5ec7aac5330b50d2</sum>
        </package>
        <package name="postgresql-private-libs" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-private-libs-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a4ceb637a258938880c10f69443db1ff9f15fef0444f2ef5158bc4d4a0218e8d</sum>
        </package>
        <package name="postgresql-server" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-server-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">3228acafccd043fa04f2b22bb2c6a61db6f1b76e43f461f1798abf3f92ee06e2</sum>
        </package>
        <package name="postgresql-server-devel" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-server-devel-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7d84eb6ea1f6f578bfa5dbd1c42f3fc1447664b4896607bc3ca31d735ebc9363</sum>
        </package>
        <package name="postgresql-static" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-static-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">1ac5a23e23a31d13be65a39f326d09fde91054f5554d5542575b49cbff5ee1f0</sum>
        </package>
        <package name="postgresql-test" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-test-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">606e819a9f03a218208da7ff34fe8a153c44eeedd1232465ff93e7fcdb717708</sum>
        </package>
        <package name="postgresql-upgrade" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-upgrade-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0b64a4ea83374fe2b3503613d0542c450a2f1d2a2524ab7b638aa5ac45a81734</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="x86_64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-upgrade-devel-16.10-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">669a11b5116fdef6d3304ed23e66b88ab1750688ec45c0b9e81b9493c147f37d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14844</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182)

* thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179)

* thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180)

* thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9179" id="CVE-2025-9179" type="cve" title="CVE-2025-9179" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9180" id="CVE-2025-9180" type="cve" title="CVE-2025-9180" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9181" id="CVE-2025-9181" type="cve" title="CVE-2025-9181" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9182" id="CVE-2025-9182" type="cve" title="CVE-2025-9182" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9185" id="CVE-2025-9185" type="cve" title="CVE-2025-9185" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389575" id="2389575" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389580" id="2389580" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389581" id="2389581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389583" id="2389583" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389584" id="2389584" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14844" id="RLSA-2025:14844" type="self" title="RLSA-2025:14844" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="128.14.0" release="3.el10_0" src="thunderbird-128.14.0-3.el10_0.src.rpm">
          <filename>thunderbird-128.14.0-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">134e70204196593438adfcb520cc121b4d9e16e69f6b6cb936e7c06f51bf0b33</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15020</id>
    <title>Important: udisks2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for udisks2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.

Security Fix(es):

* udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8067" id="CVE-2025-8067" type="cve" title="CVE-2025-8067" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388623" id="2388623" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15020" id="RLSA-2025:15020" type="self" title="RLSA-2025:15020" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libudisks2" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>libudisks2-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">40eb9968d41395f4ab6a90b3c9eda76224286c55746be2c0e062a35bc76a8555</sum>
        </package>
        <package name="udisks2" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">80ff25c3775358e4d7c4e56c5c53110bac64a7b5ecd378e5c20dbb3b36358a12</sum>
        </package>
        <package name="udisks2-iscsi" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-iscsi-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">cc8c2a8d5c5accfa7602c900d3c24a54a1cdbc2b13e9f5d3f7db736c111655df</sum>
        </package>
        <package name="udisks2-lsm" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-lsm-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">579dd9b6478a9fda3ed9634977576798c0417a7c5240cf5dd74da8b4ac3f6133</sum>
        </package>
        <package name="udisks2-lvm2" arch="x86_64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-lvm2-2.10.90-5.el10_0.1.x86_64.rpm</filename>
          <sum type="sha256">42b05cc7cbde4ffb55c2e385dda6f6c0ac99711aa89c753da90123d80a83e339</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15095</id>
    <title>Moderate: httpd security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252)

* httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption (CVE-2025-23048)

* httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47252" id="CVE-2024-47252" type="cve" title="CVE-2024-47252" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23048" id="CVE-2025-23048" type="cve" title="CVE-2025-23048" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49812" id="CVE-2025-49812" type="cve" title="CVE-2025-49812" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374571" id="2374571" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374576" id="2374576" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374580" id="2374580" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15095" id="RLSA-2025:15095" type="self" title="RLSA-2025:15095" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="httpd" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">39ca4a5d5c294d34d01c023a4b910afc40c33021d06da156f0caa6550ce3b110</sum>
        </package>
        <package name="httpd-core" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-core-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">d7d9671ab8d83e12f24f6dc0a4f56359b97b7f41f13bc27ce4ee3fa6a7e76658</sum>
        </package>
        <package name="httpd-devel" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-devel-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">ecc7fb15fb30551214e2903835b6cf18082d7b513634f35bf0b6b4405b881578</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-filesystem-2.4.63-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">5be7b3a8027ace91358c2f798e53f4dcc46b2e434314f8c1cca16d3d37b96673</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-manual-2.4.63-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">f55510c6628918f1cb42924ddff3203f84c000b1cd1e4db33205dc9ed5d67887</sum>
        </package>
        <package name="httpd-tools" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-tools-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">554e7a94a09e954d418849aa0e45d8df9321a0290415f981838c7a1ebd0989bc</sum>
        </package>
        <package name="mod_ldap" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_ldap-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">34034827fab21af66821cda08bb43f1e4ea58f89d4c831c2506cbc612705ed5d</sum>
        </package>
        <package name="mod_lua" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_lua-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">1b98d4a377dd657733e01534beda2d6c3a5e8eacdf86c79753dd72e9bf787d3a</sum>
        </package>
        <package name="mod_proxy_html" arch="x86_64" epoch="1" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_proxy_html-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">51df5b13d065599821869e580bfa170a9ff8ea6bbeee015bf5079d9c4694cec3</sum>
        </package>
        <package name="mod_session" arch="x86_64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_session-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">27967d4859b4993756634ff9cbb356d525f3730ef8cde12008a69689c6e7dbe4</sum>
        </package>
        <package name="mod_ssl" arch="x86_64" epoch="1" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_ssl-2.4.63-1.el10_0.2.x86_64.rpm</filename>
          <sum type="sha256">ca37c31b3af38af84a1f1f770d592bbf09713d197046738b794b13c8d136eea8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15699</id>
    <title>Moderate: mysql-selinux and mysql8.4 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4, mysql-selinux.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)

* mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)

* mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)

* mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)

* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)

* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)

* mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)

* mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)

* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)

* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)

* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)

* mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)

* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)

* mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)

* curl: libcurl: WebSocket endless loop (CVE-2025-5399)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)

* mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)

* mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)

* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)

* mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)

* mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)

* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)

* mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)

* mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100)

* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094)

* mysql: Optimizer  unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13176" id="CVE-2024-13176" type="cve" title="CVE-2024-13176" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21574" id="CVE-2025-21574" type="cve" title="CVE-2025-21574" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21575" id="CVE-2025-21575" type="cve" title="CVE-2025-21575" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21577" id="CVE-2025-21577" type="cve" title="CVE-2025-21577" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21579" id="CVE-2025-21579" type="cve" title="CVE-2025-21579" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21580" id="CVE-2025-21580" type="cve" title="CVE-2025-21580" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21581" id="CVE-2025-21581" type="cve" title="CVE-2025-21581" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21584" id="CVE-2025-21584" type="cve" title="CVE-2025-21584" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21585" id="CVE-2025-21585" type="cve" title="CVE-2025-21585" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21588" id="CVE-2025-21588" type="cve" title="CVE-2025-21588" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30681" id="CVE-2025-30681" type="cve" title="CVE-2025-30681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30682" id="CVE-2025-30682" type="cve" title="CVE-2025-30682" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30683" id="CVE-2025-30683" type="cve" title="CVE-2025-30683" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30684" id="CVE-2025-30684" type="cve" title="CVE-2025-30684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30685" id="CVE-2025-30685" type="cve" title="CVE-2025-30685" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30687" id="CVE-2025-30687" type="cve" title="CVE-2025-30687" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30688" id="CVE-2025-30688" type="cve" title="CVE-2025-30688" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30689" id="CVE-2025-30689" type="cve" title="CVE-2025-30689" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693" id="CVE-2025-30693" type="cve" title="CVE-2025-30693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30695" id="CVE-2025-30695" type="cve" title="CVE-2025-30695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30696" id="CVE-2025-30696" type="cve" title="CVE-2025-30696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30699" id="CVE-2025-30699" type="cve" title="CVE-2025-30699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30703" id="CVE-2025-30703" type="cve" title="CVE-2025-30703" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30704" id="CVE-2025-30704" type="cve" title="CVE-2025-30704" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30705" id="CVE-2025-30705" type="cve" title="CVE-2025-30705" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30715" id="CVE-2025-30715" type="cve" title="CVE-2025-30715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30721" id="CVE-2025-30721" type="cve" title="CVE-2025-30721" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722" id="CVE-2025-30722" type="cve" title="CVE-2025-30722" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50077" id="CVE-2025-50077" type="cve" title="CVE-2025-50077" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50078" id="CVE-2025-50078" type="cve" title="CVE-2025-50078" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50079" id="CVE-2025-50079" type="cve" title="CVE-2025-50079" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50080" id="CVE-2025-50080" type="cve" title="CVE-2025-50080" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50081" id="CVE-2025-50081" type="cve" title="CVE-2025-50081" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50082" id="CVE-2025-50082" type="cve" title="CVE-2025-50082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50083" id="CVE-2025-50083" type="cve" title="CVE-2025-50083" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50084" id="CVE-2025-50084" type="cve" title="CVE-2025-50084" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50085" id="CVE-2025-50085" type="cve" title="CVE-2025-50085" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50086" id="CVE-2025-50086" type="cve" title="CVE-2025-50086" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50087" id="CVE-2025-50087" type="cve" title="CVE-2025-50087" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50088" id="CVE-2025-50088" type="cve" title="CVE-2025-50088" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50091" id="CVE-2025-50091" type="cve" title="CVE-2025-50091" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50092" id="CVE-2025-50092" type="cve" title="CVE-2025-50092" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50093" id="CVE-2025-50093" type="cve" title="CVE-2025-50093" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50094" id="CVE-2025-50094" type="cve" title="CVE-2025-50094" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50096" id="CVE-2025-50096" type="cve" title="CVE-2025-50096" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50097" id="CVE-2025-50097" type="cve" title="CVE-2025-50097" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50098" id="CVE-2025-50098" type="cve" title="CVE-2025-50098" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50099" id="CVE-2025-50099" type="cve" title="CVE-2025-50099" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50100" id="CVE-2025-50100" type="cve" title="CVE-2025-50100" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50101" id="CVE-2025-50101" type="cve" title="CVE-2025-50101" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50102" id="CVE-2025-50102" type="cve" title="CVE-2025-50102" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50104" id="CVE-2025-50104" type="cve" title="CVE-2025-50104" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5399" id="CVE-2025-5399" type="cve" title="CVE-2025-5399" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2338999" id="2338999" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359885" id="2359885" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359888" id="2359888" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359892" id="2359892" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359894" id="2359894" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359895" id="2359895" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359899" id="2359899" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359900" id="2359900" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359902" id="2359902" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359903" id="2359903" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359911" id="2359911" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359918" id="2359918" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359920" id="2359920" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359924" id="2359924" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359928" id="2359928" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359930" id="2359930" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359932" id="2359932" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359934" id="2359934" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359938" id="2359938" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359940" id="2359940" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359943" id="2359943" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359944" id="2359944" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359945" id="2359945" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359947" id="2359947" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359950" id="2359950" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359963" id="2359963" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359964" id="2359964" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359972" id="2359972" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2370920" id="2370920" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380264" id="2380264" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380273" id="2380273" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380274" id="2380274" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380278" id="2380278" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380280" id="2380280" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380283" id="2380283" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380284" id="2380284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380290" id="2380290" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380291" id="2380291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380295" id="2380295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380298" id="2380298" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380306" id="2380306" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380308" id="2380308" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380309" id="2380309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380310" id="2380310" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380312" id="2380312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380313" id="2380313" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380320" id="2380320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380321" id="2380321" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380322" id="2380322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380326" id="2380326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380327" id="2380327" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380334" id="2380334" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380335" id="2380335" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15699" id="RLSA-2025:15699" type="self" title="RLSA-2025:15699" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="mysql8.4" arch="x86_64" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-8.4.6-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">9ab4f1b27cce2084ed507afd86531225d9894f5fa19471f3bc107d9f8720f303</sum>
        </package>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-common-8.4.6-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b00f64905687fb131a234fa7eb8cfbf01c82d55158e117d99ce6b0f8dfff877c</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-errmsg-8.4.6-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4e4119b62c7395860583065fc1a0792e5cf336b0e3820babc0b39cc7de6528f0</sum>
        </package>
        <package name="mysql8.4-libs" arch="x86_64" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-libs-8.4.6-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2e49268285cb97841baf89326dddb5842839c1ceef2f0a8acb4d28b934d2540a</sum>
        </package>
        <package name="mysql8.4-server" arch="x86_64" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-server-8.4.6-2.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2c4d73fc062ba4634dbf7d31a073d67ce222416ec72d114fc747c7e371e611b7</sum>
        </package>
        <package name="mysql-selinux" arch="noarch" epoch="0" version="1.0.14" release="1.el10_0" src="mysql-selinux-1.0.14-1.el10_0.src.rpm">
          <filename>mysql-selinux-1.0.14-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6e96fc73b86d1fcb2205efe0362501f06665351449502bf0ca4bd11e15c17025</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15901</id>
    <title>Important: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: Podman kube play command may overwrite host files (CVE-2025-9566)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9566" id="CVE-2025-9566" type="cve" title="CVE-2025-9566" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393152" id="2393152" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15901" id="RLSA-2025:15901" type="self" title="RLSA-2025:15901" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="podman" arch="x86_64" epoch="6" version="5.4.0" release="13.el10_0" src="podman-5.4.0-13.el10_0.src.rpm">
          <filename>podman-5.4.0-13.el10_0.x86_64.rpm</filename>
          <sum type="sha256">7d23f0629fb06750e84793a2525875cbd4af6d291d14b0de9558e2faac04e91b</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="13.el10_0" src="podman-5.4.0-13.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-13.el10_0.noarch.rpm</filename>
          <sum type="sha256">d244c5274a4dcfb729f6b4dbaa6d690299fe89c525f5c66f69555dfca5fe9963</sum>
        </package>
        <package name="podman-remote" arch="x86_64" epoch="6" version="5.4.0" release="13.el10_0" src="podman-5.4.0-13.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-13.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0ea8eb676c816bc60039e71c10f4f8bd94c93161cdca61b52d21c52254b74c2e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16109</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527)

* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532)

* firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528)

* firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537)

* firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536)

* firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10527" id="CVE-2025-10527" type="cve" title="CVE-2025-10527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10528" id="CVE-2025-10528" type="cve" title="CVE-2025-10528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10529" id="CVE-2025-10529" type="cve" title="CVE-2025-10529" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10532" id="CVE-2025-10532" type="cve" title="CVE-2025-10532" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10533" id="CVE-2025-10533" type="cve" title="CVE-2025-10533" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10536" id="CVE-2025-10536" type="cve" title="CVE-2025-10536" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10537" id="CVE-2025-10537" type="cve" title="CVE-2025-10537" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395745" id="2395745" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395754" id="2395754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395755" id="2395755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395756" id="2395756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395759" id="2395759" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395764" id="2395764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395766" id="2395766" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16109" id="RLSA-2025:16109" type="self" title="RLSA-2025:16109" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="firefox" arch="x86_64" epoch="0" version="140.3.0" release="1.el10_0" src="firefox-140.3.0-1.el10_0.src.rpm">
          <filename>firefox-140.3.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">2345152d5d4165f4c5e39aea5b178b188c25f7ba240a8a485df5a0d0143448f5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16157</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527)

* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532)

* firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528)

* firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537)

* firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536)

* firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10527" id="CVE-2025-10527" type="cve" title="CVE-2025-10527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10528" id="CVE-2025-10528" type="cve" title="CVE-2025-10528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10529" id="CVE-2025-10529" type="cve" title="CVE-2025-10529" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10532" id="CVE-2025-10532" type="cve" title="CVE-2025-10532" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10533" id="CVE-2025-10533" type="cve" title="CVE-2025-10533" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10536" id="CVE-2025-10536" type="cve" title="CVE-2025-10536" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10537" id="CVE-2025-10537" type="cve" title="CVE-2025-10537" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395745" id="2395745" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395754" id="2395754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395755" id="2395755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395756" id="2395756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395759" id="2395759" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395764" id="2395764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395766" id="2395766" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16157" id="RLSA-2025:16157" type="self" title="RLSA-2025:16157" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="thunderbird" arch="x86_64" epoch="0" version="140.3.0" release="1.el10_0" src="thunderbird-140.3.0-1.el10_0.src.rpm">
          <filename>thunderbird-140.3.0-1.el10_0.x86_64.rpm</filename>
          <sum type="sha256">a2f2ebef365786d8c0e92016e86ef41ec86f473eda609b9e7301be160c661282</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16432</id>
    <title>Moderate: opentelemetry-collector security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4673" id="CVE-2025-4673" type="cve" title="CVE-2025-4673" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373305" id="2373305" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16432" id="RLSA-2025:16432" type="self" title="RLSA-2025:16432" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="x86_64" epoch="0" version="0.127.0" release="3.el10_0" src="opentelemetry-collector-0.127.0-3.el10_0.src.rpm">
          <filename>opentelemetry-collector-0.127.0-3.el10_0.x86_64.rpm</filename>
          <sum type="sha256">0fa9ee24ea481ad6ad221feb3d4898453ec90b7f5c4cb474738130a9eee8d061</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16428</id>
    <title>Moderate: libtpms security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libtpms.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.

Security Fix(es):

* libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49133" id="CVE-2025-49133" type="cve" title="CVE-2025-49133" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2371585" id="2371585" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16428" id="RLSA-2025:16428" type="self" title="RLSA-2025:16428" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-x86-64-appstream-rpms">
        <name>rocky-linux-10-x86-64-appstream-rpms</name>
        <package name="libtpms" arch="x86_64" epoch="0" version="0.9.6" release="11.el10_0" src="libtpms-0.9.6-11.el10_0.src.rpm">
          <filename>libtpms-0.9.6-11.el10_0.x86_64.rpm</filename>
          <sum type="sha256">12dd8cdfc9050211f18b483635b05acddb0e961ed09c239b7fb360177b474f04</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>